@openwop/openwop-conformance 2.40.0 → 2.40.2

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 635,
-    "tests": 2427,
-    "withStableId": 2427,
+    "files": 636,
+    "tests": 2437,
+    "withStableId": 2437,
     "interpolatedTitles": 0,
-    "explicitIds": 2307
+    "explicitIds": 2331
   },
   "records": [
     {
@@ -26810,7 +26810,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 275,
       "title": "a host not advertising a2a.pushNotifications refuses all four push-config operations with PushNotificationNotSupportedError",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-unadvertised-refused",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26823,7 +26823,7 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.errors PushNotificationNotSupportedError (serverWhen: push config without a2a.pushNotifications) and the push-config operation rows; A2A v1.0.1 §3.3.4",
           "requirement": null,
           "interpolated": true
         }
@@ -26834,7 +26834,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 306,
       "title": "RFC 0214 — CreateTaskPushNotificationConfig refuses a non-https or private destination",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-register-ssrf",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26842,12 +26842,12 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations CreateTaskPushNotificationConfig (\"the url MUST pass the webhooks.md egress guard\"); webhooks.md §Egress; RFC 0214 §B",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations CreateTaskPushNotificationConfig (\"the url MUST pass the webhooks.md egress guard\"); webhooks.md §Egress; RFC 0214 §B",
           "requirement": null,
           "interpolated": true
         }
@@ -26858,41 +26858,40 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 324,
       "title": "RFC 0214 §E — a push config of another tenant's task, of another task, or unknown, is answered identically",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-config-isolation",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
           "requirement": "SendMessage MUST start two tasks with tenant-bound ids"
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
-          "requirement": "a delete naming another tenant's task MUST NOT delete the caller's config",
-          "interpolated": true
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
+          "requirement": "a delete naming another tenant's task MUST NOT delete the caller's config"
         },
         {
           "section": "A2A v1.0.1 §3.1.10 (\"MUST be idempotent\")",
@@ -26906,7 +26905,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 368,
       "title": "RFC 0214 §A — a push config's token and credentials are never returned, and never reach task, events or state",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-secrets-not-returned",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26914,12 +26913,12 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations push rows (\"secrets are never returned\"); security-defaults.md §\"Onward hops\" (RFC 0214 §A)",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations push rows (\"secrets are never returned\"); security-defaults.md §\"Onward hops\" (RFC 0214 §A)",
           "requirement": null,
           "interpolated": true
         }
@@ -27062,7 +27061,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 509,
       "title": "a run suspended on a credential interrupt projects to TASK_STATE_AUTH_REQUIRED, naming the provider and carrying connectUrl",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.a2a-auth-required",
       "citations": [
         {
           "section": "runs.md createRun",
@@ -27218,7 +27217,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-2-envelope-carrying-a-version-1-body-is-refused-the-positive-is-admitt",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 129,
+      "line": 137,
       "title": "a version-2 envelope carrying a version-1 body is refused; the positive is admitted; above the floor is refused; below it follows envelopeStrictness",
       "explicitId": "openwop.requirement.0209.version-selects-branch",
       "citations": [
@@ -27262,7 +27261,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.no-first-createsurface-a-message-after-deletesurface-and-a-second-createsurface",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 155,
+      "line": 163,
       "title": "no first createSurface, a message after deleteSurface, and a second createSurface are each refused; the valid steps are admitted",
       "explicitId": "openwop.requirement.0209.fold-guarded",
       "citations": [
@@ -27276,7 +27275,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-createsurface-catalogid-differing-from-the-payload-catalogid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 180,
+      "line": 188,
       "title": "a createSurface.catalogId differing from the payload catalogId is refused",
       "explicitId": "openwop.requirement.0209.catalog-equality",
       "citations": [
@@ -27294,7 +27293,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-message-whose-surfaceid-differs-from-the-payload-surfaceid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 194,
+      "line": 202,
       "title": "a message whose surfaceId differs from the payload surfaceId is refused",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.surface-id-equality",
       "citations": [
@@ -27312,7 +27311,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-recorded-version-2-surface-is-returned-byte-equal-on-poll-and-carried-by-a-for",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 210,
+      "line": 218,
       "title": "a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.recorded-as-recorded",
       "citations": [
@@ -27349,7 +27348,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-1-surface-recorded-at-floor-1-is-returned-byte-equal-on-poll-and-carri",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 237,
+      "line": 245,
       "title": "a version-1 surface recorded at floor 1 is returned byte-equal on poll and carried by a fork",
       "explicitId": "openwop.requirement.0209.legacy-readable",
       "citations": [
@@ -27386,7 +27385,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.one-untrusted-update-taints-a-trusted-surface-a-later-trusted-update-does-not-la",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 261,
+      "line": 269,
       "title": "one untrusted update taints a trusted surface, a later trusted update does not launder it, and the approval does not advance; an all-trusted surface does",
       "explicitId": "openwop.requirement.0209.taint-sticky",
       "citations": [
@@ -27397,6 +27396,19 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-a2ui-v09-surface.records-why-render-needs-root-has-no-server-side-witness-and-where-its-witness-l",
+      "file": "v2-a2ui-v09-surface.test.ts",
+      "line": 308,
+      "title": "records why render-needs-root has no server-side witness, and where its witness lives",
+      "explicitId": "openwop.requirement.0209.render-needs-root",
+      "citations": [
+        {
+          "section": "RFC 0209 §C.9",
+          "requirement": "a renderer does not render a surface before its root component exists"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-advertised-fixtures-exist.a-sampled-advertised-fixture-is-actually-creatable-not-just-listed",
       "file": "v2-advertised-fixtures-exist.test.ts",
@@ -27467,7 +27479,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.a-getartifact-answered-as-application-a2a-json-validates-against-artifact-schema",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 80,
+      "line": 87,
       "title": "a getArtifact answered as application/a2a+json validates against artifact.schema.json",
       "explicitId": "openwop.requirement.0205.artifact-a2a-shape",
       "citations": [
@@ -27491,7 +27503,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.the-artifactid-of-an-application-a2a-json-body-equals-the-artifactid-path-segmen",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 92,
+      "line": 99,
       "title": "the artifactId of an application/a2a+json body equals the {artifactId} path segment",
       "explicitId": "openwop.requirement.0205.artifact-id-matches-path",
       "citations": [
@@ -27508,7 +27520,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.the-url-of-a-url-part-answers-no-2xx-to-a-second-tenant-or-to-no-credential",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 103,
+      "line": 110,
       "title": "the url of a url Part answers no 2xx to a second tenant or to no credential",
       "explicitId": "openwop.requirement.0205.artifact-url-part-scoped",
       "citations": [
@@ -27524,6 +27536,19 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-artifact-a2a-shape.records-why-export-alias-equivalence-has-no-wire-witness",
+      "file": "v2-artifact-a2a-shape.test.ts",
+      "line": 132,
+      "title": "records why export-alias-equivalence has no wire witness",
+      "explicitId": "openwop.requirement.0205.export-alias-equivalence",
+      "citations": [
+        {
+          "section": "RFC 0205 §C.11",
+          "requirement": "an export alias and its media type name one format"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-assurance-downgrade-audited.an-identity-below-the-lane-floor-is-refused-with-sender-constraint-missing",
       "file": "v2-assurance-downgrade-audited.test.ts",
@@ -27912,7 +27937,7 @@
     {
       "id": "openwop.it.v2-capability-maturity-bounded.no-family-record-advertises-stable-above-its-corpus-declaration-row",
       "file": "v2-capability-maturity-bounded.test.ts",
-      "line": 69,
+      "line": 92,
       "title": "no family record advertises `stable` above its corpus declaration row",
       "explicitId": "openwop.requirement.0197.maturity-not-overstated",
       "citations": [
@@ -27933,6 +27958,20 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-capability-maturity-bounded.no-run-emits-a-persisted-member-the-release-has-retired",
+      "file": "v2-capability-maturity-bounded.test.ts",
+      "line": 134,
+      "title": "no run emits a persisted member the release has retired",
+      "explicitId": "openwop.requirement.0197.retired-not-emitted",
+      "citations": [
+        {
+          "section": "RFC 0197 §A.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-capability-record-shape.every-family-record-carries-status-since-and-witness-from-the-wire-legal-sets",
       "file": "v2-capability-record-shape.test.ts",
@@ -29617,7 +29656,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-inside-the-advertised-window-is-accepted-the-control-the-two-refusa",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 149,
+      "line": 152,
       "title": "a credential inside the advertised window is accepted — the control the two refusals rest on",
       "explicitId": "openwop.requirement.0210.exp-only-control-accepted",
       "citations": [
@@ -29631,7 +29670,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-total-lifetime-exceeds-the-window-is-refused-401-and-so-is-on",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 164,
+      "line": 167,
       "title": "a credential whose TOTAL lifetime exceeds the window is refused 401, and so is one carrying no iat",
       "explicitId": "openwop.requirement.0210.exp-only-lifetime-bound",
       "citations": [
@@ -29650,7 +29689,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.the-over-lifetime-refusal-names-credential-lifetime-exceeded-not-a-generic-unaut",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 199,
+      "line": 202,
       "title": "the over-lifetime refusal names credential_lifetime_exceeded, not a generic unauthenticated",
       "explicitId": "openwop.requirement.0210.credential-lifetime-code",
       "citations": [
@@ -29664,7 +29703,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-remaining-lifetime-exceeds-the-window-is-refused-though-its-t",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 217,
+      "line": 220,
       "title": "a credential whose REMAINING lifetime exceeds the window is refused, though its total lifetime does not",
       "explicitId": "openwop.requirement.0210.exp-only-remaining-bound",
       "citations": [
@@ -30354,7 +30393,7 @@
       "file": "v2-mcp-mount-map.test.ts",
       "line": 287,
       "title": "a credential interrupt is answered in URL mode (url = connectUrl), isError without URL support, and input_required again on an accept retry with no credential",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.mcp-url-mode",
       "citations": [
         {
           "section": "interop-map.json mcp.mrtr InputRequiredResult (host as server)",
@@ -30392,7 +30431,7 @@
       "file": "v2-mcp-mount-map.test.ts",
       "line": 328,
       "title": "form mode is never emitted for a nested schema or a sensitive (format password) field",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.form-mode-no-secret",
       "citations": [
         {
           "section": "interop-map.json mcp.mrtr InputRequiredResult (host as server)",
@@ -31211,7 +31250,7 @@
     {
       "id": "openwop.it.v2-oidc-id-token-audience.a-same-audience-id-token-is-admissible-and-one-minted-for-another-relying-party",
       "file": "v2-oidc-id-token-audience.test.ts",
-      "line": 74,
+      "line": 68,
       "title": "a same-audience ID token is admissible, and one minted for another relying party is audience_mismatch",
       "explicitId": "openwop.requirement.0200.id-token-aud",
       "citations": [
@@ -33379,7 +33418,7 @@
       "file": "v2-webhook-endpoint-verification.test.ts",
       "line": 64,
       "title": "no-echo, wrong-echo and a redirect are refused and persist nothing; an echo is accepted",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.endpoint-verification",
       "citations": [
         {
           "section": "RFC 0201 §D.14",
@@ -33447,7 +33486,7 @@
       "file": "v2-webhook-message-id-stable.test.ts",
       "line": 69,
       "title": "every attempt of one delivery carries one webhook-id, and distinct deliveries carry distinct ids",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.message-id-stable",
       "citations": [
         {
           "section": "RFC 0201 §C.10",
@@ -33480,7 +33519,7 @@
       "file": "v2-webhook-secret-rotation.test.ts",
       "line": 67,
       "title": "a rotation dual-signs for overlapSeconds, keeps OpenWOP-Signature on the previous secret, and is tenant-checked",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.secret-rotation",
       "citations": [
         {
           "section": "RFC 0201 §E.18 / identity.md §5",
@@ -33563,7 +33602,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 77,
       "title": "a subscription that did not opt in is neither verified nor given webhook-* headers",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.opt-in-only",
       "citations": [
         {
           "section": "RFC 0201 §B.8 / §D.15",
@@ -33597,7 +33636,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 110,
       "title": "the opt-in is validated, its 201 echoes the applied list, and no response carries the secret",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.registration-validated",
       "citations": [
         {
           "section": "RFC 0201 §B.5–§B.6",
@@ -33629,7 +33668,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 155,
       "title": "an opted-in delivery is dual-signed and its Standard Webhooks signature covers the id",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.delivery-signed",
       "citations": [
         {
           "section": "RFC 0201 §B",
@@ -36661,10 +36700,10 @@
       ]
     },
     {
-      "id": "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-report-names-the-overstated-families-and-t",
+      "id": "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-gate-states-when-c-7-binds",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 76,
-      "title": "the committed corpus is green, and the report NAMES the overstated families and the gap row",
+      "line": 85,
+      "title": "the committed corpus is green, and the gate states when §C.7 binds",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
         {
@@ -36672,14 +36711,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
-          "requirement": "a \"reported\" disposition that printed nothing would be indistinguishable from a clean tree; the report MUST name the gap row that owes the re-cut"
-        },
-        {
-          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
-          "requirement": "the report MUST name the families by key, not just count them — a number nobody can act on is not a report"
-        },
         {
           "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
           "requirement": "the gate MUST state which suite version makes §C.7 binding, so \"reported\" has a visible end date"
@@ -36687,10 +36718,10 @@
       ]
     },
     {
-      "id": "openwop.it.bundle-maturity-gate.the-same-committed-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-every-ov",
+      "id": "openwop.it.bundle-maturity-gate.the-superseded-myndhyve-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-eve",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 86,
-      "title": "the same committed bundle re-labelled onto the RFC’s suite FAILS, naming every overstated family",
+      "line": 93,
+      "title": "the superseded MyndHyve bundle re-labelled onto the RFC’s suite FAILS, naming every overstated family",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
         {
@@ -36712,7 +36743,7 @@
     {
       "id": "openwop.it.bundle-maturity-gate.the-count-is-derived-promoting-one-family-in-the-declaration-drops-38-to-37",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 95,
+      "line": 102,
       "title": "the count is DERIVED — promoting one family in the declaration drops 38 to 37",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
@@ -36730,7 +36761,7 @@
     {
       "id": "openwop.it.bundle-maturity-gate.a-bundle-whose-suite-is-below-the-rfc-s-is-reported-not-failed-even-with-the-sam",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 103,
+      "line": 110,
       "title": "a bundle whose suite is BELOW the RFC’s is reported, not failed, even with the same 38",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
@@ -36746,6 +36777,14 @@
         {
           "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
           "requirement": "the reported row must cite COMPATIBILITY.md §2.3 — an old pass stays a measurement at the suite that measured it"
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
+          "requirement": "a \"reported\" disposition that printed nothing would be indistinguishable from a clean tree; the report MUST name the gap row that owes the re-cut"
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
+          "requirement": "the report MUST name the families by key, not just count them — a number nobody can act on is not a report"
         }
       ]
     },
@@ -41055,7 +41094,7 @@
     {
       "id": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
       "file": "v2-bundle-witness-preimage.test.ts",
-      "line": 66,
+      "line": 69,
       "title": "every committed v3 bundle re-derives its witnessSha256 from the prose preimage",
       "explicitId": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
       "citations": [
@@ -41082,7 +41121,7 @@
     {
       "id": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
       "file": "v2-bundle-witness-preimage.test.ts",
-      "line": 80,
+      "line": 83,
       "title": "the row comparator is code-unit order, which a locale collation contradicts",
       "explicitId": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
       "citations": [
@@ -41096,6 +41135,167 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-colocated-companion.a-3-the-anchor-list-is-closed-and-exact",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 157,
+      "title": "§A.3 the anchor list is closed and exact",
+      "explicitId": "openwop.requirement.0216.anchor-list-closed",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base fixture list MUST pass the anchor gate, or every sabotage below proves nothing"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.b-7-the-marker-is-inside-the-signed-digest",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 175,
+      "title": "§B.7 the marker is inside the signed digest",
+      "explicitId": "openwop.requirement.0216.deployment-in-preimage",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "host.deployment MUST enter the witnessSha256 preimage when present"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a bundle without the marker MUST digest exactly as before RFC 0216"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a signed companion that sheds host.deployment MUST fail verification with witness-digest"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the unaltered companion MUST NOT be refused for its digest"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-a-companion-counts-only-for-listed-rows",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 187,
+      "title": "§C.9 a companion counts only for listed rows",
+      "explicitId": "openwop.requirement.0216.companion-anchor-rows-only",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base companion MUST pair with the served-host bundle of the same image, key and configuration"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a paired companion MUST witness its harness-trust-anchor rows"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a paired companion MUST NOT witness a row off the anchor list, however it passed"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "an uncertified companion MUST witness nothing"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-a-b-the-same-host-and-the-same-image-digest",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 197,
+      "title": "§C.9(a)/(b) the same host and the same image digest",
+      "explicitId": "openwop.requirement.0216.companion-same-image",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a commit-kind build MUST NOT pair — a commit does not name the bytes that ran"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "image digests differing in one byte MUST NOT pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion of another host MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-c-signed-under-a-key-the-served-bundle-publishes",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 209,
+      "title": "§C.9(c) signed under a key the served bundle publishes",
+      "explicitId": "openwop.requirement.0216.companion-attributable",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion whose attestation does not verify under the named published key MUST NOT pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion signed under a key the served bundle does not publish MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-d-equivalent-discovery-origin-and-oidc-issuers-aside",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 218,
+      "title": "§C.9(d) equivalent discovery, origin and oidc issuers aside",
+      "explicitId": "openwop.requirement.0216.companion-equivalent",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion differing only in origin and oidc issuers MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a different revocationWindowSeconds MUST NOT pair — it is a different claim"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a difference in a non-oidc lane MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-10-the-committed-unmarked-companion-witnesses-nothing",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 227,
+      "title": "§C.10 the committed unmarked companion witnesses nothing",
+      "explicitId": "openwop.requirement.0216.legacy-companion",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the committed 2026-09-25 companion MUST be recognised as a companion by its witnessSha256"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the committed unmarked companion MUST witness nothing (commit-kind build, throwaway key)"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the legacy file carries no marker — it is caught by digest, not by a field it could drop"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",
@@ -41482,7 +41682,7 @@
       "file": "v2-lane-exp-only-schema.test.ts",
       "line": 127,
       "title": "the gate refuses an enum member with no §2.2 row, and a suite map the table does not license",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0210.lane-rule-surfaces-agree",
       "citations": [
         {
           "section": "scripts/check-lane-revocation-rules.mjs",