@openwop/openwop-conformance 2.45.2 → 2.45.3

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 650,
-    "tests": 2496,
-    "withStableId": 2496,
+    "files": 662,
+    "tests": 2535,
+    "withStableId": 2535,
     "interpolatedTitles": 0,
-    "explicitIds": 2375
+    "explicitIds": 2411
   },
   "records": [
     {
@@ -6846,7 +6846,7 @@
     {
       "id": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "file": "byok-roundtrip.test.ts",
-      "line": 51,
+      "line": 67,
       "title": "the canary fixture run MUST resolve a host-provisioned secret and emit SHA-256 hex",
       "explicitId": "openwop.it.byok-roundtrip.the-canary-fixture-run-must-resolve-a-host-provisioned-secret-and-emit-sha-256-h",
       "citations": [
@@ -6871,7 +6871,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "file": "byok-roundtrip.test.ts",
-      "line": 116,
+      "line": 132,
       "title": "BYOK fixture run MUST emit a node.completed event for the resolve step",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-must-emit-a-node-completed-event-for-the-resolve-step",
       "citations": [
@@ -6884,7 +6884,7 @@
     {
       "id": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "file": "byok-roundtrip.test.ts",
-      "line": 143,
+      "line": 159,
       "title": "BYOK fixture run event log MUST NOT echo the resolved secret value (redaction)",
       "explicitId": "openwop.it.byok-roundtrip.byok-fixture-run-event-log-must-not-echo-the-resolved-secret-value-redaction",
       "citations": [
@@ -23601,7 +23601,7 @@
     {
       "id": "openwop.it.runner-ledger.a-floor-file-that-vitest-passed-but-that-recorded-nothing-is-unclassified-when-a",
       "file": "runner-ledger.test.ts",
-      "line": 141,
+      "line": 146,
       "title": "a floor file that vitest passed but that recorded NOTHING is unclassified when a ledger exists — silence is not a witness",
       "explicitId": "openwop.it.runner-ledger.a-floor-file-that-vitest-passed-but-that-recorded-nothing-is-unclassified-when-a",
       "citations": [
@@ -23614,7 +23614,7 @@
     {
       "id": "openwop.it.runner-ledger.a-vacuous-pass-executed-pass-with-assertioncount-0-on-a-claimed-floor-is-unclass",
       "file": "runner-ledger.test.ts",
-      "line": 153,
+      "line": 158,
       "title": "a VACUOUS pass (executed-pass with assertionCount 0) on a claimed floor is unclassified and REJECTS certification",
       "explicitId": "openwop.it.runner-ledger.a-vacuous-pass-executed-pass-with-assertioncount-0-on-a-claimed-floor-is-unclass",
       "citations": [
@@ -23627,7 +23627,7 @@
     {
       "id": "openwop.it.runner-ledger.a-skipped-file-with-no-ledger-entry-is-blocked-unclassified-and-it-never-reads-a",
       "file": "runner-ledger.test.ts",
-      "line": 162,
+      "line": 167,
       "title": "a skipped file with no ledger entry is blocked (unclassified) — and it never reads as skipped/inapplicable",
       "explicitId": "openwop.it.runner-ledger.a-skipped-file-with-no-ledger-entry-is-blocked-unclassified-and-it-never-reads-a",
       "citations": [
@@ -23640,7 +23640,7 @@
     {
       "id": "openwop.it.runner-ledger.a-recorded-inapplicable-skipped-is-certifiable-and-not-unclassified-a-recorded-e",
       "file": "runner-ledger.test.ts",
-      "line": 174,
+      "line": 179,
       "title": "a recorded inapplicable/skipped is certifiable and NOT unclassified; a recorded executed-fail blocks but is classified",
       "explicitId": "openwop.it.runner-ledger.a-recorded-inapplicable-skipped-is-certifiable-and-not-unclassified-a-recorded-e",
       "citations": [
@@ -23653,7 +23653,7 @@
     {
       "id": "openwop.it.runner-ledger.a-discoveryonly-profile-certifies-with-an-empty-floor-an-unknown-profile-does-no",
       "file": "runner-ledger.test.ts",
-      "line": 187,
+      "line": 192,
       "title": "a discoveryOnly profile certifies with an empty floor; an unknown profile does not",
       "explicitId": "openwop.it.runner-ledger.a-discoveryonly-profile-certifies-with-an-empty-floor-an-unknown-profile-does-no",
       "citations": [
@@ -23666,7 +23666,7 @@
     {
       "id": "openwop.it.runner-ledger.a-runtime-derived-profile-openwop-node-packs-is-held-only-when-every-floor-row-i",
       "file": "runner-ledger.test.ts",
-      "line": 194,
+      "line": 199,
       "title": "a RUNTIME-DERIVED profile (openwop-node-packs) is HELD only when every floor row is a witnessed pass; otherwise it is not held — not rejected, not blocked",
       "explicitId": "openwop.it.runner-ledger.a-runtime-derived-profile-openwop-node-packs-is-held-only-when-every-floor-row-i",
       "citations": [
@@ -23683,7 +23683,7 @@
     {
       "id": "openwop.it.runner-ledger.the-runner-s-a-resolution-of-a-silent-zero-assertion-file-blocked-marker-is-stil",
       "file": "runner-ledger.test.ts",
-      "line": 229,
+      "line": 234,
       "title": "the runner's §A resolution of a silent zero-assertion file (blocked + marker) is STILL unclassified for a claimed floor",
       "explicitId": "openwop.it.runner-ledger.the-runner-s-a-resolution-of-a-silent-zero-assertion-file-blocked-marker-is-stil",
       "citations": [
@@ -23696,7 +23696,7 @@
     {
       "id": "openwop.it.runner-ledger.with-no-ledger-at-all-every-skipped-file-is-blocked-and-the-runner-says-so-the-p",
       "file": "runner-ledger.test.ts",
-      "line": 242,
+      "line": 247,
       "title": "with no ledger at all, every skipped file is blocked and the runner says so (the pre-S6 honest reading)",
       "explicitId": "openwop.it.runner-ledger.with-no-ledger-at-all-every-skipped-file-is-blocked-and-the-runner-says-so-the-p",
       "citations": [
@@ -23709,7 +23709,7 @@
     {
       "id": "openwop.it.runner-ledger.notes-are-keyed-to-the-current-test-file-worst-first-when-mixed-and-read-back-wi",
       "file": "runner-ledger.test.ts",
-      "line": 252,
+      "line": 257,
       "title": "notes are keyed to the current test file, worst-first when mixed, and read back with joined reasons",
       "explicitId": "openwop.it.runner-ledger.notes-are-keyed-to-the-current-test-file-worst-first-when-mixed-and-read-back-wi",
       "citations": [
@@ -23722,7 +23722,7 @@
     {
       "id": "openwop.it.runner-ledger.files-that-finished-before-this-one-appear-in-the-ledger-file-with-an-assertion",
       "file": "runner-ledger.test.ts",
-      "line": 274,
+      "line": 279,
       "title": "files that finished before this one appear in the ledger file with an assertion count",
       "explicitId": "openwop.it.runner-ledger.files-that-finished-before-this-one-appear-in-the-ledger-file-with-an-assertion",
       "citations": [
@@ -24657,6 +24657,103 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.secrets-run-witness.a-run-supplied-secret-resolves-intact-matched-true-for-its-digest-false-for-anot",
+      "file": "secrets-run-witness.test.ts",
+      "line": 72,
+      "title": "a run-supplied secret resolves intact: matched true for its digest, false for another",
+      "explicitId": "openwop.requirement.secrets.run-witness-resolves",
+      "citations": [
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "the witness run with a matching digest MUST complete"
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "the witness run with a different digest MUST complete (a mismatch is an output, not a failure)"
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "witness MUST output matched: true when expectedSha256 is the digest of the supplied value"
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "witness MUST output matched: false when expectedSha256 is the digest of a different value"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.secrets-run-witness.a-run-supplied-secret-appears-on-no-readable-surface-in-any-encoding-or-as-its-d",
+      "file": "secrets-run-witness.test.ts",
+      "line": 88,
+      "title": "a run-supplied secret appears on no readable surface, in any encoding or as its digest",
+      "explicitId": "openwop.requirement.secrets.run-witness-redacted",
+      "citations": [
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.secrets-run-witness.a-run-ref-resolves-only-within-the-run-that-supplied-it-and-the-witness-refuses",
+      "file": "secrets-run-witness.test.ts",
+      "line": 99,
+      "title": "a run: ref resolves only within the run that supplied it, and the witness refuses any other ref",
+      "explicitId": "openwop.requirement.secrets.run-witness-scope-bound",
+      "citations": [
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "a branch fork taken before witness MUST NOT inherit runSecrets: witness fails credential_not_found"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.secrets-run-witness.the-idempotency-request-digest-excludes-runsecrets-a-retry-differing-only-there",
+      "file": "secrets-run-witness.test.ts",
+      "line": 131,
+      "title": "the idempotency request digest excludes runSecrets: a retry differing only there replays, and its value is discarded",
+      "explicitId": "openwop.requirement.secrets.run-secrets-outside-request-digest",
+      "citations": [
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "a host advertising runSecrets MUST accept a well-formed runSecrets on createRun"
+        },
+        {
+          "section": null,
+          "requirement": "a same-key retry differing only in runSecrets MUST NOT be 409 idempotency_key_mismatch — the request digest MUST NOT cover runSecrets",
+          "interpolated": true
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "the retry MUST be answered from cache with the original 201"
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": "the retry MUST name the original runId"
+        },
+        {
+          "section": "idempotency.md §Outcomes",
+          "requirement": "a response served from cache MUST carry OpenWOP-Idempotent-Replay: true"
+        },
+        {
+          "section": "capabilities.md §\"Run-supplied secrets\" (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.self-hosted-runner.capabilities-schema-json-declares-selfhostedrunner-supported-with-required-suppo",
       "file": "self-hosted-runner.test.ts",
@@ -26212,62 +26309,118 @@
       ]
     },
     {
-      "id": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation",
+      "id": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-a-repeated-delivery-is-effectively-once",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 55,
-      "title": "de-dups by dedupKey, retries to dead-letter, and links delivery→run causation",
-      "explicitId": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation",
+      "line": 149,
+      "title": "de-dups by dedupKey: a repeated delivery is effectively-once",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.dedup",
       "citations": [
         {
-          "section": "trigger-bridge.md §C-1",
-          "requirement": "a repeated dedupKey MUST be effectively-once — EXACTLY one delivered attempt (not zero, not two)"
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "run-event-payloads.schema.json#triggerDeliveryAttempted",
-          "requirement": "outcome MUST be delivered|retrying|dead-lettered"
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "trigger-bridge.md §C-2",
-          "requirement": "the exhaust scenario MUST be wired when the delivery seam is"
+          "section": "trigger-bridge.md §F.6",
+          "requirement": "a 202 MUST carry the started runId"
         },
         {
-          "section": "trigger-bridge.md §C-2",
-          "requirement": "an exhausted delivery MUST emit ≥1 trigger.delivery.attempted"
+          "section": "trigger-bridge.md §F.6 / §C-1",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "trigger-bridge.md §C-2",
-          "requirement": "an exhausted retry policy MUST terminate in a dead-lettered delivery"
+          "section": "trigger-bridge.md §F.6",
+          "requirement": "the dedup no-op MUST say outcome \"duplicate\""
         },
         {
-          "section": "trigger-bridge.md §B",
-          "requirement": "exhaustion MUST emit ≥1 trigger.subscription.state.changed"
+          "section": "trigger-bridge.md §F.4",
+          "requirement": "a dedup no-op MUST return the PRIOR runId"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.trigger-bridge-delivery.dead-letters-an-exhausted-or-refused-delivery-without-starting-a-run",
+      "file": "trigger-bridge-delivery.test.ts",
+      "line": 172,
+      "title": "dead-letters an exhausted or refused delivery without starting a run",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.dead-letter",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "trigger-bridge.md §B",
-          "requirement": "the subscription MUST transition to dead-lettered on exhaustion"
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "trigger-bridge.md §B",
-          "requirement": "toState MUST be in the four-state vocabulary"
+          "section": "trigger-bridge.md §F.2",
+          "requirement": "a required-verification failure MUST NOT start a run"
         },
         {
-          "section": "trigger-bridge.md §C",
-          "requirement": "a successful delivery MUST create a run"
+          "section": "trigger-bridge.md §F.6 (RFC 0230 §C.1)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6 (RFC 0230 §C.1)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.trigger-bridge-delivery.links-delivery-run-causation-on-run-started",
+      "file": "trigger-bridge-delivery.test.ts",
+      "line": 194,
+      "title": "links delivery→run causation on run.started",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.causation",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
         },
         {
-          "section": "trigger-bridge.md §C-1",
-          "requirement": "a successful delivery MUST emit a trigger.delivery.attempted{outcome:delivered}"
+          "section": "trigger-bridge.md §F.6",
+          "requirement": "a 202 MUST carry the started runId"
         },
         {
           "section": "trigger-bridge.md §C",
-          "requirement": "a delivered run MUST emit run.started"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "trigger-bridge.md §C / RFC 0040",
-          "requirement": "run.started.causationId MUST EQUAL the delivery id (the trigger.delivery.attempted{delivered} eventId) — resolvable via /ancestry"
+          "requirement": "run.started MUST carry the delivery id as causationId"
+        },
+        {
+          "section": "trigger-bridge.md §C / RFC 0040",
+          "requirement": "run.started.causationId MUST EQUAL the delivered attempt event id"
         }
       ]
     },
+    {
+      "id": "openwop.it.trigger-bridge-delivery.keeps-the-run-less-trigger-events-content-free",
+      "file": "trigger-bridge-delivery.test.ts",
+      "line": 222,
+      "title": "keeps the run-less trigger events content-free",
+      "explicitId": null,
+      "citations": []
+    },
     {
       "id": "openwop.it.trigger-bridge-shape.a-conforming-subscription-validates",
       "file": "trigger-bridge-shape.test.ts",
@@ -26576,6 +26729,67 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.trigger-refused-event-keeps-subscription.a-refused-event-dead-letters-only-its-delivery-the-subscription-stays-active-and",
+      "file": "trigger-refused-event-keeps-subscription.test.ts",
+      "line": 55,
+      "title": "a refused event dead-letters only its delivery; the subscription stays active and a verified event then delivers",
+      "explicitId": "openwop.requirement.trigger-bridge.refused-event-keeps-subscription",
+      "citations": [
+        {
+          "section": "host-sample-test-seams.md (trigger-bridge delivery seam)",
+          "requirement": "scenario \"refused\" MUST answer 200"
+        },
+        {
+          "section": "host-sample-test-seams.md (trigger-bridge delivery seam)",
+          "requirement": "scenario \"refused\" MUST return the subscriptionId it drove"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "an event failing a required verification MUST NOT start a run; its delivery is dead-lettered"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "the refused delivery MUST be recorded as trigger.delivery.attempted { outcome: \"dead-lettered\" }"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "an event failing a required verification MUST NOT be delivered"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "an event failing a required verification MUST NOT start a run"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "a refused event MUST NOT emit trigger.subscription.state.changed — one bad post must not disable the integration"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "a refused event MUST NOT change the subscription's state: it stays active"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "the normative subscription read MUST still show state active after a refused event"
+        },
+        {
+          "section": "host-sample-test-seams.md (trigger-bridge delivery seam)",
+          "requirement": "scenario \"deliver\" with the refused subscriptionId MUST answer 200"
+        },
+        {
+          "section": "host-sample-test-seams.md (trigger-bridge delivery seam)",
+          "requirement": "scenario \"deliver\" MUST deliver on the subscriptionId it was given"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "after a refused event, a verified event on the same subscription MUST start a run"
+        },
+        {
+          "section": "trigger-bridge.md §F.2 (corrected 2026-09-30)",
+          "requirement": "after a refused event, the next verified delivery on the subscription MUST be recorded delivered"
+        }
+      ]
+    },
     {
       "id": "openwop.it.trigger-stream-cdc-sources.the-canonical-stream-triggerevent-fixture-validates",
       "file": "trigger-stream-cdc-sources.test.ts",
@@ -29844,6 +30058,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-eval-mode-unadvertised-refused.post-runs-mode-eval-answers-422-capability-not-provided-and-creates-no-run",
+      "file": "v2-eval-mode-unadvertised-refused.test.ts",
+      "line": 32,
+      "title": "POST /runs {mode: \"eval\"} answers 422 capability_not_provided and creates no run",
+      "explicitId": "openwop.requirement.runs.eval-mode-unadvertised-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/runs.md §Refusals",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/runs.md §Refusals",
+          "requirement": "the 422 for an unadvertised eval mode MUST carry the registered code capability_not_provided"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-event-type-closed.every-emitted-type-is-a-registered-protocol-type-or-a-vendor-type-under-an-adver",
       "file": "v2-event-type-closed.test.ts",
@@ -30124,6 +30356,107 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-fs-sandbox-escape-refused.a-path-inside-the-sandbox-root-is-written-and-read-back",
+      "file": "v2-fs-sandbox-escape-refused.test.ts",
+      "line": 116,
+      "title": "a path inside the sandbox root is written and read back",
+      "explicitId": "openwop.requirement.storage.fs-inside-root-read",
+      "citations": [
+        {
+          "section": "spec/v2/core/storage.md §fs",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/storage.md §fs",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "the read MUST return the bytes written"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-fs-sandbox-escape-refused.an-absolute-path-outside-the-root-is-refused-forbidden-path-outside-sandbox",
+      "file": "v2-fs-sandbox-escape-refused.test.ts",
+      "line": 129,
+      "title": "an absolute path outside the root is refused forbidden, path-outside-sandbox",
+      "explicitId": "openwop.requirement.storage.fs-absolute-escape-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/storage.md §fs",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a sandbox escape is `forbidden`"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a sandbox escape carries details.reason: path-outside-sandbox"
+        },
+        {
+          "section": "spec/v2/core/errors.md §Host-service refusals",
+          "requirement": "a generic code MUST carry details.service, the family key"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-fs-sandbox-escape-refused.a-dot-dot-path-that-climbs-out-of-the-root-is-refused-forbidden-path-outside-san",
+      "file": "v2-fs-sandbox-escape-refused.test.ts",
+      "line": 140,
+      "title": "a dot-dot path that climbs out of the root is refused forbidden, path-outside-sandbox",
+      "explicitId": "openwop.requirement.storage.fs-dotdot-escape-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/storage.md §fs",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a sandbox escape is `forbidden`"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a sandbox escape carries details.reason: path-outside-sandbox"
+        },
+        {
+          "section": "spec/v2/core/errors.md §Host-service refusals",
+          "requirement": "a generic code MUST carry details.service, the family key"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-fs-sandbox-escape-refused.a-symlink-inside-the-root-that-points-outside-it-is-refused-forbidden-path-outsi",
+      "file": "v2-fs-sandbox-escape-refused.test.ts",
+      "line": 151,
+      "title": "a symlink inside the root that points outside it is refused forbidden, path-outside-sandbox",
+      "explicitId": "openwop.requirement.storage.fs-symlink-escape-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/storage.md §fs",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a sandbox escape is `forbidden`"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a sandbox escape carries details.reason: path-outside-sandbox"
+        },
+        {
+          "section": "spec/v2/core/errors.md §Host-service refusals",
+          "requirement": "a generic code MUST carry details.service, the family key"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-header-scheme.no-removed-header-family-appears-on-any-response",
       "file": "v2-header-scheme.test.ts",
@@ -31756,6 +32089,30 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-memory-cross-tenant-isolation.a-second-tenant-listing-the-same-memoryref-sees-none-of-the-first-tenant-s-entri",
+      "file": "v2-memory-cross-tenant-isolation.test.ts",
+      "line": 87,
+      "title": "a second tenant listing the same memoryRef sees none of the first tenant's entries",
+      "explicitId": "openwop.requirement.0004.memory-ref-one-tenant",
+      "citations": [
+        {
+          "section": "spec/v2/core/host-services.md §memory",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §memory",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §memory",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-min-client-version.a-client-below-minclientversion-is-refused-with-426-client-version-unsupported",
       "file": "v2-min-client-version.test.ts",
@@ -32938,6 +33295,45 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-queue-cross-tenant-isolation.a-message-tenant-a-publishes-on-topic-t-is-never-consumed-by-tenant-b-on-t-and-a",
+      "file": "v2-queue-cross-tenant-isolation.test.ts",
+      "line": 92,
+      "title": "a message tenant A publishes on topic T is never consumed by tenant B on T, and A's own consumer receives it",
+      "explicitId": "openwop.requirement.queueBus.cross-tenant-isolation",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": "the consume node MUST output `consumed` as an array ([] when nothing arrived), never leave it unset — an unset output would pass the isolation check vacuously",
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §queueBus",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-refresh-sla.refreshedat-on-each-embedded-protocol-facet-is-within-90-days-of-now",
       "file": "v2-refresh-sla.test.ts",
@@ -33716,6 +34112,210 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-safefetch-ssrf-refused.a-loopback-target-is-refused-egress-denied-ssrf-blocked-before-any-connection",
+      "file": "v2-safefetch-ssrf-refused.test.ts",
+      "line": 159,
+      "title": "a loopback target is refused egress_denied, ssrf-blocked, before any connection",
+      "explicitId": "openwop.requirement.httpClient.ssrf-loopback-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/host-services.md §httpClient",
+          "requirement": "the guard MUST refuse BEFORE connecting — these probe requests reached the suite's loopback listener"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-safefetch-ssrf-refused.an-rfc-1918-target-is-refused-egress-denied-ssrf-blocked",
+      "file": "v2-safefetch-ssrf-refused.test.ts",
+      "line": 166,
+      "title": "an RFC 1918 target is refused egress_denied, ssrf-blocked",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-safefetch-ssrf-refused.a-link-local-or-cloud-metadata-target-is-refused-egress-denied-ssrf-blocked",
+      "file": "v2-safefetch-ssrf-refused.test.ts",
+      "line": 172,
+      "title": "a link-local or cloud-metadata target is refused egress_denied, ssrf-blocked",
+      "explicitId": null,
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-safefetch-ssrf-refused.the-same-addresses-in-decimal-octal-short-and-ipv4-mapped-ipv6-spellings-are-ref",
+      "file": "v2-safefetch-ssrf-refused.test.ts",
+      "line": 178,
+      "title": "the same addresses in decimal, octal, short and IPv4-mapped IPv6 spellings are refused",
+      "explicitId": "openwop.requirement.httpClient.ssrf-address-spellings-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/host-services.md §httpClient",
+          "requirement": "the guard MUST refuse BEFORE connecting — these probe requests reached the suite's loopback listener"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-safefetch-ssrf-refused.a-name-that-resolves-to-loopback-is-refused-on-its-resolved-address",
+      "file": "v2-safefetch-ssrf-refused.test.ts",
+      "line": 192,
+      "title": "a name that resolves to loopback is refused on its resolved address",
+      "explicitId": "openwop.requirement.httpClient.ssrf-resolved-name-refused",
+      "citations": [
+        {
+          "section": "spec/v2/core/host-services.md §httpClient",
+          "requirement": "the host MUST resolve the target and reject a loopback address before connecting — the probe reached the suite's loopback listener"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-secret-canary-absent.a-secret-resolved-from-the-host-s-store-appears-on-no-readable-surface-of-the-ru",
+      "file": "v2-secret-canary-absent.test.ts",
+      "line": 168,
+      "title": "a secret resolved from the host's store appears on no readable surface of the run",
+      "explicitId": "openwop.requirement.secrets.resolved-secret-absent",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §openwop-smoke-byok-roundtrip",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §secrets",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-secret-canary-absent.a-secret-resolved-by-a-run-that-then-fails-appears-on-no-readable-surface-the-er",
+      "file": "v2-secret-canary-absent.test.ts",
+      "line": 178,
+      "title": "a secret resolved by a run that then fails appears on no readable surface, the error included",
+      "explicitId": "openwop.requirement.secrets.resolved-secret-absent-on-failure",
+      "citations": [
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §secrets",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-secret-canary-absent.a-replay-fork-re-resolves-the-secret-and-still-carries-it-on-no-readable-surface",
+      "file": "v2-secret-canary-absent.test.ts",
+      "line": 191,
+      "title": "a replay fork re-resolves the secret and still carries it on no readable surface",
+      "explicitId": "openwop.requirement.secrets.resolved-secret-absent-in-fork",
+      "citations": [
+        {
+          "section": "spec/v2/core/host-services.md §secrets",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-secrets-run-witness.a-run-supplied-secret-resolves-intact-matched-true-for-its-digest-false-for-anot",
+      "file": "v2-secrets-run-witness.test.ts",
+      "line": 85,
+      "title": "a run-supplied secret resolves intact: matched true for its digest, false for another",
+      "explicitId": "openwop.requirement.secrets.run-witness-resolves",
+      "citations": [
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "the witness run with a matching digest MUST complete"
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "the witness run with a different digest MUST complete (a mismatch is an output, not a failure)"
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "witness MUST output matched: true when expectedSha256 is the digest of the supplied value"
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "witness MUST output matched: false when expectedSha256 is the digest of a different value"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-secrets-run-witness.a-run-supplied-secret-appears-on-no-readable-surface-in-any-encoding-or-as-its-d",
+      "file": "v2-secrets-run-witness.test.ts",
+      "line": 101,
+      "title": "a run-supplied secret appears on no readable surface, in any encoding or as its digest",
+      "explicitId": "openwop.requirement.secrets.run-witness-redacted",
+      "citations": [
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-secrets-run-witness.a-run-ref-resolves-only-within-the-run-that-supplied-it-and-the-witness-refuses",
+      "file": "v2-secrets-run-witness.test.ts",
+      "line": 112,
+      "title": "a run: ref resolves only within the run that supplied it, and the witness refuses any other ref",
+      "explicitId": "openwop.requirement.secrets.run-witness-scope-bound",
+      "citations": [
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "a branch fork taken before witness MUST NOT inherit runSecrets: witness fails credential_not_found"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-secrets-run-witness.the-idempotency-request-digest-excludes-runsecrets-a-retry-differing-only-there",
+      "file": "v2-secrets-run-witness.test.ts",
+      "line": 144,
+      "title": "the idempotency request digest excludes runSecrets: a retry differing only there replays, and its value is discarded",
+      "explicitId": "openwop.requirement.secrets.run-secrets-outside-request-digest",
+      "citations": [
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "a host advertising runSecrets MUST accept a well-formed runSecrets on createRun"
+        },
+        {
+          "section": null,
+          "requirement": "a same-key retry differing only in runSecrets MUST NOT be 409 idempotency_key_mismatch — the request digest MUST NOT cover runSecrets",
+          "interpolated": true
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "the retry MUST be answered from cache with the original 201"
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": "the retry MUST name the original runId"
+        },
+        {
+          "section": "idempotency.md §Outcomes",
+          "requirement": "a response served from cache MUST carry OpenWOP-Idempotent-Replay: true"
+        },
+        {
+          "section": "host-services.md §Run-supplied secrets (RFC 0229)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-sse-last-event-id-cursor.a-last-event-id-past-the-log-is-an-exclusive-cursor-a-terminal-run-answers-200-w",
       "file": "v2-sse-last-event-id-cursor.test.ts",
@@ -33863,6 +34463,206 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.kvstorage-a-read-for-tenant-b-never-returns-what-tenant-a-wrote-under-the-same-k",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 150,
+      "title": "kvStorage: a read for tenant B never returns what tenant A wrote under the same key (get and list)",
+      "explicitId": "openwop.requirement.storage.cross-tenant-kv-storage",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own read MUST return the value it wrote (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's read MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a kvStorage get for tenant B MUST NOT return data tenant A wrote under an identical key"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a kvStorage list for tenant B MUST NOT return a key tenant A wrote"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.tablestorage-a-read-for-tenant-b-never-returns-what-tenant-a-wrote-in-the-same-t",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 158,
+      "title": "tableStorage: a read for tenant B never returns what tenant A wrote in the same table (get and query)",
+      "explicitId": "openwop.requirement.storage.cross-tenant-table-storage",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own read MUST return the value it wrote (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's read MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a tableStorage get or query for tenant B MUST NOT return a row tenant A wrote in the identically named table"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a tableStorage query for tenant B MUST NOT return a row tenant A wrote"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.blobstorage-a-read-for-tenant-b-never-returns-what-tenant-a-wrote-under-the-same",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 166,
+      "title": "blobStorage: a read for tenant B never returns what tenant A wrote under the same bucket and key",
+      "explicitId": "openwop.requirement.storage.cross-tenant-blob-storage",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own read MUST return the object it wrote (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's read MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a blobStorage get for tenant B MUST NOT return an object tenant A wrote under an identical bucket and key"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a blobStorage list for tenant B MUST NOT return a key tenant A wrote"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.cache-a-get-for-tenant-b-never-returns-what-tenant-a-put-under-the-same-key",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 174,
+      "title": "cache: a get for tenant B never returns what tenant A put under the same key",
+      "explicitId": "openwop.requirement.storage.cross-tenant-cache",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own read MUST return the value it put (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's read MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a cache get for tenant B MUST NOT return data tenant A wrote under an identical key"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a cache read for tenant B MUST NOT return a key tenant A wrote"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.vectorstore-a-query-for-tenant-b-never-matches-a-vector-tenant-a-upserted-in-the",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 182,
+      "title": "vectorStore: a query for tenant B never matches a vector tenant A upserted in the same collection",
+      "explicitId": "openwop.requirement.storage.cross-tenant-vector-store",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own query MUST return the vector it upserted (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's query MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a vectorStore query for tenant B MUST NOT return metadata tenant A wrote in the identically named collection"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a vectorStore query for tenant B MUST NOT return an id tenant A upserted"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.searchindex-a-query-for-tenant-b-never-hits-a-document-tenant-a-indexed-in-the-s",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 190,
+      "title": "searchIndex: a query for tenant B never hits a document tenant A indexed in the same index",
+      "explicitId": "openwop.requirement.storage.cross-tenant-search-index",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own query MUST return the document it indexed (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's query MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a searchIndex query for tenant B MUST NOT return fields tenant A indexed in the identically named index"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "a searchIndex query for tenant B MUST NOT return an id tenant A indexed"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.sql-tenant-b-reading-the-same-named-datasource-never-sees-a-row-tenant-a-inserte",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 198,
+      "title": "sql: tenant B reading the same-named datasource never sees a row tenant A inserted",
+      "explicitId": "openwop.requirement.storage.cross-tenant-sql",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own query MUST return the row it inserted (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's query MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "sql datasources are scoped per tenant: tenant B MUST NOT read a row tenant A inserted"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "sql datasources are scoped per tenant: tenant B MUST NOT see a key tenant A inserted"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-storage-cross-tenant-isolation.nosql-tenant-b-reading-the-same-named-datasource-never-sees-a-document-tenant-a",
+      "file": "v2-storage-cross-tenant-isolation.test.ts",
+      "line": 206,
+      "title": "nosql: tenant B reading the same-named datasource never sees a document tenant A inserted (get and query)",
+      "explicitId": "openwop.requirement.storage.cross-tenant-nosql",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §The storage probe fixtures",
+          "requirement": "tenant A's own query MUST return the document it inserted (positive control)"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "tenant B's read MUST complete or be refused with a storage refusal code"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "nosql datasources are scoped per tenant: tenant B MUST NOT read a document tenant A inserted, by query or by its id"
+        },
+        {
+          "section": "spec/v2/core/storage.md §Shared rules",
+          "requirement": "nosql datasources are scoped per tenant: tenant B MUST NOT see a key tenant A inserted"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-stream-mode-refusal.a-value-outside-the-pattern-a-forbidden-combination-and-an-unimplemented-mode-ar",
       "file": "v2-stream-mode-refusal.test.ts",
@@ -34071,6 +34871,114 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-tool-authorization-fail-closed.a-tool-whose-required-scope-the-principal-lacks-is-not-invoked-and-is-refused-fo",
+      "file": "v2-tool-authorization-fail-closed.test.ts",
+      "line": 158,
+      "title": "a tool whose required scope the principal lacks is not invoked and is refused forbidden",
+      "explicitId": "openwop.requirement.toolHooks.authorization-fail-closed-missing-scope",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §conformance-tool-scope-probe",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "conformance/fixtures.md §conformance-tool-scope-probe",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "a refused tool MUST NOT also return ok"
+        },
+        {
+          "section": "schemas/v2/run-event-payloads.schema.json#/$defs/agentToolReturned",
+          "requirement": "durationMs is absent when the call never started (forbidden)"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "the forbidden refusal MUST carry details.scope: \"tool\""
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "the forbidden refusal MUST carry details.toolName"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "the forbidden refusal MUST carry details.requiredScopes naming the tool's scopes"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-tool-authorization-fail-closed.a-tool-whose-required-scope-cannot-be-evaluated-is-not-invoked-and-is-refused-fo",
+      "file": "v2-tool-authorization-fail-closed.test.ts",
+      "line": 178,
+      "title": "a tool whose required scope cannot be evaluated is not invoked and is refused forbidden",
+      "explicitId": "openwop.requirement.toolHooks.authorization-fail-closed-unevaluable-scope",
+      "citations": [
+        {
+          "section": "conformance/fixtures.md §conformance-tool-scope-probe",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "conformance/fixtures.md §conformance-tool-scope-probe",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "a refused tool MUST NOT also return ok"
+        },
+        {
+          "section": "schemas/v2/run-event-payloads.schema.json#/$defs/agentToolReturned",
+          "requirement": "durationMs is absent when the call never started (forbidden)"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "the forbidden refusal MUST carry details.scope: \"tool\""
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "the forbidden refusal MUST carry details.toolName"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §toolHooks",
+          "requirement": "the forbidden refusal MUST carry details.requiredScopes naming the tool's scopes"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-tool-catalog-annotations.every-published-annotations-object-is-the-table-function-of-the-descriptor",
       "file": "v2-tool-catalog-annotations.test.ts",
@@ -35056,6 +35964,66 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-workspace-scope-from-identity.a-second-tenant-cannot-read-or-list-a-file-the-first-tenant-wrote",
+      "file": "v2-workspace-scope-from-identity.test.ts",
+      "line": 100,
+      "title": "a second tenant cannot read or list a file the first tenant wrote",
+      "explicitId": "openwop.requirement.0059.workspace-scope-from-identity",
+      "citations": [
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "positive control: the owning scope MUST read its own file (200)"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "positive control: the owner reads back the content it wrote"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "positive control: the owner's list names its own file"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "another scope's read MUST NOT disclose the file's content"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "another scope's list MUST NOT disclose the file"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-workspace-scope-from-identity.naming-the-first-tenant-s-scope-in-the-request-does-not-widen-the-second-tenant",
+      "file": "v2-workspace-scope-from-identity.test.ts",
+      "line": 122,
+      "title": "naming the first tenant's scope in the request does not widen the second tenant's scope",
+      "explicitId": "openwop.requirement.0059.workspace-scope-not-request-named",
+      "citations": [
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "positive control: the owning scope MUST read its own file (200)"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "a request naming another scope MUST NOT disclose that scope's file"
+        },
+        {
+          "section": "spec/v2/core/host-services.md §workspace",
+          "requirement": "a list naming another scope MUST NOT disclose that scope's file"
+        }
+      ]
+    },
     {
       "id": "openwop.it.vector-knn-roundtrip.capabilities-vectorstore-is-either-absent-or-a-well-formed-object",
       "file": "vector-knn-roundtrip.test.ts",