test(rulepack): build a labeled OAS 3.0/3.1 corpus

[back1ash]

Summary

Create a version-controlled benchmark corpus of at least 100 labeled operations drawn from suitably licensed public OpenAPI specifications and intentionally seeded cases. The corpus establishes expected findings, supports false-positive analysis, and provides a deterministic evaluation baseline.

Scope

• Include OAS 3.0.x and 3.1.x, YAML and JSON, and repository-local $ref usage.
• Combine public specifications with synthetic seeded cases.
• Give each operation a stable case ID and machine-readable expected findings, non-findings, risks, severity, rationale, provenance, location, and reviewer status.
• Cover positive, negative, boundary, ambiguous, and false-positive regression cases.
• Document maintenance, review, licensing, and contribution conventions.
• Keep fixtures self-contained and no-egress.

Acceptance criteria

• At least 100 distinct operations are labeled.
• Both supported OAS dialects and input formats are represented.
• Every public source records provenance and compatible reuse terms.
• All five P0 rule IDs and risk categories have positive and negative cases.
• Each operation has a stable ID, expected labels, rationale, and review status in a machine-readable manifest.
• Expected labels use normalized result-schema terminology and are order-independent.
• Fixtures require no network, code execution, credentials, or private data.
• Each expected finding records agreement from at least two reviewers.
• Documentation explains adding cases, changing labels, recording review, and tracking false-positive regressions.
• A coverage summary reports counts by dialect, source, rule, risk, and positive/negative class.

Dependencies

• P0 rule specifications.
• Risk-classifier contract.
• Normalized result schema v1 (design(core): define normalized result schema v1 #4).
• Validator decision for final compatibility; collection may begin earlier.

Non-goals

• Implementing the parser, rule engine, or CLI.
• Benchmarking validator performance.
• Covering OAS 2.0, OAS 3.2, P1 rules, or custom rule DSLs.
• Claiming that corpus results demonstrate runtime API safety.