@openwop/openwop-conformance 2.42.8 → 2.43.0

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 642,
-    "tests": 2466,
-    "withStableId": 2466,
+    "files": 645,
+    "tests": 2481,
+    "withStableId": 2481,
     "interpolatedTitles": 0,
-    "explicitIds": 2356
+    "explicitIds": 2367
   },
   "records": [
     {
@@ -5425,15 +5425,72 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.audit-anomaly-shape.every-anomaly-kind-validates-in-its-own-shape",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 74,
+      "title": "every anomaly kind validates in its own shape",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.audit-anomaly-shape.an-anomaly-outside-its-kind-s-shape-is-refused",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 84,
+      "title": "an anomaly outside its kind's shape is refused",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.audit-anomaly-shape.chainvalid-is-false-exactly-when-anomalies-is-non-empty",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 92,
+      "title": "chainValid is false exactly when anomalies is non-empty",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.audit-checkpoint-signature.every-checkpoint-get-v1-audit-verify-returns-verifies-under-the-advertised-key",
       "file": "audit-checkpoint-signature.test.ts",
-      "line": 30,
+      "line": 29,
       "title": "every checkpoint GET /v1/audit/verify returns verifies under the advertised key",
       "explicitId": "openwop.requirement.0218.checkpoint-signature-over-root",
       "citations": [
         {
-          "section": "RFC 0218 · spec/v1/auth-profiles.md §\"Audit-log integrity\" 3",
+          "section": "RFC 0218 · spec/v1/auth-profiles.md §\"Audit-log integrity\" 3; spec/v2/core/security-defaults.md §\"Audit-log integrity\" (RFC 0224)",
           "requirement": null,
           "interpolated": true
         }
@@ -5534,10 +5591,19 @@
     {
       "id": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "file": "audit-log-integrity.test.ts",
-      "line": 60,
+      "line": 80,
       "title": "host that claims the profile advertises required capability fields",
       "explicitId": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "citations": [
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": "auditLogIntegrity.checkpointPublicKey MUST be an Ed25519 SubjectPublicKeyInfo, base64"
+        },
         {
           "section": "auth-profiles.md §\"Audit-log integrity\"",
           "requirement": "openwop-audit-log-integrity profile MUST advertise auditLogIntegrity.hashChain: true"
@@ -5551,13 +5617,14 @@
     {
       "id": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "file": "audit-log-integrity.test.ts",
-      "line": 83,
+      "line": 111,
       "title": "GET /v1/audit/verify on a recent range reports chainValid: true",
       "explicitId": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "citations": [
         {
           "section": "auth-profiles.md §\"Audit-log integrity\" §\"Verification endpoint\"",
-          "requirement": "claiming openwop-audit-log-integrity profile REQUIRES exposing GET /v1/audit/verify"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "audit-verify-result.schema.json",
@@ -5574,6 +5641,29 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.audit-log-integrity.verify-lists-every-checkpoint-ascending-no-more-than-checkpointintervalentries-a",
+      "file": "audit-log-integrity.test.ts",
+      "line": 163,
+      "title": "verify lists every checkpoint ascending, no more than checkpointIntervalEntries apart",
+      "explicitId": "openwop.requirement.0224.checkpoint-cadence",
+      "citations": [
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": "every checkpoint MUST carry an integer atSequence"
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.auth-api-key-rotation.host-claiming-rotation-profile-advertises-required-fields",
       "file": "auth-api-key-rotation.test.ts",
@@ -6731,7 +6821,7 @@
     {
       "id": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "file": "byok-roundtrip.test.ts",
-      "line": 39,
+      "line": 51,
       "title": "the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex",
       "explicitId": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "citations": [
@@ -6756,7 +6846,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "file": "byok-roundtrip.test.ts",
-      "line": 104,
+      "line": 116,
       "title": "BYOK fixture run MUST emit a node.completed event for the resolve step",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "citations": [
@@ -6769,7 +6859,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "file": "byok-roundtrip.test.ts",
-      "line": 130,
+      "line": 143,
       "title": "BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "citations": [
@@ -11541,7 +11631,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 104,
+      "line": 108,
       "title": "capabilities.envelopes.reliability.completion (when present) conforms to RFC 0033 §E",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.capabilities-envelopes-reliability-completion-when-present-conforms-to-rfc-0033",
       "citations": [
@@ -11558,7 +11648,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 127,
+      "line": 131,
       "title": "truncation: emits envelope.truncated + envelope.retry.attempted with reason: \"truncation\"",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-emits-envelope-truncated-envelope-retry-attempted-with-reason-truncat",
       "citations": [
@@ -11579,20 +11669,21 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 152,
+      "line": 156,
       "title": "truncation: retry budget strictly greater than initial (RFC 0033 §B truncationBudgetMultiplier)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.truncation-retry-budget-strictly-greater-than-initial-rfc-0033-b-truncationbudge",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §B",
-          "requirement": "truncation retry MUST multiply maxTokens by truncationBudgetMultiplier — final budget > initial 50 fixture value"
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 176,
+      "line": 185,
       "title": "schema-violation: NO envelope.truncated; envelope.retry.attempted reason ∈ {schema-violation, parse-error}",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-no-envelope-truncated-envelope-retry-attempted-reason-schema-vi",
       "citations": [
@@ -11609,7 +11700,7 @@
     {
       "id": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "file": "envelope-completion-distinguishes-truncation.test.ts",
-      "line": 206,
+      "line": 215,
       "title": "schema-violation: retry budget UNCHANGED from initial (no budget multiplication on this path)",
       "explicitId": "openwop.it.envelope-completion-distinguishes-truncation.schema-violation-retry-budget-unchanged-from-initial-no-budget-multiplication-on",
       "citations": [
@@ -12261,7 +12352,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.when-mock-llm-emits-invalid-envelope-on-attempt-1-then-valid-on-attempt-2-exactl",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 158,
+      "line": 162,
       "title": "when mock LLM emits invalid envelope on attempt 1 then valid on attempt 2, exactly one `envelope.retry.attempted` event fires before the second attempt",
       "explicitId": "openwop.it.envelope-retry-attempted.when-mock-llm-emits-invalid-envelope-on-attempt-1-then-valid-on-attempt-2-exactl",
       "citations": [
@@ -12274,7 +12365,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.event-payload-carries-attempt-2-1-indexed-first-attempt-does-not-emit",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 179,
+      "line": 183,
       "title": "event payload carries `attempt: 2` (1-indexed; first attempt does not emit)",
       "explicitId": "openwop.it.envelope-retry-attempted.event-payload-carries-attempt-2-1-indexed-first-attempt-does-not-emit",
       "citations": [
@@ -12291,7 +12382,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.reason-is-one-of-the-spec-reserved-closed-enum-values-or-matches-the-x-host-host",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 197,
+      "line": 201,
       "title": "`reason` is one of the spec-reserved closed-enum values OR matches the `x-host-<host>-<key>` extension pattern",
       "explicitId": "openwop.it.envelope-retry-attempted.reason-is-one-of-the-spec-reserved-closed-enum-values-or-matches-the-x-host-host",
       "citations": [
@@ -12304,7 +12395,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.eventual-success-records-normally-via-envelope-acceptance-downstream-runeventdoc",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 217,
+      "line": 221,
       "title": "eventual success records normally via envelope acceptance + downstream RunEventDoc",
       "explicitId": "openwop.it.envelope-retry-attempted.eventual-success-records-normally-via-envelope-acceptance-downstream-runeventdoc",
       "citations": [
@@ -12317,7 +12408,7 @@
     {
       "id": "openwop.it.envelope-retry-attempted.previouserror-when-populated-must-not-contain-prompt-or-response-substring-excer",
       "file": "envelope-retry-attempted.test.ts",
-      "line": 236,
+      "line": 240,
       "title": "`previousError` (when populated) MUST NOT contain prompt or response substring excerpts — limit to validator output",
       "explicitId": "openwop.it.envelope-retry-attempted.previouserror-when-populated-must-not-contain-prompt-or-response-substring-excer",
       "citations": [
@@ -12428,7 +12519,7 @@
     {
       "id": "openwop.it.envelope-truncated.when-mock-returns-stopreason-max-tokens-on-attempt-1-exactly-one-envelope-trunca",
       "file": "envelope-truncated.test.ts",
-      "line": 60,
+      "line": 59,
       "title": "when mock returns stopReason: max_tokens on attempt 1, exactly one envelope.truncated event fires with stopReason: max_tokens",
       "explicitId": "openwop.it.envelope-truncated.when-mock-returns-stopreason-max-tokens-on-attempt-1-exactly-one-envelope-trunca",
       "citations": [
@@ -12441,7 +12532,7 @@
     {
       "id": "openwop.it.envelope-truncated.payload-includes-nodeid-provider-model-partialpayloadavailable-boolean",
       "file": "envelope-truncated.test.ts",
-      "line": 86,
+      "line": 85,
       "title": "payload includes nodeId + provider + model + partialPayloadAvailable boolean",
       "explicitId": "openwop.it.envelope-truncated.payload-includes-nodeid-provider-model-partialpayloadavailable-boolean",
       "citations": [
@@ -12454,13 +12545,14 @@
     {
       "id": "openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte",
       "file": "envelope-truncated.test.ts",
-      "line": 105,
+      "line": 104,
       "title": "retry attempt receives a maxTokens value strictly greater than the previous attempt (RFC 0033 §B truncationBudgetMultiplier)",
       "explicitId": "openwop.it.envelope-truncated.retry-attempt-receives-a-maxtokens-value-strictly-greater-than-the-previous-atte",
       "citations": [
         {
           "section": "RFCS/0033-envelope-completion-contract.md §B",
-          "requirement": "truncation retry MUST issue with a strictly-increased maxTokens budget (host multiplies by capabilities.envelopes.reliability.completion.truncationBudgetMultiplier)"
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
@@ -27711,6 +27803,95 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-with-no-routing-edge-fails-the-run-with-approval-rejected",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 103,
+      "title": "a rejected gate with no routing edge fails the run with approval_rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the terminal snapshot error.code MUST be approval_rejected",
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "run.failed.error.code MUST be approval_rejected"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.interrupt-resolved-records-action-reject-and-decision-rejected",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 114,
+      "title": "interrupt.resolved records action reject and decision rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the reject MUST be recorded as interrupt.resolved",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "interrupt.resolved MUST carry action \"reject\" and decision \"rejected\"",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.the-gate-node-fails-with-approval-rejected-not-retryable-and-run-failed-names-it",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 127,
+      "title": "the gate node fails with approval_rejected, not retryable, and run.failed names it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the gate that does not turn the rejection into an output MUST emit node.failed"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "node.failed.error MUST carry code approval_rejected and retryable false"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "run.failed.failedNodeId MUST name the gate"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-majority-reject-decides-the-quorum-gate-on-the-deciding-vote-and-fails-the-run",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 140,
+      "title": "a majority reject decides the quorum gate on the deciding vote and fails the run with approval_rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "one reject of three under majority does not decide the gate: the run MUST stay waiting-approval"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "a vote that does not decide the gate MUST NOT emit interrupt.resolved"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the terminal snapshot error.code MUST be approval_rejected"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-approver-enforced.a-resolver-outside-approverslist-is-refused-at-resolve-time",
       "file": "v2-approver-enforced.test.ts",
@@ -32592,6 +32773,56 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-registry-lifecycle.a-yanked-version-is-never-latest-while-an-unyanked-one-exists-the-flags-agree-ac",
+      "file": "v2-registry-lifecycle.test.ts",
+      "line": 130,
+      "title": "a yanked version is never latest while an unyanked one exists, the flags agree across index and manifest, and a yanked version stays served",
+      "explicitId": "openwop.requirement.0222.yanked-version-lifecycle",
+      "citations": [
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": "the per-pack index MUST NOT name a yanked version latest while an unyanked one exists, and the index MUST agree with each version manifest"
+        },
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-registry-lifecycle.every-served-version-names-a-listed-key-whose-permittednamespaces-admit-it-and-i",
+      "file": "v2-registry-lifecycle.test.ts",
+      "line": 177,
+      "title": "every served version names a listed key whose permittedNamespaces admit it, and its signature verifies — whatever the key status",
+      "explicitId": "openwop.requirement.0222.signing-keys-cover-served-versions",
+      "citations": [
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": "every signingKeys[] entry MUST carry keyId, publicKeyUrl, status and permittedNamespaces"
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": "the v2 tree MUST serve at least one version manifest to witness"
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-relaxation-recorded.a-bundle-recording-a-relaxation-cannot-certify-the-relaxed-profile",
       "file": "v2-relaxation-recorded.test.ts",
@@ -33869,13 +34100,18 @@
         {
           "section": "spec/v2/core/webhooks.md §Delivery",
           "requirement": "a major-2 owner echo carries tenant and subject"
+        },
+        {
+          "section": "spec/v2/core/webhooks.md §Delivery",
+          "requirement": null,
+          "interpolated": true
         }
       ]
     },
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 239,
+      "line": 244,
       "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -33893,7 +34129,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 263,
+      "line": 268,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -42154,7 +42390,7 @@
     {
       "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-it-was-generated-from-and-renders-every-code",
       "file": "v2-error-registry-prose-parity.test.ts",
-      "line": 26,
+      "line": 35,
       "title": "errors.md states the registry count it was generated from and renders every code",
       "explicitId": "openwop.requirement.0171.error-registry-prose-parity",
       "citations": [
@@ -42174,6 +42410,34 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-error-registry-prose-parity.approval-rejected-is-a-registered-422-not-retriable-and-interrupt-md-rejection-n",
+      "file": "v2-error-registry-prose-parity.test.ts",
+      "line": 67,
+      "title": "approval_rejected is a registered 422, not retriable, and interrupt.md §Rejection names it",
+      "explicitId": "openwop.requirement.0223.code-registered",
+      "citations": [
+        {
+          "section": "spec/v2/errors.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/errors.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "schemas/v2/suspend-request.schema.json ApprovalData.onTimeout",
+          "requirement": "onTimeout MUST exist and declare no default — absent means reject by prose (RFC 0223)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-event-naming-rule.every-closed-enum-v2-event-type-is-two-kebab-segments-and-every-recorded-artifac",
       "file": "v2-event-naming-rule.test.ts",
@@ -43022,9 +43286,86 @@
       ]
     },
     {
-      "id": "openwop.it.v2-surface-monotone-gate.an-open-object-closed-to-additionalproperties-false-is-refused-b-6",
+      "id": "openwop.it.v2-surface-monotone-gate.positive-control-a-required-under-a-then-selecting-only-enum-members-this-diff-a",
       "file": "v2-surface-monotone-gate.test.ts",
       "line": 156,
+      "title": "POSITIVE CONTROL — a `required` under a `then` selecting only enum members this diff adds is additive",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the gate must say it admitted the conditional, not pass it silently"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-required-under-a-then-an-existing-enum-value-selects-is-refused-b-6",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 171,
+      "title": "a `required` under a `then` an EXISTING enum value selects is REFUSED (§B.6)",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the property and the object"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-then-pinning-only-a-pre-existing-value-or-pinning-nothing-required-licenses-no",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 186,
+      "title": "a `then` pinning only a PRE-EXISTING value, or pinning nothing required, licenses nothing",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the property and the object"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-new-value-conditional-does-not-launder-an-unconditional-required-beside-it",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 204,
+      "title": "a new-value conditional does not launder an UNCONDITIONAL `required` beside it",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the unconditional property"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.an-open-object-closed-to-additionalproperties-false-is-refused-b-6",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 218,
       "title": "an OPEN object closed to `additionalProperties: false` is REFUSED (§B.6)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [
@@ -43042,7 +43383,7 @@
     {
       "id": "openwop.it.v2-surface-monotone-gate.a-narrowed-type-is-refused-a-1-add-the-new-shape-beside-the-old-one",
       "file": "v2-surface-monotone-gate.test.ts",
-      "line": 163,
+      "line": 225,
       "title": "a narrowed `type` is REFUSED (§A.1 — add the new shape beside the old one)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [
@@ -43060,7 +43401,7 @@
     {
       "id": "openwop.it.v2-surface-monotone-gate.a-removed-operation-is-refused-a-path-manifest-row-is-a-surface-too",
       "file": "v2-surface-monotone-gate.test.ts",
-      "line": 170,
+      "line": 232,
       "title": "a removed OPERATION is REFUSED (a path-manifest row is a surface too)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [