@openwop/openwop-conformance 2.40.1 → 2.40.3

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 635,
-    "tests": 2430,
-    "withStableId": 2430,
+    "files": 636,
+    "tests": 2438,
+    "withStableId": 2438,
     "interpolatedTitles": 0,
-    "explicitIds": 2310
+    "explicitIds": 2332
   },
   "records": [
     {
@@ -7170,9 +7170,38 @@
       ]
     },
     {
-      "id": "openwop.it.certification-bundle-redaction.evidencesecretsfromenv-never-scrubs-a-key-identifier-id-variables-are-excluded-a",
+      "id": "openwop.it.certification-bundle-redaction.evidencesecretsfromenv-never-treats-a-setting-about-a-secret-as-one-a-bare-integ",
       "file": "certification-bundle-redaction.test.ts",
       "line": 157,
+      "title": "evidenceSecretsFromEnv never treats a setting ABOUT a secret as one: a bare integer or a value under 8 characters is not swept from the environment",
+      "explicitId": "openwop.it.certification-bundle-redaction.setting-about-a-secret-not-swept",
+      "citations": [
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a bare-integer setting whose NAME mentions a secret (a rotation overlap, a TTL) MUST NOT be swept as a credential"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a value under 8 characters is not credential-shaped and is not swept from the environment"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a credential-shaped value is still swept"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a credential the emitter hands over explicitly is scrubbed whatever its shape"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "scrubbing MUST NOT corrupt a digest the bundle carries"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.certification-bundle-redaction.evidencesecretsfromenv-never-scrubs-a-key-identifier-id-variables-are-excluded-a",
+      "file": "certification-bundle-redaction.test.ts",
+      "line": 180,
       "title": "evidenceSecretsFromEnv never scrubs a key IDENTIFIER: *_ID variables are excluded and `except` values stay visible whichever variable carried them",
       "explicitId": "openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed",
       "citations": [
@@ -7189,7 +7218,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 177,
+      "line": 200,
       "title": "verifyBundleV2 REJECTS a bundle carrying the conformance canary anywhere, and accepts the scrubbed twin",
       "explicitId": "openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc",
       "citations": [
@@ -7202,7 +7231,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.the-canary-in-a-discovery-document-key-is-still-a-rejection-keys-are-evidence",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 192,
+      "line": 215,
       "title": "the canary in a discovery-document KEY is still a rejection (keys are evidence)",
       "explicitId": "openwop.it.certification-bundle-redaction.the-canary-in-a-discovery-document-key-is-still-a-rejection-keys-are-evidence",
       "citations": [
@@ -7215,7 +7244,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.the-target-configuration-digest-is-a-digest-the-api-key-is-not-a-substring-of-an",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 198,
+      "line": 221,
       "title": "the target-configuration digest is a digest: the API key is not a substring of any string in the document",
       "explicitId": "openwop.it.certification-bundle-redaction.the-target-configuration-digest-is-a-digest-the-api-key-is-not-a-substring-of-an",
       "citations": [
@@ -26810,7 +26839,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 275,
       "title": "a host not advertising a2a.pushNotifications refuses all four push-config operations with PushNotificationNotSupportedError",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-unadvertised-refused",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26823,7 +26852,7 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.errors PushNotificationNotSupportedError (serverWhen: push config without a2a.pushNotifications) and the push-config operation rows; A2A v1.0.1 §3.3.4",
           "requirement": null,
           "interpolated": true
         }
@@ -26834,7 +26863,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 306,
       "title": "RFC 0214 — CreateTaskPushNotificationConfig refuses a non-https or private destination",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-register-ssrf",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26842,12 +26871,12 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations CreateTaskPushNotificationConfig (\"the url MUST pass the webhooks.md egress guard\"); webhooks.md §Egress; RFC 0214 §B",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations CreateTaskPushNotificationConfig (\"the url MUST pass the webhooks.md egress guard\"); webhooks.md §Egress; RFC 0214 §B",
           "requirement": null,
           "interpolated": true
         }
@@ -26858,41 +26887,40 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 324,
       "title": "RFC 0214 §E — a push config of another tenant's task, of another task, or unknown, is answered identically",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-config-isolation",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
           "requirement": "SendMessage MUST start two tasks with tenant-bound ids"
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
-          "requirement": "a delete naming another tenant's task MUST NOT delete the caller's config",
-          "interpolated": true
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
+          "requirement": "a delete naming another tenant's task MUST NOT delete the caller's config"
         },
         {
           "section": "A2A v1.0.1 §3.1.10 (\"MUST be idempotent\")",
@@ -26906,7 +26934,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 368,
       "title": "RFC 0214 §A — a push config's token and credentials are never returned, and never reach task, events or state",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-secrets-not-returned",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26914,12 +26942,12 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations push rows (\"secrets are never returned\"); security-defaults.md §\"Onward hops\" (RFC 0214 §A)",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations push rows (\"secrets are never returned\"); security-defaults.md §\"Onward hops\" (RFC 0214 §A)",
           "requirement": null,
           "interpolated": true
         }
@@ -27062,7 +27090,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 509,
       "title": "a run suspended on a credential interrupt projects to TASK_STATE_AUTH_REQUIRED, naming the provider and carrying connectUrl",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.a2a-auth-required",
       "citations": [
         {
           "section": "runs.md createRun",
@@ -29657,7 +29685,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-inside-the-advertised-window-is-accepted-the-control-the-two-refusa",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 149,
+      "line": 152,
       "title": "a credential inside the advertised window is accepted — the control the two refusals rest on",
       "explicitId": "openwop.requirement.0210.exp-only-control-accepted",
       "citations": [
@@ -29671,7 +29699,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-total-lifetime-exceeds-the-window-is-refused-401-and-so-is-on",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 164,
+      "line": 167,
       "title": "a credential whose TOTAL lifetime exceeds the window is refused 401, and so is one carrying no iat",
       "explicitId": "openwop.requirement.0210.exp-only-lifetime-bound",
       "citations": [
@@ -29690,7 +29718,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.the-over-lifetime-refusal-names-credential-lifetime-exceeded-not-a-generic-unaut",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 199,
+      "line": 202,
       "title": "the over-lifetime refusal names credential_lifetime_exceeded, not a generic unauthenticated",
       "explicitId": "openwop.requirement.0210.credential-lifetime-code",
       "citations": [
@@ -29704,7 +29732,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-remaining-lifetime-exceeds-the-window-is-refused-though-its-t",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 217,
+      "line": 220,
       "title": "a credential whose REMAINING lifetime exceeds the window is refused, though its total lifetime does not",
       "explicitId": "openwop.requirement.0210.exp-only-remaining-bound",
       "citations": [
@@ -30394,7 +30422,7 @@
       "file": "v2-mcp-mount-map.test.ts",
       "line": 287,
       "title": "a credential interrupt is answered in URL mode (url = connectUrl), isError without URL support, and input_required again on an accept retry with no credential",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.mcp-url-mode",
       "citations": [
         {
           "section": "interop-map.json mcp.mrtr InputRequiredResult (host as server)",
@@ -30432,7 +30460,7 @@
       "file": "v2-mcp-mount-map.test.ts",
       "line": 328,
       "title": "form mode is never emitted for a nested schema or a sensitive (format password) field",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.form-mode-no-secret",
       "citations": [
         {
           "section": "interop-map.json mcp.mrtr InputRequiredResult (host as server)",
@@ -31251,7 +31279,7 @@
     {
       "id": "openwop.it.v2-oidc-id-token-audience.a-same-audience-id-token-is-admissible-and-one-minted-for-another-relying-party",
       "file": "v2-oidc-id-token-audience.test.ts",
-      "line": 74,
+      "line": 68,
       "title": "a same-audience ID token is admissible, and one minted for another relying party is audience_mismatch",
       "explicitId": "openwop.requirement.0200.id-token-aud",
       "citations": [
@@ -32081,7 +32109,7 @@
     {
       "id": "openwop.it.v2-revocation-honored.a-revoked-next-request-credential-is-refused-on-the-next-request-with-credential",
       "file": "v2-revocation-honored.test.ts",
-      "line": 38,
+      "line": 40,
       "title": "a revoked next-request credential is refused on the next request with credential_revoked",
       "explicitId": "openwop.requirement.0170.revocation-honored",
       "citations": [
@@ -33419,7 +33447,7 @@
       "file": "v2-webhook-endpoint-verification.test.ts",
       "line": 64,
       "title": "no-echo, wrong-echo and a redirect are refused and persist nothing; an echo is accepted",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.endpoint-verification",
       "citations": [
         {
           "section": "RFC 0201 §D.14",
@@ -33487,7 +33515,7 @@
       "file": "v2-webhook-message-id-stable.test.ts",
       "line": 69,
       "title": "every attempt of one delivery carries one webhook-id, and distinct deliveries carry distinct ids",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.message-id-stable",
       "citations": [
         {
           "section": "RFC 0201 §C.10",
@@ -33520,7 +33548,7 @@
       "file": "v2-webhook-secret-rotation.test.ts",
       "line": 67,
       "title": "a rotation dual-signs for overlapSeconds, keeps OpenWOP-Signature on the previous secret, and is tenant-checked",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.secret-rotation",
       "citations": [
         {
           "section": "RFC 0201 §E.18 / identity.md §5",
@@ -33603,7 +33631,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 77,
       "title": "a subscription that did not opt in is neither verified nor given webhook-* headers",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.opt-in-only",
       "citations": [
         {
           "section": "RFC 0201 §B.8 / §D.15",
@@ -33637,7 +33665,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 110,
       "title": "the opt-in is validated, its 201 echoes the applied list, and no response carries the secret",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.registration-validated",
       "citations": [
         {
           "section": "RFC 0201 §B.5–§B.6",
@@ -33669,7 +33697,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 155,
       "title": "an opted-in delivery is dual-signed and its Standard Webhooks signature covers the id",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.delivery-signed",
       "citations": [
         {
           "section": "RFC 0201 §B",
@@ -41095,7 +41123,7 @@
     {
       "id": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
       "file": "v2-bundle-witness-preimage.test.ts",
-      "line": 66,
+      "line": 69,
       "title": "every committed v3 bundle re-derives its witnessSha256 from the prose preimage",
       "explicitId": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
       "citations": [
@@ -41122,7 +41150,7 @@
     {
       "id": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
       "file": "v2-bundle-witness-preimage.test.ts",
-      "line": 80,
+      "line": 83,
       "title": "the row comparator is code-unit order, which a locale collation contradicts",
       "explicitId": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
       "citations": [
@@ -41136,6 +41164,167 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-colocated-companion.a-3-the-anchor-list-is-closed-and-exact",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 157,
+      "title": "§A.3 the anchor list is closed and exact",
+      "explicitId": "openwop.requirement.0216.anchor-list-closed",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base fixture list MUST pass the anchor gate, or every sabotage below proves nothing"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.b-7-the-marker-is-inside-the-signed-digest",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 175,
+      "title": "§B.7 the marker is inside the signed digest",
+      "explicitId": "openwop.requirement.0216.deployment-in-preimage",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "host.deployment MUST enter the witnessSha256 preimage when present"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a bundle without the marker MUST digest exactly as before RFC 0216"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a signed companion that sheds host.deployment MUST fail verification with witness-digest"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the unaltered companion MUST NOT be refused for its digest"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-a-companion-counts-only-for-listed-rows",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 187,
+      "title": "§C.9 a companion counts only for listed rows",
+      "explicitId": "openwop.requirement.0216.companion-anchor-rows-only",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base companion MUST pair with the served-host bundle of the same image, key and configuration"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a paired companion MUST witness its harness-trust-anchor rows"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a paired companion MUST NOT witness a row off the anchor list, however it passed"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "an uncertified companion MUST witness nothing"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-a-b-the-same-host-and-the-same-image-digest",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 197,
+      "title": "§C.9(a)/(b) the same host and the same image digest",
+      "explicitId": "openwop.requirement.0216.companion-same-image",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a commit-kind build MUST NOT pair — a commit does not name the bytes that ran"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "image digests differing in one byte MUST NOT pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion of another host MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-c-signed-under-a-key-the-served-bundle-publishes",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 209,
+      "title": "§C.9(c) signed under a key the served bundle publishes",
+      "explicitId": "openwop.requirement.0216.companion-attributable",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion whose attestation does not verify under the named published key MUST NOT pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion signed under a key the served bundle does not publish MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-d-equivalent-discovery-origin-and-oidc-issuers-aside",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 218,
+      "title": "§C.9(d) equivalent discovery, origin and oidc issuers aside",
+      "explicitId": "openwop.requirement.0216.companion-equivalent",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion differing only in origin and oidc issuers MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a different revocationWindowSeconds MUST NOT pair — it is a different claim"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a difference in a non-oidc lane MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-10-the-committed-unmarked-companion-witnesses-nothing",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 227,
+      "title": "§C.10 the committed unmarked companion witnesses nothing",
+      "explicitId": "openwop.requirement.0216.legacy-companion",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the committed 2026-09-25 companion MUST be recognised as a companion by its witnessSha256"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the committed unmarked companion MUST witness nothing (commit-kind build, throwaway key)"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the legacy file carries no marker — it is caught by digest, not by a field it could drop"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",
@@ -41522,7 +41711,7 @@
       "file": "v2-lane-exp-only-schema.test.ts",
       "line": 127,
       "title": "the gate refuses an enum member with no §2.2 row, and a suite map the table does not license",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0210.lane-rule-surfaces-agree",
       "citations": [
         {
           "section": "scripts/check-lane-revocation-rules.mjs",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.1",
-  "corpusTag": "v2.40.1",
+  "version": "2.40.3",
+  "corpusTag": "v2.40.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "23c87c259cbe4b6d087faa9f358684921d400a11330bde6b27c8cacbf0b16d78",
-    "api/v2/asyncapi.yaml": "3629ae4718168e424aee3e93b3c785df904a12229a2c58c0eec0ecaf9f8f5b2e",
-    "api/v2/openapi.yaml": "74d9beac93b861a3d191ee5e87ce047a907171df6ecdb3fcb0854d28e8df119c",
+    "api/seams-v2.yaml": "96b5b49ba8aab1595b547d568ece7c4fb9fae9d7bdde29aff7c39f20ef31b120",
+    "api/v2/asyncapi.yaml": "cc4d94df8eb1e168f30f8c12279bc65cf34c948a5ed95cc062288728fc605618",
+    "api/v2/openapi.yaml": "5029e637cd61c900b169cb3f79e61e48b3ee89a6c3c11f3262158bf2fa910125",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -117,7 +117,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "740944d7f0a00c91308449f3a3f52fa7b91b16b8fd36a0171b917afe9f4b0f09",
-    "schemas/v2/certification-bundle.schema.json": "67ac56bbf5f8deeec58b32e8d7bc9ce854a6a8c3cd81693e65192e5c3b726154",
+    "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "77d77c3ee245f8f7855a530a3aa610a0a7c00a26df6c97962f1600c93e8b13c1",
+    "spec/v1/core-standard-manifest.json": "c8d01314ab747038fb9b3ef17552d336f61211591b4af07379e65f65a6e55454",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "45483b0932d4b2a80b0781419abc697f7d363be46bddfd8163a48364b8f76a36",
+    "spec/v1/gaps.json": "41e5bbd50515eb08923a29a79dfeb41d045f2b28dec9b2af3473c18db148c7be",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -218,7 +218,7 @@
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ccfed7d978ce7293a6d8f3c0f6045835dfb7e488f2b67a68f6b04d67c4b0cfc9",
     "spec/v2/core/capabilities.md": "e22381fed3a93376ad478fa7f07571fdad9653aefd7c05f189a2ef45a49f6c63",
-    "spec/v2/core/conformance.md": "38ebc9e56a830d0ee0ade429b81b0cd302c23e49a13647b1b902275262d6610d",
+    "spec/v2/core/conformance.md": "e4d3b34ef5b7c6a34675ed59a086143e8bfd0e00d0d04ce0f2a2ec6245275084",
     "spec/v2/core/connection-packs.md": "7257339a4fc125011bf89961588c949cb058a0c0f7d9808ad08a5288deb3f8fc",
     "spec/v2/core/conversation.md": "c9a937e410fdb4e092cec2f05a7cab8b5232745090cfb20041c03c70ccbb5cdc",
     "spec/v2/core/errors.md": "619cd74381c41acf33d012eb1afd834e148ac292663a1a6fa6744dbaff9661d9",
@@ -231,7 +231,7 @@
     "spec/v2/core/interop.md": "9a6b37e07c0235856199ace6b3a84f592fa5903fcf6c442f8a18f4d6b6aa5525",
     "spec/v2/core/interrupt.md": "1dc94f7c791dd5a547b1abafde6a8a76acd3d2993d288057f302f57911dc83bf",
     "spec/v2/core/node-pack-runtimes.md": "c435ad506f618831b6c0a9fd9150d83a5dc6caa1e3d755b949af2ff8949f1140",
-    "spec/v2/core/oauth.md": "08e558a742259e75cfb2123f4c364d238dc4c57eea1a3c25d8f420ab4dff8244",
+    "spec/v2/core/oauth.md": "38ec0e70d46f328430138559095f261ae4fcd3d32c2d994a2d3e630a062c0e6c",
     "spec/v2/core/overview.md": "8f9d4a68b6185664e40d226cb82d9a9270a6c6630e3db59bddff300be781947d",
     "spec/v2/core/packs.md": "91cd577b4a636c1587ef78742e583a203244b8508b289b01a18a8ef2ef0a9b3e",
     "spec/v2/core/persistence.md": "d32736bd74e51df7c552565b4105a8ec801ece6d2292c8676421368ee9bffec1",
@@ -240,7 +240,7 @@
     "spec/v2/core/security-defaults.md": "500471a8db7af9b776ac40b4a9a278c9f3d45e1c1dead880114e7fadc7bee37d",
     "spec/v2/core/tool-catalog.md": "35f1a3fd509db0fc0490ddf400686fe94dc4b20c98064d5ebe776da516153e60",
     "spec/v2/core/versioning.md": "0aded71d090c8358c3ce17763c120cfc1cc42531a5eaa1b8a2a7016ed9594069",
-    "spec/v2/core/webhooks.md": "95880896e37e5b7096693a75203cf0ed70cefa09959230e17b45aa9193078eff",
+    "spec/v2/core/webhooks.md": "2a44b100c42dd841fe2b8f87179a981be6c0dd26608ce1b14e077318c4ac8201",
     "spec/v2/core/workflow-chain-packs.md": "ee45d3fede3bb6f0cc6abcf0d6c929c7cd213a0fbe862b738a998f929c4d1102",
     "spec/v2/corrections.json": "cc74ffde74384b0f261a4f625871d922e8661d654d647a8534e21036595cb280",
     "spec/v2/corrections.schema.json": "4ac595b9a6d7f66d53de03fe0edbe0dc58de46426932387bfdc0ceb3cf949a3e",
@@ -284,6 +284,8 @@
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
     "spec/v2/facets/webhooks.schema.json": "2fac635ee5fbc10a14a1a46cf512a11bac660bfbabe0aea79f6c7b657ecb9e4e",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
+    "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
+    "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
     "spec/v2/id-field-bindings.json": "9f6fd280250447e26a6704811c352bb8f2ff6c4bd242befe3da0ba38962370e9",
     "spec/v2/interop-map.json": "02255dafe7eb55f61ca7f9ae7c21f079d1848a6756991343088975ac9d184b8d",
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
@@ -292,9 +294,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c24fde3d12b1732d9f0162ef0a0596ebd24501935cd28801eb892fbb6ec57949",
+    "spec/v2/release.json": "4c84997343779f46a54f9c4caf3d02714abc563f618b25729ca4b52468a23d39",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "72d51a1bd81cbe3cee07f9ad0ab7b481b60d4e74e651704e9b3242c49c93ec11"
+    "spec/v2/surface-baseline.json": "2f1da906609307ec885cb04c36d7e688cd3124933759c88dc9ae3fa0ee9ec88b"
   },
-  "corpusCommit": "470ee4d7a2cb94ddb893d82d57ade4d95644d74b"
+  "corpusCommit": "5d3d440cac757fb2b6c08452f64785eaeda086d3"
 }