@openwop/openwop-conformance 2.42.9 → 2.43.0

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 642,
-    "tests": 2466,
-    "withStableId": 2466,
+    "files": 645,
+    "tests": 2481,
+    "withStableId": 2481,
     "interpolatedTitles": 0,
-    "explicitIds": 2356
+    "explicitIds": 2367
   },
   "records": [
     {
@@ -5425,15 +5425,72 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.audit-anomaly-shape.every-anomaly-kind-validates-in-its-own-shape",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 74,
+      "title": "every anomaly kind validates in its own shape",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.audit-anomaly-shape.an-anomaly-outside-its-kind-s-shape-is-refused",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 84,
+      "title": "an anomaly outside its kind's shape is refused",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.audit-anomaly-shape.chainvalid-is-false-exactly-when-anomalies-is-non-empty",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 92,
+      "title": "chainValid is false exactly when anomalies is non-empty",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.audit-checkpoint-signature.every-checkpoint-get-v1-audit-verify-returns-verifies-under-the-advertised-key",
       "file": "audit-checkpoint-signature.test.ts",
-      "line": 30,
+      "line": 29,
       "title": "every checkpoint GET /v1/audit/verify returns verifies under the advertised key",
       "explicitId": "openwop.requirement.0218.checkpoint-signature-over-root",
       "citations": [
         {
-          "section": "RFC 0218 · spec/v1/auth-profiles.md §\"Audit-log integrity\" 3",
+          "section": "RFC 0218 · spec/v1/auth-profiles.md §\"Audit-log integrity\" 3; spec/v2/core/security-defaults.md §\"Audit-log integrity\" (RFC 0224)",
           "requirement": null,
           "interpolated": true
         }
@@ -5534,10 +5591,19 @@
     {
       "id": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "file": "audit-log-integrity.test.ts",
-      "line": 60,
+      "line": 80,
       "title": "host that claims the profile advertises required capability fields",
       "explicitId": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "citations": [
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": "auditLogIntegrity.checkpointPublicKey MUST be an Ed25519 SubjectPublicKeyInfo, base64"
+        },
         {
           "section": "auth-profiles.md §\"Audit-log integrity\"",
           "requirement": "openwop-audit-log-integrity profile MUST advertise auditLogIntegrity.hashChain: true"
@@ -5551,13 +5617,14 @@
     {
       "id": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "file": "audit-log-integrity.test.ts",
-      "line": 83,
+      "line": 111,
       "title": "GET /v1/audit/verify on a recent range reports chainValid: true",
       "explicitId": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "citations": [
         {
           "section": "auth-profiles.md §\"Audit-log integrity\" §\"Verification endpoint\"",
-          "requirement": "claiming openwop-audit-log-integrity profile REQUIRES exposing GET /v1/audit/verify"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "audit-verify-result.schema.json",
@@ -5574,6 +5641,29 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.audit-log-integrity.verify-lists-every-checkpoint-ascending-no-more-than-checkpointintervalentries-a",
+      "file": "audit-log-integrity.test.ts",
+      "line": 163,
+      "title": "verify lists every checkpoint ascending, no more than checkpointIntervalEntries apart",
+      "explicitId": "openwop.requirement.0224.checkpoint-cadence",
+      "citations": [
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": "every checkpoint MUST carry an integer atSequence"
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.auth-api-key-rotation.host-claiming-rotation-profile-advertises-required-fields",
       "file": "auth-api-key-rotation.test.ts",
@@ -6731,7 +6821,7 @@
     {
       "id": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "file": "byok-roundtrip.test.ts",
-      "line": 39,
+      "line": 51,
       "title": "the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex",
       "explicitId": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "citations": [
@@ -6756,7 +6846,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "file": "byok-roundtrip.test.ts",
-      "line": 104,
+      "line": 116,
       "title": "BYOK fixture run MUST emit a node.completed event for the resolve step",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "citations": [
@@ -6769,7 +6859,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "file": "byok-roundtrip.test.ts",
-      "line": 130,
+      "line": 143,
       "title": "BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "citations": [
@@ -27713,6 +27803,95 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-with-no-routing-edge-fails-the-run-with-approval-rejected",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 103,
+      "title": "a rejected gate with no routing edge fails the run with approval_rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the terminal snapshot error.code MUST be approval_rejected",
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "run.failed.error.code MUST be approval_rejected"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.interrupt-resolved-records-action-reject-and-decision-rejected",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 114,
+      "title": "interrupt.resolved records action reject and decision rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the reject MUST be recorded as interrupt.resolved",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "interrupt.resolved MUST carry action \"reject\" and decision \"rejected\"",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.the-gate-node-fails-with-approval-rejected-not-retryable-and-run-failed-names-it",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 127,
+      "title": "the gate node fails with approval_rejected, not retryable, and run.failed names it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the gate that does not turn the rejection into an output MUST emit node.failed"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "node.failed.error MUST carry code approval_rejected and retryable false"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "run.failed.failedNodeId MUST name the gate"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-majority-reject-decides-the-quorum-gate-on-the-deciding-vote-and-fails-the-run",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 140,
+      "title": "a majority reject decides the quorum gate on the deciding vote and fails the run with approval_rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "one reject of three under majority does not decide the gate: the run MUST stay waiting-approval"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "a vote that does not decide the gate MUST NOT emit interrupt.resolved"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the terminal snapshot error.code MUST be approval_rejected"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-approver-enforced.a-resolver-outside-approverslist-is-refused-at-resolve-time",
       "file": "v2-approver-enforced.test.ts",
@@ -32594,6 +32773,56 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-registry-lifecycle.a-yanked-version-is-never-latest-while-an-unyanked-one-exists-the-flags-agree-ac",
+      "file": "v2-registry-lifecycle.test.ts",
+      "line": 130,
+      "title": "a yanked version is never latest while an unyanked one exists, the flags agree across index and manifest, and a yanked version stays served",
+      "explicitId": "openwop.requirement.0222.yanked-version-lifecycle",
+      "citations": [
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": "the per-pack index MUST NOT name a yanked version latest while an unyanked one exists, and the index MUST agree with each version manifest"
+        },
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-registry-lifecycle.every-served-version-names-a-listed-key-whose-permittednamespaces-admit-it-and-i",
+      "file": "v2-registry-lifecycle.test.ts",
+      "line": 177,
+      "title": "every served version names a listed key whose permittedNamespaces admit it, and its signature verifies — whatever the key status",
+      "explicitId": "openwop.requirement.0222.signing-keys-cover-served-versions",
+      "citations": [
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": "every signingKeys[] entry MUST carry keyId, publicKeyUrl, status and permittedNamespaces"
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": "the v2 tree MUST serve at least one version manifest to witness"
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-relaxation-recorded.a-bundle-recording-a-relaxation-cannot-certify-the-relaxed-profile",
       "file": "v2-relaxation-recorded.test.ts",
@@ -42161,7 +42390,7 @@
     {
       "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-it-was-generated-from-and-renders-every-code",
       "file": "v2-error-registry-prose-parity.test.ts",
-      "line": 26,
+      "line": 35,
       "title": "errors.md states the registry count it was generated from and renders every code",
       "explicitId": "openwop.requirement.0171.error-registry-prose-parity",
       "citations": [
@@ -42181,6 +42410,34 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-error-registry-prose-parity.approval-rejected-is-a-registered-422-not-retriable-and-interrupt-md-rejection-n",
+      "file": "v2-error-registry-prose-parity.test.ts",
+      "line": 67,
+      "title": "approval_rejected is a registered 422, not retriable, and interrupt.md §Rejection names it",
+      "explicitId": "openwop.requirement.0223.code-registered",
+      "citations": [
+        {
+          "section": "spec/v2/errors.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/errors.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "schemas/v2/suspend-request.schema.json ApprovalData.onTimeout",
+          "requirement": "onTimeout MUST exist and declare no default — absent means reject by prose (RFC 0223)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-event-naming-rule.every-closed-enum-v2-event-type-is-two-kebab-segments-and-every-recorded-artifac",
       "file": "v2-event-naming-rule.test.ts",
@@ -43029,9 +43286,86 @@
       ]
     },
     {
-      "id": "openwop.it.v2-surface-monotone-gate.an-open-object-closed-to-additionalproperties-false-is-refused-b-6",
+      "id": "openwop.it.v2-surface-monotone-gate.positive-control-a-required-under-a-then-selecting-only-enum-members-this-diff-a",
       "file": "v2-surface-monotone-gate.test.ts",
       "line": 156,
+      "title": "POSITIVE CONTROL — a `required` under a `then` selecting only enum members this diff adds is additive",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the gate must say it admitted the conditional, not pass it silently"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-required-under-a-then-an-existing-enum-value-selects-is-refused-b-6",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 171,
+      "title": "a `required` under a `then` an EXISTING enum value selects is REFUSED (§B.6)",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the property and the object"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-then-pinning-only-a-pre-existing-value-or-pinning-nothing-required-licenses-no",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 186,
+      "title": "a `then` pinning only a PRE-EXISTING value, or pinning nothing required, licenses nothing",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the property and the object"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-new-value-conditional-does-not-launder-an-unconditional-required-beside-it",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 204,
+      "title": "a new-value conditional does not launder an UNCONDITIONAL `required` beside it",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the unconditional property"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.an-open-object-closed-to-additionalproperties-false-is-refused-b-6",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 218,
       "title": "an OPEN object closed to `additionalProperties: false` is REFUSED (§B.6)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [
@@ -43049,7 +43383,7 @@
     {
       "id": "openwop.it.v2-surface-monotone-gate.a-narrowed-type-is-refused-a-1-add-the-new-shape-beside-the-old-one",
       "file": "v2-surface-monotone-gate.test.ts",
-      "line": 163,
+      "line": 225,
       "title": "a narrowed `type` is REFUSED (§A.1 — add the new shape beside the old one)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [
@@ -43067,7 +43401,7 @@
     {
       "id": "openwop.it.v2-surface-monotone-gate.a-removed-operation-is-refused-a-path-manifest-row-is-a-surface-too",
       "file": "v2-surface-monotone-gate.test.ts",
-      "line": 170,
+      "line": 232,
       "title": "a removed OPERATION is REFUSED (a path-manifest row is a surface too)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 567,
-    "v1": 451,
-    "v2": 128
+    "files": 570,
+    "v1": 452,
+    "v2": 133
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -249,15 +249,21 @@
     "artifact-type-store-without-render.test.ts": [
       1
     ],
+    "audit-anomaly-shape.test.ts": [
+      1,
+      2
+    ],
     "audit-checkpoint-signature.test.ts": [
-      1
+      1,
+      2
     ],
     "audit-checkpoint-vectors.test.ts": [
       1,
       2
     ],
     "audit-log-integrity.test.ts": [
-      1
+      1,
+      2
     ],
     "auth-api-key-rotation.test.ts": [
       1
@@ -1281,6 +1287,9 @@
     "v2-advertised-path-space-served.test.ts": [
       2
     ],
+    "v2-approval-reject-disposition.test.ts": [
+      2
+    ],
     "v2-approver-enforced.test.ts": [
       2
     ],
@@ -1503,6 +1512,9 @@
     "v2-refresh-sla.test.ts": [
       2
     ],
+    "v2-registry-lifecycle.test.ts": [
+      2
+    ],
     "v2-relaxation-recorded.test.ts": [
       2
     ],