@openwop/openwop-conformance 2.0.0-rc.0 → 2.0.0-rc.10

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 473,
-    "tests": 1974,
-    "withStableId": 1974,
+    "files": 544,
+    "tests": 2118,
+    "withStableId": 2118,
     "interpolatedTitles": 0,
-    "explicitIds": 1939
+    "explicitIds": 2057
   },
   "records": [
     {
@@ -25741,6 +25741,2558 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-advertised-fixtures-exist.every-advertised-fixture-id-is-one-the-corpus-defines",
+      "file": "v2-advertised-fixtures-exist.test.ts",
+      "line": 60,
+      "title": "every advertised fixture id is one the corpus defines",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-advertised-fixtures-exist.a-sampled-advertised-fixture-is-actually-creatable-not-just-listed",
+      "file": "v2-advertised-fixtures-exist.test.ts",
+      "line": 80,
+      "title": "a sampled advertised fixture is actually creatable, not just listed",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approver-enforced.a-resolver-outside-approverslist-is-refused-at-resolve-time",
+      "file": "v2-approver-enforced.test.ts",
+      "line": 52,
+      "title": "a resolver outside approversList is refused at resolve time",
+      "explicitId": "openwop.requirement.0173.approver-enforced",
+      "citations": [
+        {
+          "section": "facets/interrupt.schema.json refKinds",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "interrupt.md §Approver enforcement",
+          "requirement": "the fixture MUST suspend on its approval gate (status waiting-approval) before a resolve can be attempted"
+        },
+        {
+          "section": "interrupt.md §Approver enforcement",
+          "requirement": "a host advertising `interrupt` MUST refuse a resolver not in approversList with 403 (RFC 0173 §B — enforcement, not advice)"
+        },
+        {
+          "section": "errors.json",
+          "requirement": "the refusal MUST carry a registered 403 code (forbidden | run_forbidden) in the canonical envelope"
+        },
+        {
+          "section": "interrupt.md §Approver enforcement",
+          "requirement": "a refused resolve MUST NOT resume the run — the interrupt stays pending"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-assurance-downgrade-audited.an-identity-below-the-lane-floor-is-refused-with-sender-constraint-missing",
+      "file": "v2-assurance-downgrade-audited.test.ts",
+      "line": 53,
+      "title": "an identity below the lane floor is refused with sender_constraint_missing",
+      "explicitId": "openwop.requirement.0170.assurance-downgrade-audited.refused",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be sender_constraint_missing",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-assurance-downgrade-audited.a-resolved-identity-records-the-assurance-actually-used-never-a-downgraded-beare",
+      "file": "v2-assurance-downgrade-audited.test.ts",
+      "line": 63,
+      "title": "a resolved identity records the assurance actually used, never a downgraded bearer under a sender-constrained label",
+      "explicitId": "openwop.requirement.0170.assurance-downgrade-audited.audited",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-v3-signed.a-signed-v3-bundle-validates-against-the-closed-root-schema-an-extra-root-key-is",
+      "file": "v2-bundle-v3-signed.test.ts",
+      "line": 60,
+      "title": "a signed v3 bundle validates against the closed-root schema; an extra root key is rejected",
+      "explicitId": "openwop.requirement.0168.bundle-v3-signed.schema-closed-root",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the v3 root is closed — an unknown root key MUST be rejected (RFC 0168 §E.1)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-v3-signed.the-attestation-verifies-under-the-host-key-and-a-flipped-witnesssha256-is-refus",
+      "file": "v2-bundle-v3-signed.test.ts",
+      "line": 69,
+      "title": "the attestation verifies under the host key, and a flipped witnessSha256 is refused with witness-digest",
+      "explicitId": "openwop.requirement.0168.bundle-v3-signed.witness-digest",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the Ed25519 attestation MUST verify under the host key",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a witnessSha256 that is not the digest of the rows MUST be refused with witness-digest (RFC 0148 §C)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the attestation covers witnessSha256, so a flipped digest MUST NOT verify under the host key",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-v3-signed.an-independent-claim-self-signed-under-the-host-key-is-refused-a-distinct-verifi",
+      "file": "v2-bundle-v3-signed.test.ts",
+      "line": 82,
+      "title": "an independent claim self-signed under the host key is refused; a distinct verifier key verifies",
+      "explicitId": "openwop.requirement.0168.bundle-v3-signed.independent-self-signed",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "an independent claim whose verifier key id equals the host key id MUST be refused with independent-self-signed (RFC 0148 R5)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a refused independent claim MUST NOT certify",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the verifier attestation MUST verify under the verifier key",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capabilities-root-closed.the-host-document-validates-against-capabilities-schema-json",
+      "file": "v2-capabilities-root-closed.test.ts",
+      "line": 32,
+      "title": "the host document validates against capabilities.schema.json",
+      "explicitId": "openwop.requirement.0169.capabilities-root-closed.valid",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capabilities-root-closed.an-unknown-root-key-fails-validation",
+      "file": "v2-capabilities-root-closed.test.ts",
+      "line": 40,
+      "title": "an unknown root key fails validation",
+      "explicitId": "openwop.requirement.0169.capabilities-root-closed.unknown-root-key",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "any root key that is not a metadata key, a declared family, or `extensions` MUST fail validation",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capabilities-root-closed.a-dotted-mirror-key-fails-validation",
+      "file": "v2-capabilities-root-closed.test.ts",
+      "line": 46,
+      "title": "a dotted mirror key fails validation",
+      "explicitId": "openwop.requirement.0169.capabilities-root-closed.dotted-key",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a dotted key (the v1 `host.<family>` mirror) MUST fail validation at the closed root",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capabilities-root-closed.the-v1-capabilities-wrapper-fails-validation",
+      "file": "v2-capabilities-root-closed.test.ts",
+      "line": 52,
+      "title": "the v1 `capabilities` wrapper fails validation",
+      "explicitId": "openwop.requirement.0169.capabilities-root-closed.wrapper",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the v1 `capabilities` wrapper MUST fail validation at the closed root (migration row C2.1)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capabilities-root-closed.a-root-profiles-fails-validation",
+      "file": "v2-capabilities-root-closed.test.ts",
+      "line": 58,
+      "title": "a root `profiles[]` fails validation",
+      "explicitId": "openwop.requirement.0169.capabilities-root-closed.profiles",
+      "citations": [
+        {
+          "section": "spec/v2/core/capabilities.md §7",
+          "requirement": "no `profiles[]` exists at the v2 root; a host that emits one MUST fail schema validation (row C2.10)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capability-record-shape.every-family-record-carries-status-since-and-witness-from-the-wire-legal-sets",
+      "file": "v2-capability-record-shape.test.ts",
+      "line": 66,
+      "title": "every family record carries status, since and witness from the wire-legal sets",
+      "explicitId": "openwop.requirement.0169.capability-record-shape.required-fields",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capability-record-shape.until-is-present-iff-the-record-is-experimental-or-deprecated",
+      "file": "v2-capability-record-shape.test.ts",
+      "line": 79,
+      "title": "`until` is present iff the record is experimental or deprecated",
+      "explicitId": "openwop.requirement.0169.capability-record-shape.until-iff-not-stable",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-capability-record-shape.no-advertised-record-carries-an-until-already-in-the-past",
+      "file": "v2-capability-record-shape.test.ts",
+      "line": 94,
+      "title": "no advertised record carries an `until` already in the past",
+      "explicitId": "openwop.requirement.0169.capability-record-shape.until-not-past",
+      "citations": [
+        {
+          "section": "spec/v2/core/capabilities.md §2 (`until` in the past)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-chain-pin-exact.a-chain-reference-carrying-a-range-core-ai-callprompt-1-is-refused-at-register",
+      "file": "v2-chain-pin-exact.test.ts",
+      "line": 102,
+      "title": "a chain reference carrying a range (core.ai.callPrompt@^1) is refused at register",
+      "explicitId": "openwop.requirement.0177.chain-pin-exact.range-refused",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal MUST carry an error code in the canonical envelope",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-chain-pin-exact.a-chain-reference-pinning-an-exact-version-core-ai-callprompt-1-0-0-registers",
+      "file": "v2-chain-pin-exact.test.ts",
+      "line": 111,
+      "title": "a chain reference pinning an exact version (core.ai.callPrompt@1.0.0) registers",
+      "explicitId": "openwop.requirement.0177.chain-pin-exact.exact-accepted",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-coherence-not-in-bundle.every-corpus-ledger-id-has-a-scenario-in-src-coherence-and-none-in-src-scenarios",
+      "file": "v2-coherence-not-in-bundle.test.ts",
+      "line": 60,
+      "title": "every corpus-ledger id has a scenario in src/coherence and none in src/scenarios — the two id sets are disjoint by construction",
+      "explicitId": "openwop.requirement.0168.coherence-not-in-bundle.disjoint-by-construction",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the corpus ledger MUST carry at least one requirement id",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-coherence-not-in-bundle.the-bundle-schema-rejects-a-v3-bundle-carrying-a-corpus-coherence-id-and-accepts",
+      "file": "v2-coherence-not-in-bundle.test.ts",
+      "line": 89,
+      "title": "the bundle schema rejects a v3 bundle carrying a corpus-coherence id and accepts one under openwop.requirement.",
+      "explicitId": "openwop.requirement.0168.coherence-not-in-bundle.schema-forbids-coherence-ids",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a v3 bundle carrying an openwop.it.spec-corpus-validity. id MUST be rejected by the bundle schema",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-compensation-read-projection.get-runs-runid-compensation-on-a-fresh-run-validates-with-status-none",
+      "file": "v2-compensation-read-projection.test.ts",
+      "line": 43,
+      "title": "GET /runs/{runId}/compensation on a fresh run validates with status none",
+      "explicitId": "openwop.requirement.0173.compensation-read-projection",
+      "citations": [
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
+        {
+          "section": "security-defaults.md §Compensation",
+          "requirement": "a host advertising `compensation` MUST serve GET /runs/{runId}/compensation with 200 (RFC 0173 §B — the read projection is the obligation's witness)"
+        },
+        {
+          "section": "compensation-projection.schema.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "compensation-projection.schema.json runId",
+          "requirement": "runId MUST echo the run read"
+        },
+        {
+          "section": "compensation-projection.schema.json status",
+          "requirement": "a run with nothing to compensate MUST project status \"none\""
+        },
+        {
+          "section": "compensation-projection.schema.json attempts",
+          "requirement": "no attempt exists before an unwind"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-compensation-read-projection.an-unknown-run-projects-404-not-found-through-the-canonical-envelope",
+      "file": "v2-compensation-read-projection.test.ts",
+      "line": 74,
+      "title": "an unknown run projects 404 not_found through the canonical envelope",
+      "explicitId": "openwop.requirement.0173.compensation-read-projection.not-found",
+      "citations": [
+        {
+          "section": "openapi.yaml getRunCompensation 404",
+          "requirement": "an unknown runId MUST answer 404"
+        },
+        {
+          "section": "errors.md §Envelope",
+          "requirement": "the 404 MUST carry the registered not_found code in the flat envelope"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-configurable-closed.the-standalone-schema-rejects-a-dotted-key-and-an-unknown-root-key-and-accepts-t",
+      "file": "v2-configurable-closed.test.ts",
+      "line": 46,
+      "title": "the standalone schema rejects a dotted key and an unknown root key and accepts the versioned control",
+      "explicitId": "openwop.requirement.0171.configurable-closed.schema",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "{ version: 1 } is the smallest valid configurable (version REQUIRED, const 1)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a dotted key (`ai.provider` as a string key) MUST fail the closed nested schema",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "an unknown root key MUST fail the closed schema (additionalProperties: false in the standalone artifact)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a configurable without `version` MUST fail",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-configurable-closed.post-runs-rejects-a-dotted-key-with-400-validation-error",
+      "file": "v2-configurable-closed.test.ts",
+      "line": 54,
+      "title": "POST /runs rejects a dotted key with 400 validation_error",
+      "explicitId": "openwop.requirement.0171.configurable-closed.dotted-key",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a dotted key inside a section MUST be rejected with 400",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be validation_error",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-configurable-closed.post-runs-rejects-an-unknown-root-key-with-400-validation-error",
+      "file": "v2-configurable-closed.test.ts",
+      "line": 61,
+      "title": "POST /runs rejects an unknown root key with 400 validation_error",
+      "explicitId": "openwop.requirement.0171.configurable-closed.unknown-key",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "an unknown root key MUST be rejected with 400",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be validation_error",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-dual-stack-negotiation.a-run-created-through-v1-runs-with-no-header-is-readable-through-runs-under-open",
+      "file": "v2-dual-stack-negotiation.test.ts",
+      "line": 68,
+      "title": "a run created through /v1/runs with no header is readable through /runs under OpenWOP-Version: 2.0",
+      "explicitId": "openwop.requirement.0172.dual-stack-negotiation.cross-major-read",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": "a /v1/ response MUST report the 1.x contract that produced it"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §5",
+          "requirement": "the overlap: a run created through /v1/runs MUST be readable through GET /runs/{runId} with OpenWOP-Version: 2.0"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §5",
+          "requirement": "the v2 read MUST name the same run"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": "the v2 read MUST report the 2.x contract that produced it"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-dual-stack-negotiation.an-unlisted-major-is-406-protocol-version-unsupported-with-details-protocolversi",
+      "file": "v2-dual-stack-negotiation.test.ts",
+      "line": 83,
+      "title": "an unlisted major is 406 protocol_version_unsupported with details.protocolVersions[]",
+      "explicitId": "openwop.requirement.0172.dual-stack-negotiation.unlisted-major",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a header naming a major not in protocolVersions[] MUST be answered 406",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be protocol_version_unsupported",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "details.protocolVersions[] MUST echo the advertised list",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-dual-stack-negotiation.openwop-version-2-0-on-a-v1-path-is-400-protocol-version-mismatch",
+      "file": "v2-dual-stack-negotiation.test.ts",
+      "line": 94,
+      "title": "OpenWOP-Version: 2.0 on a /v1/ path is 400 protocol_version_mismatch",
+      "explicitId": "openwop.requirement.0172.dual-stack-negotiation.v1-path-mismatch",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a /v1/… path with OpenWOP-Version other than 1 MUST be answered 400",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be protocol_version_mismatch",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-dual-stack-negotiation.every-response-reports-the-contract-that-produced-it",
+      "file": "v2-dual-stack-negotiation.test.ts",
+      "line": 103,
+      "title": "every response reports the contract that produced it",
+      "explicitId": "openwop.requirement.0172.dual-stack-negotiation.response-header",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": "a header-less /v1/ response MUST carry OpenWOP-Version: 1.<minor> — the contract used, never another (silent downgrade)"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": "a /v1/ response under OpenWOP-Version: 1.0 MUST carry OpenWOP-Version: 1.<minor>"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": "a response under OpenWOP-Version: 2.0 MUST carry OpenWOP-Version: 2.<minor>"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-effect-identity-business-key.get-runs-runid-effects-validates-and-every-row-is-keyed-on-business-identity-or",
+      "file": "v2-effect-identity-business-key.test.ts",
+      "line": 49,
+      "title": "GET /runs/{runId}/effects validates and every row is keyed on business identity or the activity recipe",
+      "explicitId": "openwop.requirement.0173.effect-identity-business-key",
+      "citations": [
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
+        {
+          "section": "security-defaults.md §Layer-2 effect identity",
+          "requirement": "a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)"
+        },
+        {
+          "section": "effect-ledger-projection.schema.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "effect-ledger-projection.schema.json runId",
+          "requirement": "runId MUST echo the run read"
+        },
+        {
+          "section": "security-defaults.md §Layer-2 effect identity",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0150 §B",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "effect-ledger-projection.schema.json providerKey",
+          "requirement": "providerKey is a redaction-safe identity, never credential material"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-effect-identity-business-key.the-same-provider-key-is-presented-across-two-transport-retries",
+      "file": "v2-effect-identity-business-key.test.ts",
+      "line": 96,
+      "title": "the same provider key is presented across two transport retries",
+      "explicitId": "openwop.requirement.0173.effect-identity-business-key.retry",
+      "citations": [
+        {
+          "section": "spec/v2/core/replay.md §Effect identity",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/replay.md §Effect identity",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-effect-seam-manifest.get-host-effect-seams-validates-and-every-row-is-guarded",
+      "file": "v2-effect-seam-manifest.test.ts",
+      "line": 51,
+      "title": "GET /host/effect-seams validates and every row is guarded",
+      "explicitId": "openwop.requirement.0173.effect-seam-manifest",
+      "citations": [
+        {
+          "section": "replay.md §The effect-seam manifest",
+          "requirement": "a host advertising `replay` MUST serve GET /host/effect-seams with 200 (RFC 0173 §C.1)"
+        },
+        {
+          "section": "effect-seam-manifest.schema.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "replay.md §The effect-seam manifest",
+          "requirement": "the manifest MUST enumerate at least one outbound effect seam — a node runtime with no effect path does not need `replay`"
+        },
+        {
+          "section": "RFC 0173 §C.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0173 §C.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "effect-seam-manifest.schema.json seams[].kind",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0173 §C.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "effect-seam-manifest.schema.json seams[].branchReFires",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-effect-seam-manifest.the-replay-facet-names-the-manifest-address-as-the-constant-host-effect-seams",
+      "file": "v2-effect-seam-manifest.test.ts",
+      "line": 106,
+      "title": "the replay facet names the manifest address as the constant /host/effect-seams",
+      "explicitId": "openwop.requirement.0173.effect-seam-manifest.facet",
+      "citations": [
+        {
+          "section": "facets/replay.schema.json effectSeamsManifest",
+          "requirement": "the facet MUST carry the constant \"/host/effect-seams\" (replay.md §The surface)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-effect-seam-manifest.driving-one-seam-of-each-kind-observes-no-re-fire-on-replay",
+      "file": "v2-effect-seam-manifest.test.ts",
+      "line": 117,
+      "title": "driving one seam of each kind observes no re-fire on replay",
+      "explicitId": "openwop.requirement.0173.effect-seam-manifest.no-re-fire",
+      "citations": [
+        {
+          "section": "spec/v2/core/replay.md §The effect-seam manifest",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-enum-growth-rule.the-envelope-accepts-a-registered-but-unknown-to-this-suite-vendor-member",
+      "file": "v2-enum-growth-rule.test.ts",
+      "line": 53,
+      "title": "the envelope accepts a registered-but-unknown-to-this-suite vendor member",
+      "explicitId": "openwop.requirement.0171.enum-growth-rule.unknown-member-accepted",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the vendor branch admits an optional third segment (<org>.<domain>.<name>)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-enum-growth-rule.the-reserved-prefix-and-a-malformed-member-are-rejected",
+      "file": "v2-enum-growth-rule.test.ts",
+      "line": 63,
+      "title": "the reserved prefix and a malformed member are rejected",
+      "explicitId": "openwop.requirement.0171.enum-growth-rule.reserved-rejected",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "openwop. is the only reserved prefix; a type under it that is not in the enum MUST fail",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a member outside the positive pattern (upper-case) MUST fail",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a single-segment member MUST fail — every type is <domain>.<name> or <org>.<name>",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-2-append-vocabulary.a-host-append-to-an-open-era-2-run-keeps-the-log-in-v1-vocabulary-so-the-whole-l",
+      "file": "v2-era-2-append-vocabulary.test.ts",
+      "line": 48,
+      "title": "a host append to an open era-2 run keeps the log in v1 vocabulary, so the whole log still reads",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-2-append-vocabulary.the-run-keeps-the-era-it-was-created-with-an-append-does-not-promote-it-to-era-3",
+      "file": "v2-era-2-append-vocabulary.test.ts",
+      "line": 119,
+      "title": "the run keeps the era it was created with; an append does not promote it to era 3",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-key.a-run-created-now-carries-eventlogschemaversion-3-on-its-snapshot",
+      "file": "v2-era-key.test.ts",
+      "line": 52,
+      "title": "a run created now carries eventLogSchemaVersion 3 on its snapshot",
+      "explicitId": "openwop.requirement.0176.era-key",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "eventLogSchemaVersion is REQUIRED on every run snapshot (run-snapshot.schema.json) — the era key is never absent on a run a v2 host created",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-key.discovery-advertises-the-value-the-host-writes-for-new-runs-and-nothing-else",
+      "file": "v2-era-key.test.ts",
+      "line": 67,
+      "title": "discovery advertises the value the host writes for new runs and nothing else",
+      "explicitId": "openwop.requirement.0176.era-key.discovery",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §2.2",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §2.2",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the value stamped on a run created now MUST equal the value discovery advertises",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-stamp-universal.discovery-advertises-an-era-the-host-actually-writes-and-a-new-run-carries-it",
+      "file": "v2-era-stamp-universal.test.ts",
+      "line": 40,
+      "title": "discovery advertises an era the host actually writes, and a new run carries it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-era-stamp-universal.a-v2-era-host-stamps-3-so-its-new-runs-are-never-read-as-the-v1-era",
+      "file": "v2-era-stamp-universal.test.ts",
+      "line": 80,
+      "title": "a v2-era host stamps 3, so its new runs are never read as the v1 era",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host advertising era 3 MUST stamp 3 on every run it creates — an unstamped run made after the cut is indistinguishable from a pre-cut run and every reader translates it as era 2, which is a silent wrong read rather than an error",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-error-registry.an-error-response-is-the-closed-envelope-with-a-registered-code-at-its-registere",
+      "file": "v2-error-registry.test.ts",
+      "line": 52,
+      "title": "an error response is the closed envelope with a registered code at its registered status",
+      "explicitId": "openwop.requirement.0171.error-registry.envelope",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-error-registry.retry-timing-is-never-spelled-inside-details",
+      "file": "v2-error-registry.test.ts",
+      "line": 64,
+      "title": "retry timing is never spelled inside details",
+      "explicitId": "openwop.requirement.0171.error-registry.no-retry-details",
+      "citations": [
+        {
+          "section": "spec/v2/core/errors.md §Retry timing",
+          "requirement": "details.retryAfter / retryAfterMs / retryAfterSeconds are not part of v2 and a host MUST NOT emit them — Retry-After is the only retry timing"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-error-registry.a-429-rate-limited-response-carries-retry-after",
+      "file": "v2-error-registry.test.ts",
+      "line": 72,
+      "title": "a 429 rate_limited response carries Retry-After",
+      "explicitId": "openwop.requirement.0171.error-registry.retry-after",
+      "citations": [
+        {
+          "section": "spec/v2/core/errors.md §Retry timing",
+          "requirement": "a 429 MUST carry the registered code rate_limited"
+        },
+        {
+          "section": "spec/v2/core/errors.md §Retry timing",
+          "requirement": "a 429 rate_limited response MUST set Retry-After"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-event-type-closed.every-emitted-type-is-a-registered-protocol-type-or-a-vendor-type-under-an-adver",
+      "file": "v2-event-type-closed.test.ts",
+      "line": 71,
+      "title": "every emitted type is a registered protocol type or a vendor type under an advertised org",
+      "explicitId": "openwop.requirement.0171.event-type-closed.type",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-event-type-closed.every-emitted-event-validates-as-a-runeventdoc",
+      "file": "v2-event-type-closed.test.ts",
+      "line": 84,
+      "title": "every emitted event validates as a RunEventDoc",
+      "explicitId": "openwop.requirement.0171.event-type-closed.envelope",
+      "citations": [
+        {
+          "section": "spec/v2/core/events.md §The envelope",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/events.md §The envelope",
+          "requirement": "sequence is the one ordering field: integer ≥ 0, strictly increasing per run"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-fork-a-v1-run.the-fork-of-an-era-2-run-is-accepted-and-its-prefix-is-byte-equivalent-to-the-tr",
+      "file": "v2-fork-a-v1-run.test.ts",
+      "line": 62,
+      "title": "the fork of an era-2 run is accepted and its prefix is byte-equivalent to the translated parent",
+      "explicitId": "openwop.requirement.0176.fork-a-v1-run.prefix",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/replay.md §Byte-equivalence of the prefix",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-fork-a-v1-run.run-started-on-the-fork-carries-the-legacy-subject-where-the-parent-had-none",
+      "file": "v2-fork-a-v1-run.test.ts",
+      "line": 86,
+      "title": "run.started on the fork carries the legacy Subject where the parent had none",
+      "explicitId": "openwop.requirement.0176.fork-a-v1-run.legacy-subject",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the fork's log MUST carry run.started at its head",
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/identity.md §1.2",
+          "requirement": "run.started on the fork MUST carry owner.subject — the seeded parent had none, so the host stamps the legacy Subject at first v2 read (RFC 0170 §A.3) and the fork copies it verbatim (replay.md §The surface)"
+        },
+        {
+          "section": "spec/v2/core/identity.md §1.2",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/persistence.md §Everything else a v1 host persisted",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-form-when-reuses-edge-conditions.a-field-when-is-the-edge-condition-grammar-type-left-right-and-no-other-expressi",
+      "file": "v2-form-when-reuses-edge-conditions.test.ts",
+      "line": 51,
+      "title": "a field `when` is the edge-condition grammar { type, left, right } and no other expression language",
+      "explicitId": "openwop.requirement.0177.form-when-reuses-edge-conditions",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a `when` outside the edge-condition grammar (a second expression language) MUST be rejected",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "an operator outside expression|equals|notEquals|contains|regex|truthy|falsy MUST be rejected",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-header-scheme.no-removed-header-family-appears-on-any-response",
+      "file": "v2-header-scheme.test.ts",
+      "line": 49,
+      "title": "no removed header family appears on any response",
+      "explicitId": "openwop.requirement.0171.header-scheme.no-legacy-headers",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-header-scheme.openwop-version-names-the-contract-on-every-response",
+      "file": "v2-header-scheme.test.ts",
+      "line": 58,
+      "title": "OpenWOP-Version names the contract on every response",
+      "explicitId": "openwop.requirement.0171.header-scheme.version-on-every-response",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-id-grammar.every-id-on-the-run-snapshot-matches-its-ids-schema-json-kind",
+      "file": "v2-id-grammar.test.ts",
+      "line": 43,
+      "title": "every id on the run snapshot matches its ids.schema.json kind",
+      "explicitId": "openwop.requirement.0170.id-grammar.snapshot",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-id-grammar.every-id-on-the-run-events-matches-its-ids-schema-json-kind",
+      "file": "v2-id-grammar.test.ts",
+      "line": 53,
+      "title": "every id on the run events matches its ids.schema.json kind",
+      "explicitId": "openwop.requirement.0170.id-grammar.events",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "every event MUST carry the run's own runId",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-id-grammar.a-run-id-whose-tenant-segment-is-not-the-caller-s-is-refused",
+      "file": "v2-id-grammar.test.ts",
+      "line": 68,
+      "title": "a run id whose tenant segment is not the caller's is refused",
+      "explicitId": "openwop.requirement.0170.id-grammar.tenant-binding",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md",
+          "requirement": "the code MUST be answered with its registered HTTP status (id_tenant_mismatch → 403, not_found → 404)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-idempotency-key-grammar.a-22-character-key-inside-the-grammar-is-accepted",
+      "file": "v2-idempotency-key-grammar.test.ts",
+      "line": 38,
+      "title": "a 22+ character key inside the grammar is accepted",
+      "explicitId": "openwop.requirement.0170.idempotency-key-grammar.valid-accepted",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the suite's key MUST itself be inside ^[A-Za-z0-9._~-]{22,128}$",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a UUIDv4-strength key in base64url form satisfies the grammar and MUST NOT be refused as idempotency_key_invalid",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-idempotency-key-grammar.a-key-outside-the-grammar-is-refused-with-400-idempotency-key-invalid",
+      "file": "v2-idempotency-key-grammar.test.ts",
+      "line": 50,
+      "title": "a key outside the grammar is refused with 400 idempotency_key_invalid",
+      "explicitId": "openwop.requirement.0170.idempotency-key-grammar.invalid-refused",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host MUST reject an Idempotency-Key outside ^[A-Za-z0-9._~-]{22,128}$ with 400",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be idempotency_key_invalid",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-interrupt-token-scheme.a-token-without-the-ow2-prefix-is-refused",
+      "file": "v2-interrupt-token-scheme.test.ts",
+      "line": 37,
+      "title": "a token without the ow2. prefix is refused",
+      "explicitId": "openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Tokens",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-interrupt-token-scheme.a-well-formed-token-under-a-kid-the-host-does-not-hold-is-401-interrupt-token-in",
+      "file": "v2-interrupt-token-scheme.test.ts",
+      "line": 46,
+      "title": "a well-formed token under a kid the host does not hold is 401 interrupt_token_invalid",
+      "explicitId": "openwop.requirement.0170.interrupt-token-scheme.unheld-kid-refused",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host MUST refuse a token whose kid it does not hold with 401",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be interrupt_token_invalid (one code per state — never not_found for a token the host cannot verify)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-lane-issuer-advertised.every-auth-lanes-member-names-lane-issuers-revocation-and-minimumassurance",
+      "file": "v2-lane-issuer-advertised.test.ts",
+      "line": 36,
+      "title": "every auth.lanes[] member names lane, issuers[], revocation and minimumAssurance",
+      "explicitId": "openwop.requirement.0170.lane-issuer-advertised.members",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/identity.md §2.2",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/identity.md §2.2",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/identity.md §2.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/identity.md §2.4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-lane-issuer-advertised.a-windowed-revocation-rule-advertises-revocationwindowseconds",
+      "file": "v2-lane-issuer-advertised.test.ts",
+      "line": 52,
+      "title": "a windowed revocation rule advertises revocationWindowSeconds",
+      "explicitId": "openwop.requirement.0170.lane-issuer-advertised.window",
+      "citations": [
+        {
+          "section": "spec/v2/core/identity.md §2.2",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-legacy-profiles-absent.no-legacy-id-appears-in-a2a-profiles-or-mcp-profiles-and-each-id-matches-its-fac",
+      "file": "v2-legacy-profiles-absent.test.ts",
+      "line": 41,
+      "title": "no -legacy id appears in a2a.profiles or mcp.profiles and each id matches its facet pattern",
+      "explicitId": "openwop.requirement.0175.legacy-profiles-absent",
+      "citations": [
+        {
+          "section": "interop.md §Legacy profiles are absent",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-legacy-profiles-absent.no-root-profiles-exists-in-the-v2-representation",
+      "file": "v2-legacy-profiles-absent.test.ts",
+      "line": 70,
+      "title": "no root profiles[] exists in the v2 representation",
+      "explicitId": "openwop.requirement.0175.legacy-profiles-absent.no-root-profiles",
+      "citations": [
+        {
+          "section": "capabilities.md §Profiles",
+          "requirement": "no `profiles[]` exists at the v2 root — a profile is a predicate over the declaration file, not an advertisement (RFC 0169 §C.1)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-manifest-ceiling-refused.an-engines-openwop-range-with-no-upper-bound-1-0-0-reads-2-0-0-and-is-refused-at",
+      "file": "v2-manifest-ceiling-refused.test.ts",
+      "line": 105,
+      "title": "an engines.openwop range with no upper bound (>=1.0.0) reads <2.0.0 and is refused at install with pack_engine_unsupported",
+      "explicitId": "openwop.requirement.0177.manifest-ceiling-refused.unbounded",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "an unbounded range does not admit protocol major 2 and MUST be refused with 400 pack_engine_unsupported",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be pack_engine_unsupported (not pack_runtime_requirement_unmet)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-manifest-ceiling-refused.a-v1-ceiling-1-0-0-2-0-0-is-refused-at-install-with-pack-engine-unsupported",
+      "file": "v2-manifest-ceiling-refused.test.ts",
+      "line": 114,
+      "title": "a v1 ceiling (>=1.0.0 <2.0.0) is refused at install with pack_engine_unsupported",
+      "explicitId": "openwop.requirement.0177.manifest-ceiling-refused.v1-ceiling",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a <2.0.0 ceiling does not admit protocol major 2 and MUST be refused with 400 pack_engine_unsupported",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be pack_engine_unsupported",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-manifest-ceiling-refused.a-range-admitting-the-host-major-2-0-0-3-0-0-installs",
+      "file": "v2-manifest-ceiling-refused.test.ts",
+      "line": 123,
+      "title": "a range admitting the host major (>=2.0.0 <3.0.0) installs",
+      "explicitId": "openwop.requirement.0177.manifest-ceiling-refused.v2-installs",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-manifest-hatch-carried.an-x-field-inside-agents-0-of-a-node-pack-is-ignored-not-rejected-the-pack-insta",
+      "file": "v2-manifest-hatch-carried.test.ts",
+      "line": 85,
+      "title": "an x- field inside agents[0] of a node pack is ignored, not rejected — the pack installs",
+      "explicitId": "openwop.requirement.0177.manifest-hatch-carried.agents-x-field",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-manifest-hatch-carried.an-x-field-inside-a-prompt-template-of-a-prompt-pack-is-ignored-not-rejected-the",
+      "file": "v2-manifest-hatch-carried.test.ts",
+      "line": 103,
+      "title": "an x- field inside a prompt template of a prompt pack is ignored, not rejected — the pack installs",
+      "explicitId": "openwop.requirement.0177.manifest-hatch-carried.prompt-template-x-field",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-min-client-version.a-client-below-minclientversion-is-refused-with-426-client-version-unsupported",
+      "file": "v2-min-client-version.test.ts",
+      "line": 35,
+      "title": "a client below minClientVersion is refused with 426 client_version_unsupported",
+      "explicitId": "openwop.requirement.0172.min-client-version",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "minClientVersion MUST use the <major>.<minor> grammar (axis 15, as axis 1)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a 426 refusal MUST carry client_version_unsupported",
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md §The envelope",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-minimum-version-refused.an-a2a-peer-offering-only-a-version-below-minimumversion-is-refused",
+      "file": "v2-minimum-version-refused.test.ts",
+      "line": 86,
+      "title": "an A2A peer offering only a version below minimumVersion is refused",
+      "explicitId": "openwop.requirement.0175.minimum-version-refused",
+      "citations": [
+        {
+          "section": "interop.md §The floor",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-minimum-version-refused.an-mcp-server-offering-only-a-revision-below-minimumrevision-is-refused",
+      "file": "v2-minimum-version-refused.test.ts",
+      "line": 114,
+      "title": "an MCP server offering only a revision below minimumRevision is refused",
+      "explicitId": "openwop.requirement.0175.minimum-version-refused.mcp",
+      "citations": [
+        {
+          "section": "interop.md §The floor",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-mrtr-rounds-ceiling.mcp-mrtr-maxrounds-is-an-integer-ceiling-in-1-16",
+      "file": "v2-mrtr-rounds-ceiling.test.ts",
+      "line": 46,
+      "title": "mcp.mrtr.maxRounds is an integer ceiling in 1..16",
+      "explicitId": "openwop.requirement.0175.mrtr-rounds-ceiling",
+      "citations": [
+        {
+          "section": "facets/mcp.schema.json mrtr.maxRounds",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-mrtr-rounds-ceiling.round-maxrounds-1-is-refused-with-mcp-mrtr-rounds-exceeded",
+      "file": "v2-mrtr-rounds-ceiling.test.ts",
+      "line": 59,
+      "title": "round maxRounds + 1 is refused with mcp_mrtr_rounds_exceeded",
+      "explicitId": "openwop.requirement.0175.mrtr-rounds-ceiling.refused",
+      "citations": [
+        {
+          "section": "interop.md §The MCP round ceiling",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "errors.json mcp_mrtr_rounds_exceeded",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "interop.md §The MCP round ceiling",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-negotiation-authenticated.an-unauthenticated-a2a-exchange-cannot-lower-the-version-below-preferredversion",
+      "file": "v2-negotiation-authenticated.test.ts",
+      "line": 86,
+      "title": "an unauthenticated A2A exchange cannot lower the version below preferredVersion",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-negotiation-authenticated.an-unauthenticated-mcp-exchange-cannot-lower-the-revision-below-preferredversion",
+      "file": "v2-negotiation-authenticated.test.ts",
+      "line": 106,
+      "title": "an unauthenticated MCP exchange cannot lower the revision below preferredVersion",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-negotiation-decided-emitted.an-a2a-exchange-leaves-negotiation-decided-on-the-host-log",
+      "file": "v2-negotiation-decided-emitted.test.ts",
+      "line": 143,
+      "title": "an A2A exchange leaves negotiation.decided on the host log",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-negotiation-decided-emitted.an-mcp-exchange-leaves-negotiation-decided-on-the-host-log",
+      "file": "v2-negotiation-decided-emitted.test.ts",
+      "line": 146,
+      "title": "an MCP exchange leaves negotiation.decided on the host log",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-no-transport-advertisement.the-v2-root-carries-no-supportedtransports-and-no-grpc-block",
+      "file": "v2-no-transport-advertisement.test.ts",
+      "line": 29,
+      "title": "the v2 root carries no supportedTransports and no grpc block",
+      "explicitId": "openwop.requirement.0175.no-transport-advertisement",
+      "citations": [
+        {
+          "section": "interop.md §REST is the wire",
+          "requirement": "a v2 host MUST NOT advertise a transport list — `supportedTransports` does not exist in v2 (RFC 0175 §B.1, row C8.2)"
+        },
+        {
+          "section": "interop.md §gRPC",
+          "requirement": "a v2 host MUST NOT advertise a `grpc` capability block — an unwitnessable family is not advertisable (RFC 0175 §A.1, row C8.3)"
+        },
+        {
+          "section": "interop.md §The facets",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "capabilities.schema.json (closed root)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-owner-subject-required.owner-subject-is-present-and-validates-against-subject-schema-json",
+      "file": "v2-owner-subject-required.test.ts",
+      "line": 54,
+      "title": "owner.subject is present and validates against subject.schema.json",
+      "explicitId": "openwop.requirement.0170.owner-subject-required.subject",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "RunSnapshot.owner.subject is REQUIRED",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "RunSnapshot.owner.tenant is REQUIRED",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-owner-subject-required.owner-carries-no-principal-principalkind",
+      "file": "v2-owner-subject-required.test.ts",
+      "line": 64,
+      "title": "owner carries no principal / principalKind",
+      "explicitId": "openwop.requirement.0170.owner-subject-required.no-principal",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "`principal` is removed from RunSnapshot.owner — subject.subjectId carries it",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "`principalKind` is removed from RunSnapshot.owner — subject.kind carries it",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "owner is the closed block { tenant, workspace?, subject }",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.sandbox-isolationmodel-names-a-real-mechanism-never-node-vm",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 70,
+      "title": "sandbox.isolationModel names a real mechanism, never node:vm",
+      "explicitId": "openwop.requirement.0173.pack-isolation",
+      "citations": [
+        {
+          "section": "facets/sandbox.schema.json isolationModel",
+          "requirement": "isolationModel MUST NOT be node:vm — it is escapable by design (RFC 0035 §130) and is not a v2 value (RFC 0173 §D.1)"
+        },
+        {
+          "section": "facets/sandbox.schema.json isolationModel",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-read-is-refused",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 84,
+      "title": "node-pack-sandbox-fs-gated: a host filesystem read is refused",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-write-is-refused",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 91,
+      "title": "node-pack-sandbox-fs-gated: a host filesystem write is refused",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-env-the-host-environment-does-not-leak",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 98,
+      "title": "node-pack-sandbox-no-env: the host environment does not leak",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-network-gated-ungated-network-egress-is-refused",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 105,
+      "title": "node-pack-sandbox-network-gated: ungated network egress is refused",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-process-host-process-access-is-refused",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 112,
+      "title": "node-pack-sandbox-no-process: host process access is refused",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-timeout-exceeding-wallclocklimitms-fails-with-sandbox-timeout",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 119,
+      "title": "node-pack-sandbox-timeout: exceeding wallClockLimitMs fails with sandbox_timeout",
+      "explicitId": "openwop.requirement.0173.pack-isolation.timeout",
+      "citations": [
+        {
+          "section": "security-defaults.md §Sandbox isolation",
+          "requirement": "node-pack-sandbox-timeout: a wall-clock overrun MUST fail with sandbox_timeout"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-memory-cap-exceeding-memorylimitbytes-fails-with-sandbox-memor",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 126,
+      "title": "node-pack-sandbox-memory-cap: exceeding memoryLimitBytes fails with sandbox_memory_exceeded",
+      "explicitId": "openwop.requirement.0173.pack-isolation.memory-cap",
+      "citations": [
+        {
+          "section": "security-defaults.md §Sandbox isolation",
+          "requirement": "node-pack-sandbox-memory-cap: a memory overrun MUST fail with sandbox_memory_exceeded"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-isolated-context-a-pack-cannot-mutate-state-another-invocation",
+      "file": "v2-pack-isolation.test.ts",
+      "line": 133,
+      "title": "node-pack-sandbox-isolated-context: a pack cannot mutate state another invocation sees",
+      "explicitId": "openwop.requirement.0173.pack-isolation.isolated-context",
+      "citations": [
+        {
+          "section": "host-sample-test-seams.md §8",
+          "requirement": "misbehave.cross-pack-mutate is not a failure mode — it MUST return a result"
+        },
+        {
+          "section": "security-defaults.md §Sandbox isolation",
+          "requirement": "node-pack-sandbox-isolated-context: result.shared MUST equal 1 on every invocation — a mutation MUST NOT leak into a fresh context"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-payload-registry-closed.every-registered-event-carries-a-payload-that-validates-against-its-typeindex-en",
+      "file": "v2-payload-registry-closed.test.ts",
+      "line": 94,
+      "title": "every registered event carries a payload that validates against its _typeIndex entry",
+      "explicitId": "openwop.requirement.0171.payload-registry-closed",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-peer-dependency-declared.a-peerdependencies-key-the-declaration-file-does-not-name-is-refused-with-pack-p",
+      "file": "v2-peer-dependency-declared.test.ts",
+      "line": 104,
+      "title": "a peerDependencies key the declaration file does not name is refused with pack_peer_dependency_undefined",
+      "explicitId": "openwop.requirement.0177.peer-dependency-declared.undefined-key",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a key absent from spec/v2/declaration.json MUST be refused with 400 pack_peer_dependency_undefined",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the refusal code MUST be pack_peer_dependency_undefined",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-peer-dependency-declared.an-alias-table-row-host-fs-fs-resolves-through-the-overlap-and-the-pack-installs",
+      "file": "v2-peer-dependency-declared.test.ts",
+      "line": 113,
+      "title": "an alias-table row (host.fs → fs) resolves through the overlap and the pack installs",
+      "explicitId": "openwop.requirement.0177.peer-dependency-declared.alias-overlap",
+      "citations": [
+        {
+          "section": "packs.md §\"The alias table\" (RFC 0177 §B.2)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-pinned-run-disposition.a-pin-naming-a-change-id-the-host-does-not-implement-is-cancelled-with-v1-pin-un",
+      "file": "v2-pinned-run-disposition.test.ts",
+      "line": 76,
+      "title": "a pin naming a change id the host does not implement is cancelled with v1_pin_unsupported / v2-cutover",
+      "explicitId": "openwop.requirement.0176.pinned-run-disposition.cancelled",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the cancellation MUST be an event on the run's own log (run.cancelled), not a silent status flip",
+          "interpolated": true
+        },
+        {
+          "section": "run-event-payloads.schema.json runCancelled.reason",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "run-event-payloads.schema.json runCancelled.cancelledBy",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the version.pinned row MUST survive the cancellation — the log is preserved (adversarial review 4)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "version.pinned is never rewritten: the pin still names the change id it was seeded with",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-pinned-run-disposition.a-pin-naming-a-change-id-the-host-still-implements-continues-under-the-reader-ru",
+      "file": "v2-pinned-run-disposition.test.ts",
+      "line": 101,
+      "title": "a pin naming a change id the host still implements continues under the reader rule with the pin verbatim",
+      "explicitId": "openwop.requirement.0176.pinned-run-disposition.continued",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the pin is honoured verbatim — version.pinned reads back with the seeded changeId and version",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-poll-cursor-v2.the-response-is-the-closed-runid-events-lastsequence-status-isterminal",
+      "file": "v2-poll-cursor-v2.test.ts",
+      "line": 60,
+      "title": "the response is the closed { runId, events, lastSequence, status, isTerminal }",
+      "explicitId": "openwop.requirement.0171.poll-cursor-v2.shape",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "pollRunEvents MUST answer 200",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the poll response MUST be exactly { runId, events, lastSequence, status, isTerminal } (closed)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "runId MUST echo the polled run",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "events MUST be an array",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "lastSequence is the highest sequence in the log (−1 when empty)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "status is the snapshot status",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "isTerminal is a boolean",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "lastSequence MUST equal the highest sequence returned when the response carries the whole log",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-poll-cursor-v2.omitting-the-cursor-returns-from-the-first-event-sequence-0",
+      "file": "v2-poll-cursor-v2.test.ts",
+      "line": 77,
+      "title": "omitting the cursor returns from the first event (sequence 0)",
+      "explicitId": "openwop.requirement.0171.poll-cursor-v2.from-first",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "omission of afterSequence means \"from the first event\": the first returned sequence MUST be 0",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-poll-cursor-v2.aftersequence-n-returns-only-events-with-sequence-n",
+      "file": "v2-poll-cursor-v2.test.ts",
+      "line": 87,
+      "title": "afterSequence=N returns only events with sequence > N",
+      "explicitId": "openwop.requirement.0171.poll-cursor-v2.after-sequence",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "afterSequence is an integer ≥ 0 and MUST be accepted",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the cursor is exclusive and the log is not renumbered: afterSequence=first yields exactly the rest of the log",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-poll-cursor-v2.a-cursor-past-the-end-of-the-log-returns-200-with-an-empty-events-array",
+      "file": "v2-poll-cursor-v2.test.ts",
+      "line": 103,
+      "title": "a cursor past the end of the log returns 200 with an empty events array",
+      "explicitId": "openwop.requirement.0171.poll-cursor-v2.past-end",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a cursor past the end of the log MUST return 200",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a cursor past the end of the log MUST return an empty events array",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-preferred-version-default.preferredversion-is-a-member-of-protocolversions",
+      "file": "v2-preferred-version-default.test.ts",
+      "line": 40,
+      "title": "preferredVersion is a member of protocolVersions[]",
+      "explicitId": "openwop.requirement.0172.preferred-version-default.member",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "preferredVersion is REQUIRED root metadata with the <major>.<minor> grammar",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "on a host serving a single major, preferredVersion MUST equal protocolVersion (RFC 0179 §A.1)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-preferred-version-default.a-header-less-get-well-known-openwop-is-the-preferredversion-representation",
+      "file": "v2-preferred-version-default.test.ts",
+      "line": 52,
+      "title": "a header-less GET /.well-known/openwop is the preferredVersion representation",
+      "explicitId": "openwop.requirement.0172.preferred-version-default.headerless",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.3",
+          "requirement": "the discovery resource MUST answer a header-less request"
+        },
+        {
+          "section": "spec/v2/core/versioning.md §1.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §1",
+          "requirement": "preferredVersion is 1.x, so the header-less representation MUST be the v1 document (protocolVersion present) through the overlap"
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §1",
+          "requirement": "the v1 representation MUST carry protocolVersions[] and preferredVersion additively so a single fetch names the other major"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-preferred-version-default.through-the-overlap-preferredversion-names-a-1-x-member",
+      "file": "v2-preferred-version-default.test.ts",
+      "line": 70,
+      "title": "through the overlap preferredVersion names a 1.x member",
+      "explicitId": "openwop.requirement.0172.preferred-version-default.overlap",
+      "citations": [
+        {
+          "section": "spec/v2/core/versioning.md §1.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-profiles-derived-only.the-v2-document-carries-no-root-profiles",
+      "file": "v2-profiles-derived-only.test.ts",
+      "line": 43,
+      "title": "the v2 document carries no root `profiles[]`",
+      "explicitId": "openwop.requirement.0169.profiles-derived-only.no-root-profiles",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "no `profiles[]` exists at the v2 root; a profile is a derived predicate, never a wire field (row C2.10)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-profiles-derived-only.every-registry-profile-is-derivable-from-the-document-the-discovery-core-predica",
+      "file": "v2-profiles-derived-only.test.ts",
+      "line": 49,
+      "title": "every registry profile is derivable from the document; the discovery-core predicate holds on a valid document",
+      "explicitId": "openwop.requirement.0169.profiles-derived-only.derivable",
+      "citations": [
+        {
+          "section": null,
+          "requirement": "spec/v2/profiles.json MUST list at least one profile",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "openwop-discovery-core (metadata protocolVersions + preferredVersion, both REQUIRED at the root) MUST derive true from every valid v2 document",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-provider-conflict.two-definitions-of-one-bare-provider-id-fail-closed-the-later-registration-is-re",
+      "file": "v2-provider-conflict.test.ts",
+      "line": 84,
+      "title": "two definitions of one bare provider id fail closed: the later registration is refused with connection_provider_conflict",
+      "explicitId": "openwop.requirement.0177.provider-conflict.fail-closed",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the later registration of a bare provider id MUST NOT install (no version precedence)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the later registration MUST be refused with connection_provider_conflict",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-provider-conflict.the-qualified-form-packname-github-resolves-to-the-named-pack-s-definition",
+      "file": "v2-provider-conflict.test.ts",
+      "line": 102,
+      "title": "the qualified form <packName>#github resolves to the named pack's definition",
+      "explicitId": "openwop.requirement.0177.provider-conflict.qualified-form",
+      "citations": [
+        {
+          "section": "connection-packs.md §\"The qualified form\" (RFC 0177 §D.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "connection-packs.md §\"The qualified form\" (RFC 0177 §D.1)",
+          "requirement": "a qualified reference resolves only to the named pack's definition (source: pack)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-refresh-sla.refreshedat-on-each-embedded-protocol-facet-is-within-90-days-of-now",
+      "file": "v2-refresh-sla.test.ts",
+      "line": 34,
+      "title": "refreshedAt on each embedded-protocol facet is within 90 days of now",
+      "explicitId": "openwop.requirement.0175.refresh-sla",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "interop.md §The refresh SLA",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "interop.md §The refresh SLA",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "interop.md §The facets",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "interop.md §The facets",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-relaxation-recorded.a-bundle-recording-a-relaxation-cannot-certify-the-relaxed-profile",
+      "file": "v2-relaxation-recorded.test.ts",
+      "line": 68,
+      "title": "a bundle recording a relaxation cannot certify the relaxed profile",
+      "explicitId": "openwop.requirement.0173.relaxation-recorded",
+      "citations": [
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "control: a bundle with no relaxation and a fully witnessed profile MUST verify clean"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "control: the unrelaxed profile certifies"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "a bundle that records a relaxation MUST NOT certify the profile the relaxed obligation belongs to (`relaxed-profile-certified`, RFC 0173 §A.2)"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "the rejection names the relaxed profile"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "the relaxed profile is not in `certifiedProfiles`"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "an unrelated profile still certifies — the relaxation is scoped to the obligation it names"
+        },
+        {
+          "section": "security-defaults.md §Relaxations",
+          "requirement": "a relaxation recorded against an unclaimed profile is not a rejection — recording is the obligation, claiming is the defect"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-relaxation-recorded.durability-is-a-closed-set-session-deployment-persisted",
+      "file": "v2-relaxation-recorded.test.ts",
+      "line": 108,
+      "title": "durability is a closed set: session | deployment | persisted",
+      "explicitId": "openwop.requirement.0173.relaxation-recorded.durability-closed",
+      "citations": [
+        {
+          "section": "certification-bundle.schema.json host.relaxations[].durability",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "certification-bundle.schema.json host.relaxations[].durability",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "certification-bundle.schema.json host.relaxations[].durability",
+          "requirement": "the failure names the durability enum"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-revocation-honored.a-revoked-next-request-credential-is-refused-on-the-next-request-with-credential",
+      "file": "v2-revocation-honored.test.ts",
+      "line": 38,
+      "title": "a revoked next-request credential is refused on the next request with credential_revoked",
+      "explicitId": "openwop.requirement.0170.revocation-honored",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-subject-link-record.the-link-formed-across-scim-and-saml-is-a-closed-subjectlink-record",
+      "file": "v2-subject-link-record.test.ts",
+      "line": 80,
+      "title": "the link formed across SCIM and SAML is a closed SubjectLink record",
+      "explicitId": "openwop.requirement.0170.subject-link-record.shape",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a link MUST join exactly two distinct subjects",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a freshly formed link carries no deniedAt",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-subject-link-record.deactivation-sets-deniedat-and-the-saml-decision-path-consults-it",
+      "file": "v2-subject-link-record.test.ts",
+      "line": 91,
+      "title": "deactivation sets deniedAt and the SAML decision path consults it",
+      "explicitId": "openwop.requirement.0170.subject-link-record.denied-at",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "deactivation MUST set deniedAt (date-time) on the link record",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "after deniedAt is set the SAML decision path MUST deny the linked subject (the leaver contract)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-unmapped-type-refused.poll-over-a-log-with-an-unmapped-unprefixed-type-fails-with-500-event-type-unmap",
+      "file": "v2-unmapped-type-refused.test.ts",
+      "line": 48,
+      "title": "poll over a log with an unmapped, unprefixed type fails with 500 event_type_unmapped",
+      "explicitId": "openwop.requirement.0176.unmapped-type-refused",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/errors.json",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-unmapped-type-refused.a-fork-of-the-same-log-is-refused-for-the-same-reason-the-rule-binds-every-reade",
+      "file": "v2-unmapped-type-refused.test.ts",
+      "line": 71,
+      "title": "a fork of the same log is refused for the same reason — the rule binds every reader",
+      "explicitId": "openwop.requirement.0176.unmapped-type-refused.fork",
+      "citations": [
+        {
+          "section": "spec/v2/core/replay.md §Replay-from-event-log internals",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-v1-events-translated.poll-reads-an-era-2-log-with-v2-type-names-and-sequence-0-present",
+      "file": "v2-v1-events-translated.test.ts",
+      "line": 56,
+      "title": "poll reads an era-2 log with v2 type names and sequence 0 present",
+      "explicitId": "openwop.requirement.0176.v1-events-translated.poll",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-v1-events-translated.sse-reads-the-same-era-2-log-with-v2-type-names",
+      "file": "v2-v1-events-translated.test.ts",
+      "line": 70,
+      "title": "SSE reads the same era-2 log with v2 type names",
+      "explicitId": "openwop.requirement.0176.v1-events-translated.sse",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-v1-events-translated.a-fork-of-the-era-2-run-reads-its-inherited-prefix-with-v2-type-names",
+      "file": "v2-v1-events-translated.test.ts",
+      "line": 84,
+      "title": "a fork of the era-2 run reads its inherited prefix with v2 type names",
+      "explicitId": "openwop.requirement.0176.v1-events-translated.fork",
+      "citations": [
+        {
+          "section": "spec/v2/core/replay.md §Forking a v1 run",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-v1-signed-webhook-accepted.the-webhooks-facet-lists-scheme-v1-the-scheme-a-v1-signed-delivery-is-verified-u",
+      "file": "v2-v1-signed-webhook-accepted.test.ts",
+      "line": 79,
+      "title": "the webhooks facet lists scheme \"v1\" — the scheme a v1-signed delivery is verified under",
+      "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted.facet",
+      "citations": [
+        {
+          "section": "spec/v2/core/webhooks.md §Surfaces",
+          "requirement": "the webhooks facet is { signatureAlgorithms[] }"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Surfaces",
+          "requirement": "signatureAlgorithms MUST list \"v1\" — the cut adds no signature scheme (RFC 0176 §D.2)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-v1-signed-webhook-accepted.the-host-s-v2-receiver-path-accepts-an-x-openwop-only-scheme-v1-delivery-and-ref",
+      "file": "v2-v1-signed-webhook-accepted.test.ts",
+      "line": 89,
+      "title": "the host's v2 receiver path accepts an X-openwop-*-only scheme-v1 delivery and refuses a tampered one",
+      "explicitId": "openwop.requirement.0176.v1-signed-webhook-accepted",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Verification",
+          "requirement": "a receiver MUST verify before acting: the same delivery with a wrong X-openwop-Signature MUST be refused (a receiver that accepts everything is not verifying the v1 bytes)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-version-header-honored.openwop-version-is-honored-or-refused-never-ignored",
+      "file": "v2-version-header-honored.test.ts",
+      "line": 61,
+      "title": "OpenWOP-Version is honored or refused — never ignored",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "a host that does not serve major 2 MUST refuse with 406 protocol_version_unsupported, which it did",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "answering 200 to OpenWOP-Version: 2.0 with a body byte-identical to the header-less fetch means the header was IGNORED, not honored — the host served v1 and called it v2. Refusing with 406 is the correct answer for a host that does not implement major 2; silently returning v1 is the one answer that no presence-gated scenario can detect, because an absent v2 shape records `inapplicable` whether the host refused or ignored",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-version-header-honored.a-host-advertising-two-majors-serves-two-different-representations",
+      "file": "v2-version-header-honored.test.ts",
+      "line": 92,
+      "title": "a host advertising two majors serves two different representations",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the v1 document and the closed v2 root differ by construction (capabilities.md §1), so a host advertising both majors returning identical bytes for both has advertised a major it does not actually serve",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
+      "file": "v2-webhook-durable-delivery.test.ts",
+      "line": 145,
+      "title": "a failed attempt is retried and the event is delivered at least once",
+      "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
+      "citations": [
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": "the host MUST attempt delivery of run.completed for THIS run to the registered subscriber"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": "at-least-once: after the failing attempts the retry MUST land (the receiver answered 204 to the third attempt for the key)"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "DELETE /webhooks/{webhookId} MUST answer 204"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
+      "file": "v2-webhook-durable-delivery.test.ts",
+      "line": 199,
+      "title": "an exhausted delivery is dead-lettered, never dropped",
+      "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
+      "citations": [
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": "a delivery that keeps failing MUST be retried before it can be exhausted (one attempt is a drop)"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-well-known-one-resource.a-header-less-get-and-an-openwop-version-2-0-get-are-two-representations-of-one",
+      "file": "v2-well-known-one-resource.test.ts",
+      "line": 65,
+      "title": "a header-less GET and an OpenWOP-Version: 2.0 GET are two representations of one path with equal protocolVersions[]",
+      "explicitId": "openwop.requirement.0176.well-known-one-resource",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "both representations MUST be JSON objects",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the v1 representation MUST carry protocolVersions[] (RFC 0165 §A, additive) — a single fetch names the other major",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the v2 representation MUST carry protocolVersions[]",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the header MUST select a representation — a host that serves one document for both majors is the charter's \"per-major sub-objects\" the RFC does not adopt (adversarial review 3)",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-well-known-one-resource.the-v2-representation-carries-no-capabilities-wrapper-no-dotted-host-key-no-prof",
+      "file": "v2-well-known-one-resource.test.ts",
+      "line": 104,
+      "title": "the v2 representation carries no `capabilities` wrapper, no dotted `host.*` key, no `profiles[]`, no Capabilities-Etag",
+      "explicitId": "openwop.requirement.0176.well-known-one-resource.v2-representation",
+      "citations": [
+        {
+          "section": "RFC 0176 §C.2",
+          "requirement": "the `capabilities` wrapper (deprecation capabilities-wrapper, removalTrigger v2.0-cut) MUST be absent from the v2 representation"
+        },
+        {
+          "section": "RFC 0176 §C.2",
+          "requirement": "the dotted `host.*` mirror (deprecation host-dotted-mirror) MUST be absent from the v2 representation"
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §7",
+          "requirement": "no `profiles[]` exists at the v2 root (RFC 0169 §C.1, row C2.10)"
+        },
+        {
+          "section": "RFC 0176 §C.2",
+          "requirement": "Capabilities-Etag (deprecation capabilities-etag-header) MUST be absent from the v2 representation — the standard ETag is the probe handle"
+        }
+      ]
+    },
     {
       "id": "openwop.it.vector-knn-roundtrip.capabilities-vectorstore-is-either-absent-or-a-well-formed-object",
       "file": "vector-knn-roundtrip.test.ts",
@@ -31969,6 +34521,389 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-alias-covers-reword.the-corpus-gate-script-exits-0",
+      "file": "v2-alias-covers-reword.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0168.alias-covers-reword",
+      "citations": [
+        {
+          "section": "RFC 0168 §A.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-v2-discovery-root-publishes-signingkeys-the-surface-the-rfc-named",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 85,
+      "title": "the v2 discovery root publishes signingKeys[] — the surface the RFC named",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the v2 discovery root MUST carry signingKeys[] — RFC 0168 disposed of \"an Ed25519 attestation without a key registry is a signature nobody can check\" by naming this surface, so if it is absent the disposition names a place that does not exist and every bundle signature is unattributable",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be closed; an open key record lets a host attach meaning the verifier does not read",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a signingKeys[] entry MUST be able to record retirement, because a retired key has to stay listed — dropping it silently invalidates every bundle it already signed, which is the opposite of what an evidence trail is for",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-front-door-gate-verifies-the-attestation-instead-of-inspecting-the-string",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 116,
+      "title": "the Front-door gate verifies the attestation instead of inspecting the string",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the gate MUST NOT accept a bundle signature by presence: `typeof signature.sig === 'string'` is satisfied by any string, so it cannot distinguish a host key from a keypair minted seconds earlier by whoever wrote the bundle",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the gate MUST resolve signature.keyId against the host's published signingKeys[] and verify the Ed25519 attestation under it — resolving without verifying, or verifying against a key the bundle supplied itself, both leave the signature unaccountable",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-signature-attributable.the-four-signature-outcomes-stay-distinct-collapsing-any-two-restores-the-defect",
+      "file": "v2-bundle-signature-attributable.test.ts",
+      "line": 131,
+      "title": "the four signature outcomes stay distinct — collapsing any two restores the defect",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
+      "file": "v2-corpus-tag-pinned.test.ts",
+      "line": 33,
+      "title": "every vendoring consumer in the cross-repo inventory records a published corpus tag",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-declaration-parity.the-corpus-gate-script-exits-0",
+      "file": "v2-declaration-parity.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0169.declaration-parity",
+      "citations": [
+        {
+          "section": "RFC 0169 §B.2",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-it-was-generated-from-and-renders-every-code",
+      "file": "v2-error-registry-prose-parity.test.ts",
+      "line": 26,
+      "title": "errors.md states the registry count it was generated from and renders every code",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "errors.md states the registry size at least once, so the claim is checkable",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-event-naming-rule.every-closed-enum-v2-event-type-is-two-kebab-segments-and-every-recorded-artifac",
+      "file": "v2-event-naming-rule.test.ts",
+      "line": 36,
+      "title": "every closed-enum v2 event type is two kebab segments, and every recorded artifact exception is an enum member",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "run-event.schema.json properties.type.oneOf[0] MUST be the closed enum of v2 event types",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-event-naming-rule.the-closed-enum-and-the-vendor-branch-are-disjoint-every-registered-type-validat",
+      "file": "v2-event-naming-rule.test.ts",
+      "line": 51,
+      "title": "the closed enum and the vendor branch are disjoint: every registered type validates, and a typo of a registered domain does not",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "RFC 0171 §A.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0171 §A.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0171 §A.1",
+          "requirement": "a genuine vendor type under an unregistered org MUST still validate"
+        },
+        {
+          "section": "RFC 0171 §A.1",
+          "requirement": "`openwop.` is reserved and MUST NOT match the vendor branch"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-events-channel-parity.the-corpus-gate-script-exits-0",
+      "file": "v2-events-channel-parity.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0171.events-channel-parity",
+      "citations": [
+        {
+          "section": "RFC 0171 §E.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-externally-gated-never-stable.the-corpus-gate-script-exits-0",
+      "file": "v2-externally-gated-never-stable.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0169.externally-gated-never-stable",
+      "citations": [
+        {
+          "section": "RFC 0169 §C.4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-one-signing-scheme.registry-version-manifest-signing-has-exactly-one-scheme-ed25519-canonical-json",
+      "file": "v2-one-signing-scheme.test.ts",
+      "line": 37,
+      "title": "registry-version-manifest signing has exactly one scheme, ed25519-canonical-json, and no method / publicKeyRef",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "registry-version-manifest.schema.json MUST define a `signing` object",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "signing.scheme MUST be the single const `ed25519-canonical-json` — one scheme, not a menu",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "signing MUST require `keyId` and `scheme`",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "signing MUST be closed (additionalProperties: false) so a second scheme cannot be smuggled in",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "signing.method is gone in v2 — it MUST NOT appear in the signing object",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "signing.publicKeyRef is gone in v2 — the key is addressed by keyId alone",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-path-parity.the-corpus-gate-script-exits-0",
+      "file": "v2-path-parity.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0172.path-parity",
+      "citations": [
+        {
+          "section": "RFC 0172 §C.2",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-release-identity.the-corpus-gate-script-exits-0",
+      "file": "v2-release-identity.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0172.release-identity",
+      "citations": [
+        {
+          "section": "RFC 0172 §D.1",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0172 §D.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-req-only-assertions.the-corpus-gate-script-exits-0",
+      "file": "v2-req-only-assertions.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0168.req-only-assertions",
+      "citations": [
+        {
+          "section": "RFC 0168 §A.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-seams-not-in-canonical.the-corpus-gate-script-exits-0",
+      "file": "v2-seams-not-in-canonical.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0168.seams-not-in-canonical",
+      "citations": [
+        {
+          "section": "RFC 0168 §C.2",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-security-defaults-table.the-obligation-table-has-a-witness-column-and-no-row-is-unwitnessable",
+      "file": "v2-security-defaults-table.test.ts",
+      "line": 33,
+      "title": "the obligation table has a Witness column and no row is unwitnessable",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "spec/v2/core/security-defaults.md MUST exist — it is the obligation table RFC 0173 §A.1 names",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the obligation table MUST have a `Witness` column (surface · obligation · witness · invariant)",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the obligation table MUST list at least one obligation row",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-spec-artifacts-digest.the-corpus-gate-script-exits-0",
+      "file": "v2-spec-artifacts-digest.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0168.spec-artifacts-digest",
+      "citations": [
+        {
+          "section": "RFC 0168 §D.2",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-threat-model-template.the-corpus-gate-script-exits-0",
+      "file": "v2-threat-model-template.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0173.threat-model-template",
+      "citations": [
+        {
+          "section": "RFC 0173 §E.2 / RFC 0175 §F.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-witness-required.the-corpus-gate-script-exits-0",
+      "file": "v2-witness-required.test.ts",
+      "line": 31,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0168.witness-required",
+      "citations": [
+        {
+          "section": "RFC 0168 §B.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.versioned-composition-profiles.a-versioned-advertisement-validates",
       "file": "versioned-composition-profiles.test.ts",