@openwop/openwop-conformance 2.42.9 → 2.43.1

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 642,
-    "tests": 2466,
-    "withStableId": 2466,
+    "files": 646,
+    "tests": 2488,
+    "withStableId": 2488,
     "interpolatedTitles": 0,
-    "explicitIds": 2356
+    "explicitIds": 2370
   },
   "records": [
     {
@@ -1912,7 +1912,7 @@
     {
       "id": "openwop.it.agent-org-chart-scoping.serves-the-normative-org-chart-responsibility-roll-up-tree-shaped-and-tenant-sco",
       "file": "agent-org-chart-scoping.test.ts",
-      "line": 39,
+      "line": 60,
       "title": "serves the normative org-chart + responsibility roll-up, tree-shaped and tenant-scoped",
       "explicitId": "openwop.it.agent-org-chart-scoping.serves-the-normative-org-chart-responsibility-roll-up-tree-shaped-and-tenant-sco",
       "citations": [
@@ -1974,6 +1974,31 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.agent-org-chart-scoping.serves-the-org-chart-read-pair-in-the-exact-schema-shape",
+      "file": "agent-org-chart-scoping.test.ts",
+      "line": 193,
+      "title": "serves the org-chart read pair in the exact schema shape",
+      "explicitId": "openwop.it.agent-org-chart-scoping.serves-the-org-chart-read-pair-in-the-exact-schema-shape",
+      "citations": [
+        {
+          "section": "agent-org-chart.md §A / §E",
+          "requirement": "a host advertising agents.orgChart.supported MUST serve GET /v1/agents/org-chart with 200"
+        },
+        {
+          "section": "agent-org-chart.schema.json (RFC 0087 §A)",
+          "requirement": "the served GET /v1/agents/org-chart body MUST validate against agent-org-chart.schema.json (owner required; no extra keys)"
+        },
+        {
+          "section": "agent-org-chart.md §D / §E",
+          "requirement": "a host advertising agents.orgChart.responsibilityView MUST serve GET /v1/agents/org-chart/{departmentId} with 200 for a department in the caller's chart"
+        },
+        {
+          "section": "org-chart-responsibility-view.schema.json (RFC 0087 §D)",
+          "requirement": "the served GET /v1/agents/org-chart/{departmentId} body MUST validate against org-chart-responsibility-view.schema.json"
+        }
+      ]
+    },
     {
       "id": "openwop.it.agent-org-chart-shape.the-capabilities-schema-declares-agents-orgchart-with-its-sub-flags",
       "file": "agent-org-chart-shape.test.ts",
@@ -5425,15 +5450,72 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.audit-anomaly-shape.every-anomaly-kind-validates-in-its-own-shape",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 74,
+      "title": "every anomaly kind validates in its own shape",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.audit-anomaly-shape.an-anomaly-outside-its-kind-s-shape-is-refused",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 84,
+      "title": "an anomaly outside its kind's shape is refused",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.audit-anomaly-shape.chainvalid-is-false-exactly-when-anomalies-is-non-empty",
+      "file": "audit-anomaly-shape.test.ts",
+      "line": 92,
+      "title": "chainValid is false exactly when anomalies is non-empty",
+      "explicitId": "openwop.requirement.0218.anomaly-shape",
+      "citations": [
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0218 §C · spec/v1/auth-profiles.md §\"Audit-log integrity\" 4",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.audit-checkpoint-signature.every-checkpoint-get-v1-audit-verify-returns-verifies-under-the-advertised-key",
       "file": "audit-checkpoint-signature.test.ts",
-      "line": 30,
+      "line": 29,
       "title": "every checkpoint GET /v1/audit/verify returns verifies under the advertised key",
       "explicitId": "openwop.requirement.0218.checkpoint-signature-over-root",
       "citations": [
         {
-          "section": "RFC 0218 · spec/v1/auth-profiles.md §\"Audit-log integrity\" 3",
+          "section": "RFC 0218 · spec/v1/auth-profiles.md §\"Audit-log integrity\" 3; spec/v2/core/security-defaults.md §\"Audit-log integrity\" (RFC 0224)",
           "requirement": null,
           "interpolated": true
         }
@@ -5534,10 +5616,19 @@
     {
       "id": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "file": "audit-log-integrity.test.ts",
-      "line": 60,
+      "line": 80,
       "title": "host that claims the profile advertises required capability fields",
       "explicitId": "openwop.it.audit-log-integrity.host-that-claims-the-profile-advertises-required-capability-fields",
       "citations": [
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": "auditLogIntegrity.checkpointPublicKey MUST be an Ed25519 SubjectPublicKeyInfo, base64"
+        },
         {
           "section": "auth-profiles.md §\"Audit-log integrity\"",
           "requirement": "openwop-audit-log-integrity profile MUST advertise auditLogIntegrity.hashChain: true"
@@ -5551,13 +5642,14 @@
     {
       "id": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "file": "audit-log-integrity.test.ts",
-      "line": 83,
+      "line": 111,
       "title": "GET /v1/audit/verify on a recent range reports chainValid: true",
       "explicitId": "openwop.it.audit-log-integrity.get-v1-audit-verify-on-a-recent-range-reports-chainvalid-true",
       "citations": [
         {
           "section": "auth-profiles.md §\"Audit-log integrity\" §\"Verification endpoint\"",
-          "requirement": "claiming openwop-audit-log-integrity profile REQUIRES exposing GET /v1/audit/verify"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "audit-verify-result.schema.json",
@@ -5574,6 +5666,29 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.audit-log-integrity.verify-lists-every-checkpoint-ascending-no-more-than-checkpointintervalentries-a",
+      "file": "audit-log-integrity.test.ts",
+      "line": 163,
+      "title": "verify lists every checkpoint ascending, no more than checkpointIntervalEntries apart",
+      "explicitId": "openwop.requirement.0224.checkpoint-cadence",
+      "citations": [
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": "every checkpoint MUST carry an integer atSequence"
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "security-defaults.md §\"Audit-log integrity\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.auth-api-key-rotation.host-claiming-rotation-profile-advertises-required-fields",
       "file": "auth-api-key-rotation.test.ts",
@@ -6731,7 +6846,7 @@
     {
       "id": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "file": "byok-roundtrip.test.ts",
-      "line": 39,
+      "line": 51,
       "title": "the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex",
       "explicitId": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "citations": [
@@ -6756,7 +6871,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "file": "byok-roundtrip.test.ts",
-      "line": 104,
+      "line": 116,
       "title": "BYOK fixture run MUST emit a node.completed event for the resolve step",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "citations": [
@@ -6769,7 +6884,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "file": "byok-roundtrip.test.ts",
-      "line": 130,
+      "line": 143,
       "title": "BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "citations": [
@@ -27713,6 +27828,215 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-agent-org-chart-served-shape.serves-the-org-chart-read-pair-in-the-exact-v2-schema-shape",
+      "file": "v2-agent-org-chart-served-shape.test.ts",
+      "line": 30,
+      "title": "serves the org-chart read pair in the exact v2 schema shape",
+      "explicitId": "openwop.it.v2-agent-org-chart-served-shape.serves-the-org-chart-read-pair-in-the-exact-v2-schema-shape",
+      "citations": [
+        {
+          "section": "api/v2/openapi.yaml /agents/org-chart (RFC 0087 §D)",
+          "requirement": "a host advertising agents.orgChart MUST serve GET /agents/org-chart with 200"
+        },
+        {
+          "section": "schemas/v2/agent-org-chart.schema.json (RFC 0087 §A)",
+          "requirement": "the served GET /agents/org-chart body MUST validate against agent-org-chart.schema.json (owner required; no extra keys)"
+        },
+        {
+          "section": "api/v2/openapi.yaml /agents/org-chart/{departmentId} (RFC 0087 §D)",
+          "requirement": "a host advertising agents.orgChart.responsibilityView MUST serve GET /agents/org-chart/{departmentId} with 200 for a department in the caller's chart"
+        },
+        {
+          "section": "schemas/v2/org-chart-responsibility-view.schema.json (RFC 0087 §D)",
+          "requirement": "the served GET /agents/org-chart/{departmentId} body MUST validate against org-chart-responsibility-view.schema.json"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-with-no-routing-edge-fails-the-run-with-approval-rejected",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 126,
+      "title": "a rejected gate with no routing edge fails the run with approval_rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the terminal snapshot error.code MUST be approval_rejected",
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "run.failed.error.code MUST be approval_rejected"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.interrupt-resolved-records-action-reject-and-decision-rejected",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 137,
+      "title": "interrupt.resolved records action reject and decision rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "the reject MUST be recorded as interrupt.resolved",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "interrupt.resolved MUST carry action \"reject\" and decision \"rejected\"",
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.the-gate-node-fails-with-approval-rejected-not-retryable-and-run-failed-names-it",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 150,
+      "title": "the gate node fails with approval_rejected, not retryable, and run.failed names it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the gate that does not turn the rejection into an output MUST emit node.failed"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "node.failed.error MUST carry code approval_rejected and retryable false"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "run.failed.failedNodeId MUST name the gate"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-majority-reject-decides-the-quorum-gate-on-the-deciding-vote-and-fails-the-run",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 163,
+      "title": "a majority reject decides the quorum gate on the deciding vote and fails the run with approval_rejected",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "one reject of three under majority does not decide the gate: the run MUST stay waiting-approval"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "a vote that does not decide the gate MUST NOT emit interrupt.resolved"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the terminal snapshot error.code MUST be approval_rejected"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-routed-over-an-any-failed-edge-fails-as-a-node-its-all-success-s",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 186,
+      "title": "a rejected gate routed over an any_failed edge fails as a node, its all_success sibling never runs, and the run completes",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the routed gate still fails as a node: node.failed.error MUST carry approval_rejected and retryable false"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the any_failed edge admits the failed gate: on-reject MUST run to node.completed"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "a rejected gate MUST NOT satisfy an all_success edge: on-accept MUST NOT run"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.an-unresolved-gate-past-its-timeoutms-with-no-ontimeout-is-resolved-rejected-by",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 205,
+      "title": "an unresolved gate past its timeoutMs with no onTimeout is resolved rejected by the host and fails the run naming the gate",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the host MUST resolve the timed-out gate itself, recording action \"timeout\", decision \"rejected\" and reason \"timeout\""
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the timed-out gate MUST fail with approval_rejected"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "with no routing edge the run MUST terminate failed, run.failed carrying approval_rejected and failedNodeId naming the gate"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-gate-whose-ontimeout-is-approve-still-resolves-rejected-on-timeout-and-fails-t",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 224,
+      "title": "a gate whose onTimeout is approve still resolves rejected on timeout and fails the run: a timeout never grants",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "whatever onTimeout holds, the host MUST resolve the timed-out gate rejected (action \"timeout\", decision \"rejected\") — onTimeout \"approve\" is treated as reject"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": "the timed-out gate MUST fail with approval_rejected"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection (RFC 0223)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-approval-reject-disposition.a-rejected-gate-looped-back-to-itself-is-asked-again-under-a-new-key-and-the-fir",
+      "file": "v2-approval-reject-disposition.test.ts",
+      "line": 242,
+      "title": "a rejected gate looped back to itself is asked again under a new key, and the first rejection is not replayed",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interrupt.md §Re-entry and resume values",
+          "requirement": "the second visit of the gate MUST raise a new interrupt.requested"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Re-entry and resume values",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Re-entry and resume values",
+          "requirement": "the second visit MUST wait for a new decision: the run is waiting-approval again"
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Re-entry and resume values",
+          "requirement": "an earlier visit's resumeValue MUST NOT be returned: only the one caller resolve is recorded"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-approver-enforced.a-resolver-outside-approverslist-is-refused-at-resolve-time",
       "file": "v2-approver-enforced.test.ts",
@@ -29415,7 +29739,7 @@
     {
       "id": "openwop.it.v2-error-registry.an-error-response-is-the-closed-envelope-with-a-registered-code-at-its-registere",
       "file": "v2-error-registry.test.ts",
-      "line": 52,
+      "line": 72,
       "title": "an error response is the closed envelope with a registered code at its registered status",
       "explicitId": "openwop.requirement.0171.error-registry.envelope",
       "citations": [
@@ -29434,7 +29758,7 @@
     {
       "id": "openwop.it.v2-error-registry.retry-timing-is-never-spelled-inside-details",
       "file": "v2-error-registry.test.ts",
-      "line": 64,
+      "line": 84,
       "title": "retry timing is never spelled inside details",
       "explicitId": "openwop.requirement.0171.error-registry.no-retry-details",
       "citations": [
@@ -29447,7 +29771,7 @@
     {
       "id": "openwop.it.v2-error-registry.a-429-rate-limited-response-carries-retry-after",
       "file": "v2-error-registry.test.ts",
-      "line": 72,
+      "line": 92,
       "title": "a 429 rate_limited response carries Retry-After",
       "explicitId": "openwop.requirement.0171.error-registry.retry-after",
       "citations": [
@@ -29461,6 +29785,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-error-registry.an-error-code-on-run-failed-node-failed-and-the-snapshot-is-registered-or-a-vend",
+      "file": "v2-error-registry.test.ts",
+      "line": 110,
+      "title": "an error code on run.failed, node.failed and the snapshot is registered or a vendor code (advisory in 2.43.1)",
+      "explicitId": "openwop.requirement.errors.event-code-registered",
+      "citations": [
+        {
+          "section": "spec/v2/core/errors.md §The registry",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md §The registry",
+          "requirement": "every error code on run.failed, node.failed and the snapshot MUST be registered or a vendor code"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-event-type-closed.every-emitted-type-is-a-registered-protocol-type-or-a-vendor-type-under-an-adver",
       "file": "v2-event-type-closed.test.ts",
@@ -30415,7 +30757,7 @@
     {
       "id": "openwop.it.v2-manifest-ceiling-refused.an-engines-openwop-range-with-no-upper-bound-1-0-0-reads-2-0-0-and-is-refused-at",
       "file": "v2-manifest-ceiling-refused.test.ts",
-      "line": 105,
+      "line": 117,
       "title": "an engines.openwop range with no upper bound (>=1.0.0) reads <2.0.0 and is refused at install with pack_engine_unsupported",
       "explicitId": "openwop.requirement.0177.manifest-ceiling-refused.unbounded",
       "citations": [
@@ -30432,7 +30774,7 @@
     {
       "id": "openwop.it.v2-manifest-ceiling-refused.a-v1-ceiling-1-0-0-2-0-0-is-refused-at-install-with-pack-engine-unsupported",
       "file": "v2-manifest-ceiling-refused.test.ts",
-      "line": 114,
+      "line": 126,
       "title": "a v1 ceiling (>=1.0.0 <2.0.0) is refused at install with pack_engine_unsupported",
       "explicitId": "openwop.requirement.0177.manifest-ceiling-refused.v1-ceiling",
       "citations": [
@@ -30449,7 +30791,7 @@
     {
       "id": "openwop.it.v2-manifest-ceiling-refused.a-range-admitting-the-host-major-2-0-0-3-0-0-installs",
       "file": "v2-manifest-ceiling-refused.test.ts",
-      "line": 123,
+      "line": 135,
       "title": "a range admitting the host major (>=2.0.0 <3.0.0) installs",
       "explicitId": "openwop.requirement.0177.manifest-ceiling-refused.v2-installs",
       "citations": [
@@ -30463,7 +30805,7 @@
     {
       "id": "openwop.it.v2-manifest-hatch-carried.an-x-field-inside-agents-0-of-a-node-pack-is-ignored-not-rejected-the-pack-insta",
       "file": "v2-manifest-hatch-carried.test.ts",
-      "line": 85,
+      "line": 97,
       "title": "an x- field inside agents[0] of a node pack is ignored, not rejected — the pack installs",
       "explicitId": "openwop.requirement.0177.manifest-hatch-carried.agents-x-field",
       "citations": [
@@ -30477,7 +30819,7 @@
     {
       "id": "openwop.it.v2-manifest-hatch-carried.an-x-field-inside-a-prompt-template-of-a-prompt-pack-is-ignored-not-rejected-the",
       "file": "v2-manifest-hatch-carried.test.ts",
-      "line": 103,
+      "line": 119,
       "title": "an x- field inside a prompt template of a prompt pack is ignored, not rejected — the pack installs",
       "explicitId": "openwop.requirement.0177.manifest-hatch-carried.prompt-template-x-field",
       "citations": [
@@ -31899,7 +32241,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.sandbox-isolationmodel-names-a-real-mechanism-never-node-vm",
       "file": "v2-pack-isolation.test.ts",
-      "line": 78,
+      "line": 82,
       "title": "sandbox.isolationModel names a real mechanism, never node:vm",
       "explicitId": "openwop.requirement.0173.pack-isolation",
       "citations": [
@@ -31917,7 +32259,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.the-sandbox-invoke-seam-answers-the-seam-contract",
       "file": "v2-pack-isolation.test.ts",
-      "line": 92,
+      "line": 96,
       "title": "the sandbox-invoke seam answers the seam contract",
       "explicitId": "openwop.requirement.0173.pack-isolation.seam",
       "citations": [
@@ -31931,7 +32273,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-read-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 104,
+      "line": 108,
       "title": "node-pack-sandbox-fs-gated: a host filesystem read is refused",
       "explicitId": null,
       "citations": []
@@ -31939,7 +32281,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-fs-gated-a-host-filesystem-write-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 111,
+      "line": 115,
       "title": "node-pack-sandbox-fs-gated: a host filesystem write is refused",
       "explicitId": null,
       "citations": []
@@ -31947,7 +32289,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-env-the-host-environment-does-not-leak",
       "file": "v2-pack-isolation.test.ts",
-      "line": 118,
+      "line": 122,
       "title": "node-pack-sandbox-no-env: the host environment does not leak",
       "explicitId": null,
       "citations": []
@@ -31955,7 +32297,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-network-gated-ungated-network-egress-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 125,
+      "line": 129,
       "title": "node-pack-sandbox-network-gated: ungated network egress is refused",
       "explicitId": null,
       "citations": []
@@ -31963,7 +32305,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-no-process-host-process-access-is-refused",
       "file": "v2-pack-isolation.test.ts",
-      "line": 132,
+      "line": 136,
       "title": "node-pack-sandbox-no-process: host process access is refused",
       "explicitId": null,
       "citations": []
@@ -31971,7 +32313,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-timeout-exceeding-wallclocklimitms-fails-with-sandbox-timeout",
       "file": "v2-pack-isolation.test.ts",
-      "line": 139,
+      "line": 143,
       "title": "node-pack-sandbox-timeout: exceeding wallClockLimitMs fails with sandbox_timeout",
       "explicitId": "openwop.requirement.0173.pack-isolation.timeout",
       "citations": [
@@ -31984,7 +32326,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-memory-cap-exceeding-memorylimitbytes-fails-with-sandbox-memor",
       "file": "v2-pack-isolation.test.ts",
-      "line": 146,
+      "line": 150,
       "title": "node-pack-sandbox-memory-cap: exceeding memoryLimitBytes fails with sandbox_memory_exceeded",
       "explicitId": "openwop.requirement.0173.pack-isolation.memory-cap",
       "citations": [
@@ -31997,7 +32339,7 @@
     {
       "id": "openwop.it.v2-pack-isolation.node-pack-sandbox-isolated-context-a-pack-cannot-mutate-state-another-invocation",
       "file": "v2-pack-isolation.test.ts",
-      "line": 153,
+      "line": 157,
       "title": "node-pack-sandbox-isolated-context: a pack cannot mutate state another invocation sees",
       "explicitId": "openwop.requirement.0173.pack-isolation.isolated-context",
       "citations": [
@@ -32142,7 +32484,7 @@
     {
       "id": "openwop.it.v2-peer-dependency-declared.a-peerdependencies-key-the-declaration-file-does-not-name-is-refused-with-pack-p",
       "file": "v2-peer-dependency-declared.test.ts",
-      "line": 104,
+      "line": 116,
       "title": "a peerDependencies key the declaration file does not name is refused with pack_peer_dependency_undefined",
       "explicitId": "openwop.requirement.0177.peer-dependency-declared.undefined-key",
       "citations": [
@@ -32159,7 +32501,7 @@
     {
       "id": "openwop.it.v2-peer-dependency-declared.an-alias-table-row-host-fs-fs-resolves-through-the-overlap-and-the-pack-installs",
       "file": "v2-peer-dependency-declared.test.ts",
-      "line": 113,
+      "line": 125,
       "title": "an alias-table row (host.fs → fs) resolves through the overlap and the pack installs",
       "explicitId": "openwop.requirement.0177.peer-dependency-declared.alias-overlap",
       "citations": [
@@ -32594,6 +32936,56 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-registry-lifecycle.a-yanked-version-is-never-latest-while-an-unyanked-one-exists-the-flags-agree-ac",
+      "file": "v2-registry-lifecycle.test.ts",
+      "line": 130,
+      "title": "a yanked version is never latest while an unyanked one exists, the flags agree across index and manifest, and a yanked version stays served",
+      "explicitId": "openwop.requirement.0222.yanked-version-lifecycle",
+      "citations": [
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": "the per-pack index MUST NOT name a yanked version latest while an unyanked one exists, and the index MUST agree with each version manifest"
+        },
+        {
+          "section": "RFC 0222 · packs.md §\"Version manifests\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-registry-lifecycle.every-served-version-names-a-listed-key-whose-permittednamespaces-admit-it-and-i",
+      "file": "v2-registry-lifecycle.test.ts",
+      "line": 177,
+      "title": "every served version names a listed key whose permittedNamespaces admit it, and its signature verifies — whatever the key status",
+      "explicitId": "openwop.requirement.0222.signing-keys-cover-served-versions",
+      "citations": [
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": "every signingKeys[] entry MUST carry keyId, publicKeyUrl, status and permittedNamespaces"
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": "the v2 tree MUST serve at least one version manifest to witness"
+        },
+        {
+          "section": "RFC 0222 · packs.md §Signing",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-relaxation-recorded.a-bundle-recording-a-relaxation-cannot-certify-the-relaxed-profile",
       "file": "v2-relaxation-recorded.test.ts",
@@ -34206,7 +34598,7 @@
     {
       "id": "openwop.it.v2-webhook-secret-rotation.a-rotation-dual-signs-for-overlapseconds-keeps-openwop-signature-on-the-previous",
       "file": "v2-webhook-secret-rotation.test.ts",
-      "line": 67,
+      "line": 76,
       "title": "a rotation dual-signs for overlapSeconds, keeps OpenWOP-Signature on the previous secret, and is tenant-checked",
       "explicitId": "openwop.requirement.0201.secret-rotation",
       "citations": [
@@ -42161,7 +42553,7 @@
     {
       "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-it-was-generated-from-and-renders-every-code",
       "file": "v2-error-registry-prose-parity.test.ts",
-      "line": 26,
+      "line": 35,
       "title": "errors.md states the registry count it was generated from and renders every code",
       "explicitId": "openwop.requirement.0171.error-registry-prose-parity",
       "citations": [
@@ -42181,6 +42573,34 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-error-registry-prose-parity.approval-rejected-is-a-registered-422-not-retriable-and-interrupt-md-rejection-n",
+      "file": "v2-error-registry-prose-parity.test.ts",
+      "line": 67,
+      "title": "approval_rejected is a registered 422, not retriable, and interrupt.md §Rejection names it",
+      "explicitId": "openwop.requirement.0223.code-registered",
+      "citations": [
+        {
+          "section": "spec/v2/errors.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/errors.json",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/interrupt.md §Rejection",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "schemas/v2/suspend-request.schema.json ApprovalData.onTimeout",
+          "requirement": "onTimeout MUST exist and declare no default — absent means reject by prose (RFC 0223)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-event-naming-rule.every-closed-enum-v2-event-type-is-two-kebab-segments-and-every-recorded-artifac",
       "file": "v2-event-naming-rule.test.ts",
@@ -43029,9 +43449,86 @@
       ]
     },
     {
-      "id": "openwop.it.v2-surface-monotone-gate.an-open-object-closed-to-additionalproperties-false-is-refused-b-6",
+      "id": "openwop.it.v2-surface-monotone-gate.positive-control-a-required-under-a-then-selecting-only-enum-members-this-diff-a",
       "file": "v2-surface-monotone-gate.test.ts",
       "line": 156,
+      "title": "POSITIVE CONTROL — a `required` under a `then` selecting only enum members this diff adds is additive",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the gate must say it admitted the conditional, not pass it silently"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-required-under-a-then-an-existing-enum-value-selects-is-refused-b-6",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 171,
+      "title": "a `required` under a `then` an EXISTING enum value selects is REFUSED (§B.6)",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the property and the object"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-then-pinning-only-a-pre-existing-value-or-pinning-nothing-required-licenses-no",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 186,
+      "title": "a `then` pinning only a PRE-EXISTING value, or pinning nothing required, licenses nothing",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the property and the object"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.a-new-value-conditional-does-not-launder-an-unconditional-required-beside-it",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 204,
+      "title": "a new-value conditional does not launder an UNCONDITIONAL `required` beside it",
+      "explicitId": "openwop.requirement.0197.no-reshape",
+      "citations": [
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/overview.md §0a (RFC 0197 §A.1)",
+          "requirement": "the refusal must name the unconditional property"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-surface-monotone-gate.an-open-object-closed-to-additionalproperties-false-is-refused-b-6",
+      "file": "v2-surface-monotone-gate.test.ts",
+      "line": 218,
       "title": "an OPEN object closed to `additionalProperties: false` is REFUSED (§B.6)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [
@@ -43049,7 +43546,7 @@
     {
       "id": "openwop.it.v2-surface-monotone-gate.a-narrowed-type-is-refused-a-1-add-the-new-shape-beside-the-old-one",
       "file": "v2-surface-monotone-gate.test.ts",
-      "line": 163,
+      "line": 225,
       "title": "a narrowed `type` is REFUSED (§A.1 — add the new shape beside the old one)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [
@@ -43067,7 +43564,7 @@
     {
       "id": "openwop.it.v2-surface-monotone-gate.a-removed-operation-is-refused-a-path-manifest-row-is-a-surface-too",
       "file": "v2-surface-monotone-gate.test.ts",
-      "line": 170,
+      "line": 232,
       "title": "a removed OPERATION is REFUSED (a path-manifest row is a surface too)",
       "explicitId": "openwop.requirement.0197.no-reshape",
       "citations": [