@openwop/openwop-conformance 2.37.1 → 2.39.0

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 629,
-    "tests": 2404,
-    "withStableId": 2404,
+    "files": 633,
+    "tests": 2422,
+    "withStableId": 2422,
     "interpolatedTitles": 0,
-    "explicitIds": 2294
+    "explicitIds": 2304
   },
   "records": [
     {
@@ -15228,6 +15228,97 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.jcs-vectors.the-vector-set-is-present-and-non-trivial",
+      "file": "jcs-vectors.test.ts",
+      "line": 59,
+      "title": "the vector set is present and non-trivial",
+      "explicitId": "openwop.it.jcs-vectors.the-vector-set-is-present-and-non-trivial",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the vectors MUST cover RFC 8785 Appendix B numbers, documents and every §B refusal kind"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.number-s-serializes-per-rfc-8785-appendix-b",
+      "file": "jcs-vectors.test.ts",
+      "line": 66,
+      "title": "number %s serializes per RFC 8785 Appendix B",
+      "explicitId": "openwop.it.jcs-vectors.number-s-serializes-per-rfc-8785-appendix-b",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "numbers MUST serialize as ECMAScript Number::toString (RFC 8785 §3.2.2.3)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.document-s-canonicalizes-and-hashes",
+      "file": "jcs-vectors.test.ts",
+      "line": 70,
+      "title": "document %s canonicalizes and hashes",
+      "explicitId": "openwop.it.jcs-vectors.document-s-canonicalizes-and-hashes",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.text-s-is-refused-not-coerced",
+      "file": "jcs-vectors.test.ts",
+      "line": 78,
+      "title": "text %s is refused, not coerced",
+      "explicitId": "openwop.it.jcs-vectors.text-s-is-refused-not-coerced",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.a-non-i-json-native-value-is-refused-at-the-value-boundary",
+      "file": "jcs-vectors.test.ts",
+      "line": 83,
+      "title": "a non-I-JSON native value is refused at the value boundary",
+      "explicitId": "openwop.it.jcs-vectors.a-non-i-json-native-value-is-refused-at-the-value-boundary",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.member-names-and-certification-rows-sort-by-utf-16-code-units-not-by-locale",
+      "file": "jcs-vectors.test.ts",
+      "line": 99,
+      "title": "member names and certification rows sort by UTF-16 code units, not by locale",
+      "explicitId": "openwop.it.jcs-vectors.member-names-and-certification-rows-sort-by-utf-16-code-units-not-by-locale",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "witnessSha256 rows MUST sort by id in UTF-16 code-unit order; a locale-sensitive comparator MUST NOT be used"
+        }
+      ]
+    },
     {
       "id": "openwop.it.kv-atomic-increment.capabilities-kvstorage-is-either-absent-or-a-well-formed-object",
       "file": "kv-atomic-increment.test.ts",
@@ -24404,9 +24495,26 @@
       ]
     },
     {
-      "id": "openwop.it.semantic-digest-vectors.message-order-is-semantic-reversing-changes-the-digest",
+      "id": "openwop.it.semantic-digest-vectors.tool-order-uses-utf-16-code-units-where-a-locale-comparator-disagrees",
       "file": "semantic-digest-vectors.test.ts",
       "line": 113,
+      "title": "tool order uses UTF-16 code units, where a locale comparator disagrees",
+      "explicitId": "openwop.it.semantic-digest-vectors.tool-order-uses-utf-16-code-units-where-a-locale-comparator-disagrees",
+      "citations": [
+        {
+          "section": "RFC 0212 §D · RFC 0150 §C",
+          "requirement": "tools[] MUST sort by name in UTF-16 code-unit order"
+        },
+        {
+          "section": "RFC 0212 §D · RFC 0150 §C",
+          "requirement": "getWeather (0x57) MUST precede get_weather (0x5F)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.semantic-digest-vectors.message-order-is-semantic-reversing-changes-the-digest",
+      "file": "semantic-digest-vectors.test.ts",
+      "line": 121,
       "title": "message order IS semantic — reversing changes the digest",
       "explicitId": "openwop.it.semantic-digest-vectors.message-order-is-semantic-reversing-changes-the-digest",
       "citations": [
@@ -24419,7 +24527,7 @@
     {
       "id": "openwop.it.semantic-digest-vectors.the-two-unicode-forms-do-not-collide-because-jcs-does-not-apply-nfc",
       "file": "semantic-digest-vectors.test.ts",
-      "line": 120,
+      "line": 128,
       "title": "the two Unicode forms do not collide, because JCS does not apply NFC",
       "explicitId": "openwop.it.semantic-digest-vectors.the-two-unicode-forms-do-not-collide-because-jcs-does-not-apply-nfc",
       "citations": [
@@ -24432,7 +24540,7 @@
     {
       "id": "openwop.it.semantic-digest-vectors.each-field-v1-excluded-now-changes-the-digest",
       "file": "semantic-digest-vectors.test.ts",
-      "line": 133,
+      "line": 141,
       "title": "each field v1 excluded now changes the digest",
       "explicitId": "openwop.it.semantic-digest-vectors.each-field-v1-excluded-now-changes-the-digest",
       "citations": [
@@ -26494,7 +26602,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-message-carrying-taskid-without-contextid-is-answered-with-the-task-s-contexti",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 134,
+      "line": 136,
       "title": "a message carrying taskId without contextId is answered with the task's contextId",
       "explicitId": null,
       "citations": [
@@ -26525,7 +26633,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-message-whose-contextid-is-not-its-task-s-is-refused-invalid-parameters-and-ch",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 148,
+      "line": 150,
       "title": "a message whose contextId is not its task's is refused invalid-parameters and changes nothing",
       "explicitId": null,
       "citations": [
@@ -26552,7 +26660,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-message-to-a-retained-terminal-task-is-refused-unsupportedoperationerror-and-a",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 163,
+      "line": 165,
       "title": "a message to a retained terminal task is refused UnsupportedOperationError, and appends no event",
       "explicitId": null,
       "citations": [
@@ -26579,7 +26687,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-unknown-task-and-another-tenant-s-task-are-answered-by-the-same-tasknotfounde",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 178,
+      "line": 180,
       "title": "an unknown task and another tenant's task are answered by the same TaskNotFoundError",
       "explicitId": null,
       "citations": [
@@ -26612,7 +26720,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.task-status-state-is-the-map-s-projection-of-the-run-status-at-every-observed-st",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 200,
+      "line": 202,
       "title": "Task.status.state is the map's projection of the run status at every observed state",
       "explicitId": null,
       "citations": [
@@ -26635,7 +26743,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.the-json-rpc-error-codes-the-suite-can-cause-are-the-a2a-1-0-1-codes",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 225,
+      "line": 227,
       "title": "the JSON-RPC error codes the suite can cause are the A2A 1.0.1 codes",
       "explicitId": null,
       "citations": [
@@ -26658,7 +26766,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-row-whose-requires-facet-is-not-advertised-is-refused-with-the-row-s-error",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 239,
+      "line": 241,
       "title": "a row whose requires facet is not advertised is refused with the row's error",
       "explicitId": null,
       "citations": [
@@ -26673,10 +26781,130 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-a2a-operation-map.a-host-not-advertising-a2a-pushnotifications-refuses-all-four-push-config-operat",
+      "file": "v2-a2a-operation-map.test.ts",
+      "line": 254,
+      "title": "a host not advertising a2a.pushNotifications refuses all four push-config operations with PushNotificationNotSupportedError",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "a2a.operations GetTask",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-operation-map.rfc-0214-createtaskpushnotificationconfig-refuses-a-non-https-or-private-destina",
+      "file": "v2-a2a-operation-map.test.ts",
+      "line": 285,
+      "title": "RFC 0214 — CreateTaskPushNotificationConfig refuses a non-https or private destination",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-operation-map.rfc-0214-e-a-push-config-of-another-tenant-s-task-of-another-task-or-unknown-is",
+      "file": "v2-a2a-operation-map.test.ts",
+      "line": 303,
+      "title": "RFC 0214 §E — a push config of another tenant's task, of another task, or unknown, is answered identically",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
+          "requirement": "SendMessage MUST start two tasks with tenant-bound ids"
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a delete naming another tenant's task MUST NOT delete the caller's config",
+          "interpolated": true
+        },
+        {
+          "section": "A2A v1.0.1 §3.1.10 (\"MUST be idempotent\")",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-operation-map.rfc-0214-a-a-push-config-s-token-and-credentials-are-never-returned-and-never-re",
+      "file": "v2-a2a-operation-map.test.ts",
+      "line": 347,
+      "title": "RFC 0214 §A — a push config's token and credentials are never returned, and never reach task, events or state",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-a2a-operation-map.listtasks-returns-only-what-listruns-returns-to-the-same-subject-tenant-and-cont",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 252,
+      "line": 381,
       "title": "ListTasks returns only what listRuns returns to the same Subject; tenant and contextId never select",
       "explicitId": null,
       "citations": [
@@ -26713,7 +26941,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-a2a-error-s-data-is-an-array-carrying-one-errorinfo-with-the-map-row-s-reason",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 285,
+      "line": 414,
       "title": "an A2A error's data is an array carrying one ErrorInfo with the map row's reason and the A2A domain",
       "explicitId": null,
       "citations": [
@@ -26747,7 +26975,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.no-response-on-the-card-s-json-rpc-interface-url-is-the-openwop-error-envelope",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 306,
+      "line": 435,
       "title": "no response on the card's JSON-RPC interface URL is the OpenWOP error envelope",
       "explicitId": null,
       "citations": [
@@ -26765,7 +26993,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.versionnotsupportederror-carries-errorinfo-version-not-supported-and-supportedve",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 326,
+      "line": 455,
       "title": "VersionNotSupportedError carries ErrorInfo VERSION_NOT_SUPPORTED, and supportedVersions is a comma-joined subset of the card",
       "explicitId": null,
       "citations": [
@@ -26789,7 +27017,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-http-json-interface-answers-an-a2a-error-with-google-rpc-status-carrying-the",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 344,
+      "line": 473,
       "title": "an HTTP+JSON interface answers an A2A error with google.rpc.Status carrying the ErrorInfo",
       "explicitId": null,
       "citations": [
@@ -26808,7 +27036,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-run-suspended-on-a-credential-interrupt-projects-to-task-state-auth-required-n",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 359,
+      "line": 488,
       "title": "a run suspended on a credential interrupt projects to TASK_STATE_AUTH_REQUIRED, naming the provider and carrying connectUrl",
       "explicitId": null,
       "citations": [
@@ -26841,10 +27069,124 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-a2a-push-delivery.a-c-a-transition-after-registration-is-posted-to-the-registered-destination-with",
+      "file": "v2-a2a-push-delivery.test.ts",
+      "line": 140,
+      "title": "§A/§C — a transition after registration is POSTed to the registered destination with the registered Authorization and no OpenWOP signature",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "A2A v1.0.1 §4.3.3",
+          "requirement": "a push is an HTTP POST"
+        },
+        {
+          "section": null,
+          "requirement": "the push MUST carry the registered credential as Authorization: {scheme} {credentials}",
+          "interpolated": true
+        },
+        {
+          "section": "A2A v1.0.1 §4.3.3",
+          "requirement": "the push body is application/a2a+json"
+        },
+        {
+          "section": "A2A v1.0.1 §4.3.3 (StreamResponse)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "an A2A push MUST NOT carry an OpenWOP-Signature — A2A defines no secret exchange to verify it",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-push-delivery.b-a-3xx-from-the-destination-is-a-failed-delivery-the-redirect-target-receives-n",
+      "file": "v2-a2a-push-delivery.test.ts",
+      "line": 170,
+      "title": "§B — a 3xx from the destination is a failed delivery: the redirect target receives nothing, credential or not",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the redirect target MUST receive nothing: a 3xx is a delivery failure and the credential MUST NOT be sent after a redirect",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-push-delivery.a-after-delete-no-further-push-reaches-that-destination-while-a-live-config-on-t",
+      "file": "v2-a2a-push-delivery.test.ts",
+      "line": 192,
+      "title": "§A — after Delete no further push reaches that destination, while a live config on the same task still receives",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "a deleted config MUST receive nothing further — its destination credential is discarded with it",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-a2a-push-delivery.d-a-replay-fork-of-a-pushed-run-delivers-nothing-to-the-source-run-s-destination",
+      "file": "v2-a2a-push-delivery.test.ts",
+      "line": 218,
+      "title": "§D — a replay fork of a pushed run delivers nothing to the source run's destination",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"A2A push delivery\" (RFC 0214)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-2-envelope-carrying-a-version-1-body-is-refused-the-positive-is-admitt",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 128,
+      "line": 129,
       "title": "a version-2 envelope carrying a version-1 body is refused; the positive is admitted; above the floor is refused; below it follows envelopeStrictness",
       "explicitId": "openwop.requirement.0209.version-selects-branch",
       "citations": [
@@ -26888,7 +27230,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.no-first-createsurface-a-message-after-deletesurface-and-a-second-createsurface",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 154,
+      "line": 155,
       "title": "no first createSurface, a message after deleteSurface, and a second createSurface are each refused; the valid steps are admitted",
       "explicitId": "openwop.requirement.0209.fold-guarded",
       "citations": [
@@ -26902,7 +27244,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-createsurface-catalogid-differing-from-the-payload-catalogid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 179,
+      "line": 180,
       "title": "a createSurface.catalogId differing from the payload catalogId is refused",
       "explicitId": "openwop.requirement.0209.catalog-equality",
       "citations": [
@@ -26920,7 +27262,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-message-whose-surfaceid-differs-from-the-payload-surfaceid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 193,
+      "line": 194,
       "title": "a message whose surfaceId differs from the payload surfaceId is refused",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.surface-id-equality",
       "citations": [
@@ -26938,7 +27280,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-recorded-version-2-surface-is-returned-byte-equal-on-poll-and-carried-by-a-for",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 209,
+      "line": 210,
       "title": "a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.recorded-as-recorded",
       "citations": [
@@ -26951,6 +27293,16 @@
           "section": "RFC 0209 §C.11",
           "requirement": "the run's poll MUST return the recorded surface payload byte-equal — no surface is regenerated"
         },
+        {
+          "section": "RFC 0209 §C.9",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "api/seams-v2.yaml emitA2uiSurface",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0209 §C.11",
           "requirement": null,
@@ -26965,7 +27317,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-1-surface-recorded-at-floor-1-is-returned-byte-equal-on-poll-and-carri",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 228,
+      "line": 237,
       "title": "a version-1 surface recorded at floor 1 is returned byte-equal on poll and carried by a fork",
       "explicitId": "openwop.requirement.0209.legacy-readable",
       "citations": [
@@ -26983,6 +27335,16 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "api/seams-v2.yaml emitA2uiSurface",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0209 §C.11",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0209 §C.11",
           "requirement": "a fork at a later fromSeq MUST carry the version-1 surface unchanged"
@@ -26992,7 +27354,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.one-untrusted-update-taints-a-trusted-surface-a-later-trusted-update-does-not-la",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 247,
+      "line": 261,
       "title": "one untrusted update taints a trusted surface, a later trusted update does not launder it, and the approval does not advance; an all-trusted surface does",
       "explicitId": "openwop.requirement.0209.taint-sticky",
       "citations": [
@@ -27815,7 +28177,7 @@
     {
       "id": "openwop.it.v2-content-locale-keys.an-advertised-extended-content-locale-is-written-and-delivered",
       "file": "v2-content-locale-keys.test.ts",
-      "line": 51,
+      "line": 56,
       "title": "an advertised extended content locale is written and delivered",
       "explicitId": "openwop.requirement.0206.delivery-extended-locale",
       "citations": [
@@ -30575,7 +30937,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.a-callback-authenticated-as-another-subject-makes-no-token-request-and-stores-no",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 123,
+      "line": 129,
       "title": "a callback authenticated as another Subject makes no token request and stores nothing",
       "explicitId": null,
       "citations": [
@@ -30598,7 +30960,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.a-wrong-or-missing-iss-with-authorization-response-iss-parameter-supported-makes",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 145,
+      "line": 151,
       "title": "a wrong or missing iss (with authorization_response_iss_parameter_supported) makes no token request",
       "explicitId": null,
       "citations": [
@@ -30622,7 +30984,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.issuer-less-providers-get-redirect-uris-no-other-provider-shares",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 173,
+      "line": 179,
       "title": "issuer-less providers get redirect URIs no other provider shares",
       "explicitId": null,
       "citations": [
@@ -30640,7 +31002,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.the-redirect-uri-is-fixed-per-provider-whatever-the-request-carries",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 189,
+      "line": 195,
       "title": "the redirect URI is fixed per provider whatever the request carries",
       "explicitId": null,
       "citations": [
@@ -40554,6 +40916,50 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
+      "file": "v2-bundle-witness-preimage.test.ts",
+      "line": 66,
+      "title": "every committed v3 bundle re-derives its witnessSha256 from the prose preimage",
+      "explicitId": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
+      "citations": [
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the spec repo MUST carry committed v3 bundles for this census to mean anything"
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the census MUST cover every committed v3 bundle"
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
+      "file": "v2-bundle-witness-preimage.test.ts",
+      "line": 80,
+      "title": "the row comparator is code-unit order, which a locale collation contradicts",
+      "explicitId": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
+      "citations": [
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the fixture ids MUST order differently under code units and Czech collation, or this leg proves nothing"
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "witnessSha256 rows MUST sort by UTF-16 code units; a locale-sensitive comparator MUST NOT be used"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",
@@ -40938,7 +41344,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-schema.the-gate-refuses-an-enum-member-with-no-2-2-row-and-a-suite-map-the-table-does-n",
       "file": "v2-lane-exp-only-schema.test.ts",
-      "line": 117,
+      "line": 127,
       "title": "the gate refuses an enum member with no §2.2 row, and a suite map the table does not license",
       "explicitId": null,
       "citations": [
@@ -41204,6 +41610,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-push-credential-coherent.the-push-credential-exception-is-stated-wherever-the-rule-it-excepts-is-read-and",
+      "file": "v2-push-credential-coherent.test.ts",
+      "line": 71,
+      "title": "the push-credential exception is stated wherever the rule it excepts is read, and each regression is refused",
+      "explicitId": "openwop.requirement.0214.push-credential-coherent",
+      "citations": [
+        {
+          "section": "RFCS/0214 §A–§B; spec/v2/core/security-defaults.md §\"Onward hops\"; spec/v2/core/interop.md §\"A2A push delivery\"",
+          "requirement": "every clause of the RFC 0214 correction is present in the tracked corpus"
+        },
+        {
+          "section": "RFCS/0214 §A–§B; spec/v2/core/security-defaults.md §\"Onward hops\"; spec/v2/core/interop.md §\"A2A push delivery\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-release-identity.the-corpus-gate-script-exits-0",
       "file": "v2-release-identity.test.ts",