grasp-audit: show tests under GRASP-01 line

9 files changed, 531 insertions, 202 deletions

diff --git a/grasp-audit/src/result.rs b/grasp-audit/src/result.rs
index bc0008a..0de16ae 100644
--- a/grasp-audit/src/result.rs
+++ b/grasp-audit/src/result.rs
@@ -1,35 +1,56 @@
 //! Test result types
 
+use crate::specs::grasp01::{get_sections, GRASP_01_REQUIREMENTS, GRASP_COMMIT_ID};
 use std::collections::BTreeMap;
 use std::time::{Duration, Instant};
 
 // ANSI color codes
 const GREEN: &str = "\x1b[32m";
 const RED: &str = "\x1b[31m";
+const YELLOW: &str = "\x1b[33m";
+const BLUE: &str = "\x1b[34m";
+const CYAN: &str = "\x1b[36m";
 const RESET: &str = "\x1b[0m";
 const BOLD: &str = "\x1b[1m";
 
-/// Extract spec category from a spec_ref by removing trailing test number
-/// e.g., "GRASP-01:event-acceptance:1.1" -> "GRASP-01:event-acceptance"
-/// e.g., "NIP-01:basic:2" -> "NIP-01:basic"
-fn extract_spec_category(spec_ref: &str) -> String {
+/// Parse line number(s) from a spec_ref string
+/// Returns a vector of line numbers that this spec_ref covers
+///
+/// Examples:
+/// - "GRASP-01:nostr-relay:7" -> [7]
+/// - "GRASP-01:nostr-relay:7-9" -> [7, 8, 9]
+/// - "NIP-01:basic:2" -> []  (not a GRASP-01 ref)
+fn parse_spec_lines(spec_ref: &str) -> Vec<u32> {
+    // Only parse GRASP-01 refs
+    if !spec_ref.starts_with("GRASP-01:") {
+        return vec![];
+    }
+
+    // Get the last part after the last colon
     let parts: Vec<&str> = spec_ref.split(':').collect();
-    if parts.len() >= 2 {
-        // Check if the last part looks like a test number (starts with digit)
-        if let Some(last) = parts.last() {
-            if last
-                .chars()
-                .next()
-                .map(|c| c.is_ascii_digit())
-                .unwrap_or(false)
-            {
-                // Remove the trailing number part
-                return parts[..parts.len() - 1].join(":");
+    if parts.len() < 3 {
+        return vec![];
+    }
+
+    let line_part = parts.last().unwrap();
+
+    // Handle range format like "7-9"
+    if line_part.contains('-') {
+        let range_parts: Vec<&str> = line_part.split('-').collect();
+        if range_parts.len() == 2 {
+            if let (Ok(start), Ok(end)) = (range_parts[0].parse::<u32>(), range_parts[1].parse::<u32>()) {
+                return (start..=end).collect();
             }
         }
+        return vec![];
     }
-    // Return as-is if no trailing number found
-    spec_ref.to_string()
+
+    // Handle single line number
+    if let Ok(line) = line_part.parse::<u32>() {
+        return vec![line];
+    }
+
+    vec![]
 }
 
 /// Result of a single test
@@ -138,53 +159,100 @@ impl AuditResult {
         self.results.len()
     }
 
-    /// Print a detailed report with tests grouped by spec_ref
+    /// Print a detailed report aligned to GRASP-01 specification
     pub fn print_report(&self) {
-        println!("\n{}{}{}", BOLD, self.spec, RESET);
-        println!("{}", "═".repeat(60));
-
-        let passed = self.passed_count();
-        let total = self.total_count();
+        println!();
+        println!("{}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━{}", BOLD, RESET);
+        println!("{}GRASP-01 Compliance Report{}", BOLD, RESET);
+        println!("Source: github.com/nostr-protocol/grasp (commit: {})", GRASP_COMMIT_ID);
+        println!("{}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━{}", BOLD, RESET);
 
-        // Group results by spec category (strip trailing test number like ":1.1")
-        let mut grouped: BTreeMap<String, Vec<&TestResult>> = BTreeMap::new();
+        // Build a map of spec line -> tests that cover it
+        let mut tests_by_line: BTreeMap<u32, Vec<&TestResult>> = BTreeMap::new();
         for result in &self.results {
-            // Extract category from spec_ref (e.g., "GRASP-01:event-acceptance:1.1" -> "GRASP-01:event-acceptance")
-            let category = extract_spec_category(&result.spec_ref);
-            grouped.entry(category).or_default().push(result);
+            let lines = parse_spec_lines(&result.spec_ref);
+            for line in lines {
+                tests_by_line.entry(line).or_default().push(result);
+            }
         }
 
-        // Print grouped results
-        for (category, results) in &grouped {
-            println!("\n{}[{}]{}", BOLD, category, RESET);
-
-            for result in results {
-                let (color, status) = if result.passed {
-                    (GREEN, "✓")
+        // Track how many spec requirements have tests
+        let mut tested_requirements = 0;
+        let total_requirements = GRASP_01_REQUIREMENTS.len();
+
+        // Print results organized by section and spec line
+        for section in get_sections() {
+            println!();
+            println!("{}{}## {}{}", CYAN, BOLD, section, RESET);
+
+            for req in GRASP_01_REQUIREMENTS.iter().filter(|r| r.section == section) {
+                println!();
+                // Print spec requirement in blue
+                println!("{}📘 Line {}: {}{}", BLUE, req.line, req.text, RESET);
+
+                // Get tests for this line
+                if let Some(tests) = tests_by_line.get(&req.line) {
+                    tested_requirements += 1;
+                    for test in tests {
+                        let (color, status) = if test.passed {
+                            (GREEN, "✓")
+                        } else {
+                            (RED, "✗")
+                        };
+                        println!("  {}{} {}{}", color, status, test.name, RESET);
+
+                        if let Some(error) = &test.error {
+                            // Truncate long errors
+                            let error_display = if error.len() > 100 {
+                                format!("{}...", &error[..100])
+                            } else {
+                                error.clone()
+                            };
+                            println!("    {}Error: {}{}", RED, error_display, RESET);
+                        }
+                    }
                 } else {
-                    (RED, "✗")
-                };
-
-                println!("  {}{} {}{}", color, status, result.name, RESET);
-
-                if let Some(error) = &result.error {
-                    println!("    {}Error: {}{}", RED, error, RESET);
+                    println!("  {}⚠️  No Tests Implemented{}", YELLOW, RESET);
                 }
             }
         }
 
         println!();
-        let pass_rate = if total > 0 {
-            (passed as f64 / total as f64) * 100.0
+        println!("{}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━{}", BOLD, RESET);
+
+        // Summary statistics
+        let passed = self.passed_count();
+        let total_tests = self.total_count();
+
+        let spec_coverage = if total_requirements > 0 {
+            (tested_requirements as f64 / total_requirements as f64) * 100.0
+        } else {
+            0.0
+        };
+
+        let pass_rate = if total_tests > 0 {
+            (passed as f64 / total_tests as f64) * 100.0
         } else {
             0.0
         };
 
-        let summary_color = if passed == total { GREEN } else { RED };
+        let summary_color = if passed == total_tests && tested_requirements == total_requirements {
+            GREEN
+        } else if passed == total_tests {
+            YELLOW
+        } else {
+            RED
+        };
+
         println!(
-            "{}Results: {}/{} passed ({:.1}%){}",
-            summary_color, passed, total, pass_rate, RESET
+            "{}Spec coverage: {}/{} requirements tested ({:.1}%){}",
+            summary_color, tested_requirements, total_requirements, spec_coverage, RESET
         );
+        println!(
+            "{}Test results:  {}/{} tests passed ({:.1}%){}",
+            summary_color, passed, total_tests, pass_rate, RESET
+        );
+        println!("{}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━{}", BOLD, RESET);
         println!();
     }
 
@@ -235,4 +303,28 @@ mod tests {
         assert_eq!(audit.failed_count(), 1);
         assert!(!audit.all_passed());
     }
-}
+
+    #[test]
+    fn test_parse_spec_lines_single() {
+        assert_eq!(parse_spec_lines("GRASP-01:nostr-relay:7"), vec![7]);
+        assert_eq!(parse_spec_lines("GRASP-01:git-http:28"), vec![28]);
+    }
+
+    #[test]
+    fn test_parse_spec_lines_range() {
+        assert_eq!(parse_spec_lines("GRASP-01:nostr-relay:7-9"), vec![7, 8, 9]);
+        assert_eq!(parse_spec_lines("GRASP-01:cors:44-47"), vec![44, 45, 46, 47]);
+    }
+
+    #[test]
+    fn test_parse_spec_lines_non_grasp() {
+        assert_eq!(parse_spec_lines("NIP-01:basic:1"), Vec::<u32>::new());
+        assert_eq!(parse_spec_lines("OTHER:spec:5"), Vec::<u32>::new());
+    }
+
+    #[test]
+    fn test_parse_spec_lines_invalid() {
+        assert_eq!(parse_spec_lines("GRASP-01:invalid"), Vec::<u32>::new());
+        assert_eq!(parse_spec_lines("GRASP-01:test:abc"), Vec::<u32>::new());
+    }
+}
\ No newline at end of file
diff --git a/grasp-audit/src/specs/grasp01/event_acceptance_policy.rs b/grasp-audit/src/specs/grasp01/event_acceptance_policy.rs
index 1fc7f73..fee51db 100644
--- a/grasp-audit/src/specs/grasp01/event_acceptance_policy.rs
+++ b/grasp-audit/src/specs/grasp01/event_acceptance_policy.rs
@@ -138,7 +138,7 @@ impl EventAcceptancePolicyTests {
 
     /// Test: Accept valid repository announcements
     ///
-    /// Spec: Lines 3-5 of ../grasp/01.md
+    /// Spec: Line 7 of ../grasp/01.md
     /// Requirement: MUST accept repo announcements listing service in clone & relays tags
     ///
     /// **Using TestContext pattern:**
@@ -147,7 +147,7 @@ impl EventAcceptancePolicyTests {
     pub async fn test_accept_valid_repo_announcement(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_valid_repo_announcement",
-            "GRASP-01:nostr-relay:3-5",
+            "GRASP-01:nostr-relay:7",
             "Accept valid repository announcements with service in clone and relays tags",
         )
         .run(|| async {
@@ -245,14 +245,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test: Reject repo announcements not listing service in clone tag
     ///
-    /// Spec: Line 5 of ../grasp/01.md
+    /// Spec: Line 9 of ../grasp/01.md
     /// Requirement: MUST reject announcements not listing service (unless GRASP-05)
     pub async fn test_reject_repo_announcement_missing_clone_tag(
         client: &AuditClient,
     ) -> TestResult {
         TestResult::new(
             "reject_repo_announcement_missing_clone_tag",
-            "GRASP-01:nostr-relay:5",
+            "GRASP-01:nostr-relay:9",
             "Reject repository announcements without service in clone tag",
         )
         .run(|| async {
@@ -321,14 +321,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test: Reject repo announcements not listing service in relays tag
     ///
-    /// Spec: Line 5 of ../grasp/01.md
+    /// Spec: Line 9 of ../grasp/01.md
     /// Requirement: MUST reject announcements not listing service in relays
     pub async fn test_reject_repo_announcement_missing_relays_tag(
         client: &AuditClient,
     ) -> TestResult {
         TestResult::new(
             "reject_repo_announcement_missing_relays_tag",
-            "GRASP-01:nostr-relay:5",
+            "GRASP-01:nostr-relay:9",
             "Reject repository announcements without service in relays tag",
         )
         .run(|| async {
@@ -410,7 +410,7 @@ impl EventAcceptancePolicyTests {
 
     /// Test: Accept valid repository state announcements
     ///
-    /// Spec: Lines 6-7 of ../grasp/01.md
+    /// Spec: Line 7 of ../grasp/01.md
     /// Requirement: MUST accept repo state announcements with d, maintainers, and r tags
     ///
     /// **EXAMPLE: Using TestContext pattern for fixture management**
@@ -420,7 +420,7 @@ impl EventAcceptancePolicyTests {
     pub async fn test_accept_valid_repo_state_announcement(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_valid_repo_state_announcement",
-            "GRASP-01:nostr-relay:6-7",
+            "GRASP-01:nostr-relay:7",
             "Accept valid state announcements after repo announcement accepted",
         )
         .run(|| async {
@@ -526,12 +526,13 @@ impl EventAcceptancePolicyTests {
 
     /// Test 1.1: Issue referencing repo via `a` tag should be accepted
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **EXAMPLE: Using TestContext for prerequisite events**
     /// Demonstrates how TestContext simplifies test setup while supporting dual modes
     pub async fn test_accept_issue_via_a_tag(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_issue_via_a_tag",
-            "GRASP-01:event-acceptance:1.1",
+            "GRASP-01:nostr-relay:13",
             "Accept issue referencing repo via 'a' tag",
         )
         .run(|| async {
@@ -559,13 +560,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 1.2: NIP-22 comment with root `A` tag referencing repo should be accepted
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo for full isolation
     /// - In Production mode: Reuses cached repo to minimize events
     pub async fn test_accept_comment_via_capital_a_tag(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_comment_via_A_tag",
-            "GRASP-01:event-acceptance:1.2",
+            "GRASP-01:nostr-relay:13",
             "Accept NIP-22 comment with root 'A' tag referencing repo",
         )
         .run(|| async {
@@ -611,13 +613,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 1.3: Kind 1 text note quoting repo via `q` tag should be accepted
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo for full isolation
     /// - In Production mode: Reuses cached repo to minimize events
     pub async fn test_accept_kind1_via_q_tag(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_kind1_via_q_tag",
-            "GRASP-01:event-acceptance:1.3",
+            "GRASP-01:nostr-relay:13",
             "Accept kind 1 note quoting repo via 'q' tag",
         )
         .run(|| async {
@@ -660,13 +663,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 2.1: Issue quoting another accepted issue should be accepted (transitive)
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo+issue for full isolation
     /// - In Production mode: Reuses cached repo+issue to minimize events
     pub async fn test_accept_issue_quoting_issue_via_q(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_issue_quoting_issue_via_q",
-            "GRASP-01:event-acceptance:2.1",
+            "GRASP-01:nostr-relay:13",
             "Accept issue quoting accepted issue (transitive)",
         )
         .run(|| async {
@@ -705,13 +709,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 2.2: NIP-22 comment with root 'E' tag to accepted issue should be accepted
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo+issue for full isolation
     /// - In Production mode: Reuses cached repo+issue to minimize events
     pub async fn test_accept_comment_via_capital_e_tag(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_comment_via_E_tag",
-            "GRASP-01:event-acceptance:2.2",
+            "GRASP-01:nostr-relay:13",
             "Accept NIP-22 comment with root 'E' tag to accepted issue",
         )
         .run(|| async {
@@ -743,13 +748,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 2.3: Kind 1 note with 'e' tag reply to accepted kind 1 should be accepted
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo for full isolation
     /// - In Production mode: Reuses cached repo to minimize events
     pub async fn test_accept_kind1_via_e_tag(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_kind1_via_e_tag",
-            "GRASP-01:event-acceptance:2.3",
+            "GRASP-01:nostr-relay:13",
             "Accept kind 1 reply via 'e' tag to accepted kind 1",
         )
         .run(|| async {
@@ -798,13 +804,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 3.1: Kind 1 note should be accepted when referenced by an accepted issue (forward ref)
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo for full isolation
     /// - In Production mode: Reuses cached repo to minimize events
     pub async fn test_accept_kind1_referenced_in_issue(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_kind1_referenced_in_issue",
-            "GRASP-01:event-acceptance:3.1",
+            "GRASP-01:nostr-relay:13",
             "Accept kind 1 referenced in accepted issue (forward ref)",
         )
         .run(|| async {
@@ -889,13 +896,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 3.2: Comment should be accepted when referenced by another accepted comment (forward ref)
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo+issue for full isolation
     /// - In Production mode: Reuses cached repo+issue to minimize events
     pub async fn test_accept_comment_referenced_in_comment(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_comment_referenced_in_comment",
-            "GRASP-01:event-acceptance:3.2",
+            "GRASP-01:nostr-relay:13",
             "Accept comment referenced in another accepted comment (forward ref)",
         )
         .run(|| async {
@@ -949,13 +957,14 @@ impl EventAcceptancePolicyTests {
 
     /// Test 3.3: Kind 1 note should be accepted when referenced by another accepted kind 1 (forward ref)
     ///
+    /// Spec: Line 13 of ../grasp/01.md
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh repo for full isolation
     /// - In Production mode: Reuses cached repo to minimize events
     pub async fn test_accept_kind1_referenced_in_kind1(client: &AuditClient) -> TestResult {
         TestResult::new(
             "accept_kind1_referenced_in_kind1",
-            "GRASP-01:event-acceptance:3.3",
+            "GRASP-01:nostr-relay:13",
             "Accept kind 1 referenced in another accepted kind 1 (forward ref)",
         )
         .run(|| async {
@@ -1007,10 +1016,13 @@ impl EventAcceptancePolicyTests {
     // ============================================================
 
     /// Test 4.1: Issue referencing unaccepted repo should be rejected
+    ///
+    /// Spec: Line 18 of ../grasp/01.md
+    /// (Rejecting non-git-related events falls under MAY reject for curation)
     pub async fn test_reject_orphan_issue(client: &AuditClient) -> TestResult {
         TestResult::new(
             "reject_orphan_issue",
-            "GRASP-01:event-acceptance:4.1",
+            "GRASP-01:nostr-relay:18",
             "Reject issue referencing unaccepted repo",
         )
         .run(|| async {
@@ -1031,10 +1043,13 @@ impl EventAcceptancePolicyTests {
     }
 
     /// Test 4.2: Generic kind 1 note with no repo references should be rejected
+    ///
+    /// Spec: Line 18 of ../grasp/01.md
+    /// (Rejecting non-git-related events falls under MAY reject for curation)
     pub async fn test_reject_orphan_kind1(client: &AuditClient) -> TestResult {
         TestResult::new(
             "reject_orphan_kind1",
-            "GRASP-01:event-acceptance:4.2",
+            "GRASP-01:nostr-relay:18",
             "Reject kind 1 with no repo references",
         )
         .run(|| async {
@@ -1054,6 +1069,8 @@ impl EventAcceptancePolicyTests {
 
     /// Test 4.3: Comment quoting unaccepted repo should be rejected
     ///
+    /// Spec: Line 18 of ../grasp/01.md
+    /// (Rejecting non-git-related events falls under MAY reject for curation)
     /// **Using TestContext pattern:**
     /// - In CI mode: Creates fresh accepted repo for full isolation
     /// - In Production mode: Reuses cached accepted repo to minimize events
@@ -1061,7 +1078,7 @@ impl EventAcceptancePolicyTests {
     pub async fn test_reject_comment_quoting_other_repo(client: &AuditClient) -> TestResult {
         TestResult::new(
             "reject_comment_quoting_other_repo",
-            "GRASP-01:event-acceptance:4.3",
+            "GRASP-01:nostr-relay:18",
             "Reject comment quoting unaccepted repo",
         )
         .run(|| async {
diff --git a/grasp-audit/src/specs/grasp01/git_clone.rs b/grasp-audit/src/specs/grasp01/git_clone.rs
index 95338e4..3d81964 100644
--- a/grasp-audit/src/specs/grasp01/git_clone.rs
+++ b/grasp-audit/src/specs/grasp01/git_clone.rs
@@ -37,6 +37,7 @@ impl GitCloneTests {
 
     /// Test that a repository can be cloned via Git HTTP backend
     ///
+    /// Spec: Line 28 of ../grasp/01.md
     /// This test:
     /// 1. Creates a repository announcement
     /// 2. Waits for repository creation
@@ -52,7 +53,7 @@ impl GitCloneTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:28",
                     "Repository must be cloneable via Git HTTP backend",
                 )
                 .fail(format!("Failed to create repo fixture: {}", e))
@@ -85,7 +86,7 @@ impl GitCloneTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:28",
                     "Repository must be cloneable via Git HTTP backend",
                 )
                 .fail(format!("Failed to convert pubkey to npub: {}", e))
@@ -120,7 +121,7 @@ impl GitCloneTests {
                 cleanup();
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:28",
                     "Repository must be cloneable via Git HTTP backend",
                 )
                 .fail(format!("Failed to execute git clone: {}", e));
@@ -132,7 +133,7 @@ impl GitCloneTests {
             let stderr = String::from_utf8_lossy(&output.stderr);
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:28",
                 "Repository must be cloneable via Git HTTP backend",
             )
             .fail(format!("Git clone failed: {}", stderr));
@@ -143,7 +144,7 @@ impl GitCloneTests {
             cleanup();
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:28",
                 "Repository must be cloneable via Git HTTP backend",
             )
             .fail("Cloned repository missing .git directory");
@@ -152,7 +153,7 @@ impl GitCloneTests {
         cleanup();
         TestResult::new(
             test_name,
-            "GRASP-01",
+            "GRASP-01:git-http:28",
             "Repository must be cloneable via Git HTTP backend",
         )
         .pass()
@@ -160,6 +161,7 @@ impl GitCloneTests {
 
     /// Test clone URL format validation
     ///
+    /// Spec: Line 28 of ../grasp/01.md
     /// This test verifies:
     /// 1. URLs follow the pattern http://domain/npub/identifier.git
     /// 2. Invalid URLs are rejected properly
@@ -173,7 +175,7 @@ impl GitCloneTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:28",
                     "Clone URL must follow correct format",
                 )
                 .fail(format!("Failed to create repo fixture: {}", e))
@@ -201,7 +203,7 @@ impl GitCloneTests {
         if !valid_url.contains(&npub) {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:28",
                 "Clone URL must follow correct format",
             )
             .fail("URL missing npub");
@@ -210,7 +212,7 @@ impl GitCloneTests {
         if !valid_url.contains(&format!("{}.git", repo_id)) {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:28",
                 "Clone URL must follow correct format",
             )
             .fail("URL missing repository identifier");
@@ -239,7 +241,7 @@ impl GitCloneTests {
         if output.status.success() {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:28",
                 "Clone URL must follow correct format",
             )
             .fail("Invalid URL was accepted (should have been rejected)");
@@ -247,7 +249,7 @@ impl GitCloneTests {
 
         TestResult::new(
             test_name,
-            "GRASP-01",
+            "GRASP-01:git-http:28",
             "Clone URL must follow correct format",
         )
         .pass()
@@ -255,6 +257,7 @@ impl GitCloneTests {
 
     /// Test that SHA1 capabilities are advertised in git-upload-pack
     ///
+    /// Spec: Line 36 of ../grasp/01.md
     /// GRASP-01 requires:
     /// "MUST include `allow-reachable-sha1-in-want` and `allow-tip-sha1-in-want`
     /// in advertisement and serve available oids."
@@ -275,7 +278,7 @@ impl GitCloneTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:36",
                     "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
                 )
                 .fail(format!("Failed to create repo fixture: {}", e))
@@ -296,7 +299,7 @@ impl GitCloneTests {
             None => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:36",
                     "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
                 )
                 .fail("Repository announcement missing d tag")
@@ -308,7 +311,7 @@ impl GitCloneTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:36",
                     "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
                 )
                 .fail(format!("Failed to convert pubkey to npub: {}", e))
@@ -328,7 +331,7 @@ impl GitCloneTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:36",
                     "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
                 )
                 .fail(format!("HTTP request failed: {}", e))
@@ -338,7 +341,7 @@ impl GitCloneTests {
         if !response.status().is_success() {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:36",
                 "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
             )
             .fail(format!(
@@ -353,7 +356,7 @@ impl GitCloneTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:36",
                     "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
                 )
                 .fail(format!("Failed to read response body: {}", e))
@@ -367,7 +370,7 @@ impl GitCloneTests {
         if !has_allow_reachable {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:36",
                 "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
             )
             .fail("Missing capability: allow-reachable-sha1-in-want");
@@ -376,7 +379,7 @@ impl GitCloneTests {
         if !has_allow_tip {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:36",
                 "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
             )
             .fail("Missing capability: allow-tip-sha1-in-want");
@@ -384,7 +387,7 @@ impl GitCloneTests {
 
         TestResult::new(
             test_name,
-            "GRASP-01",
+            "GRASP-01:git-http:36",
             "MUST include allow-reachable-sha1-in-want and allow-tip-sha1-in-want in advertisement",
         )
         .pass()
diff --git a/grasp-audit/src/specs/grasp01/mod.rs b/grasp-audit/src/specs/grasp01/mod.rs
index e16a351..ba27fef 100644
--- a/grasp-audit/src/specs/grasp01/mod.rs
+++ b/grasp-audit/src/specs/grasp01/mod.rs
@@ -19,6 +19,7 @@ pub mod nip01_smoke;
 pub mod nip11_document;
 pub mod push_authorization;
 pub mod repository_creation;
+pub mod spec_requirements;
 
 pub use cors::CorsTests;
 pub use event_acceptance_policy::EventAcceptancePolicyTests;
@@ -27,3 +28,7 @@ pub use nip01_smoke::Nip01SmokeTests;
 pub use nip11_document::Nip11DocumentTests;
 pub use push_authorization::PushAuthorizationTests;
 pub use repository_creation::RepositoryCreationTests;
+pub use spec_requirements::{
+    get_requirement, get_requirements_for_section, get_sections, RequirementLevel,
+    SpecRequirement, GRASP_01_REQUIREMENTS, GRASP_COMMIT_ID,
+};
diff --git a/grasp-audit/src/specs/grasp01/nip01_smoke.rs b/grasp-audit/src/specs/grasp01/nip01_smoke.rs
index 5161da8..9a7d7d1 100644
--- a/grasp-audit/src/specs/grasp01/nip01_smoke.rs
+++ b/grasp-audit/src/specs/grasp01/nip01_smoke.rs
@@ -32,7 +32,7 @@ impl Nip01SmokeTests {
     pub async fn test_websocket_connection(client: &AuditClient) -> TestResult {
         TestResult::new(
             "websocket_connection",
-            "NIP-01",
+            "GRASP-01:nostr-relay:7",
             "Can establish WebSocket connection to /",
         )
         .run(|| async {
@@ -61,7 +61,7 @@ impl Nip01SmokeTests {
     pub async fn test_send_receive_event(client: &AuditClient) -> TestResult {
         TestResult::new(
             "send_receive_event",
-            "NIP-01",
+            "GRASP-01:nostr-relay:7",
             "Can send EVENT and receive OK response",
         )
         .run(|| async {
@@ -127,7 +127,7 @@ impl Nip01SmokeTests {
     pub async fn test_create_subscription(client: &AuditClient) -> TestResult {
         TestResult::new(
             "create_subscription",
-            "NIP-01",
+            "GRASP-01:nostr-relay:7",
             "Can create subscription with REQ and receive EOSE",
         )
         .run(|| async {
@@ -163,7 +163,7 @@ impl Nip01SmokeTests {
     /// Spec: NIP-01 CLOSE message
     /// Requirement: Relay MUST support CLOSE to end subscriptions
     pub async fn test_close_subscription(client: &AuditClient) -> TestResult {
-        TestResult::new("close_subscription", "NIP-01", "Can close subscriptions")
+        TestResult::new("close_subscription", "GRASP-01:nostr-relay:7", "Can close subscriptions")
             .run(|| async {
                 // For now, we just verify we can query events
                 // Full subscription management with CLOSE would require
@@ -189,7 +189,7 @@ impl Nip01SmokeTests {
     pub async fn test_reject_invalid_signature(client: &AuditClient) -> TestResult {
         TestResult::new(
             "reject_invalid_signature",
-            "NIP-01",
+            "GRASP-01:nostr-relay:7",
             "Rejects events with invalid signatures",
         )
         .run(|| async {
@@ -243,7 +243,7 @@ impl Nip01SmokeTests {
     pub async fn test_reject_invalid_event_id(client: &AuditClient) -> TestResult {
         TestResult::new(
             "reject_invalid_event_id",
-            "NIP-01",
+            "GRASP-01:nostr-relay:7",
             "Rejects events with invalid event IDs",
         )
         .run(|| async {
diff --git a/grasp-audit/src/specs/grasp01/nip11_document.rs b/grasp-audit/src/specs/grasp01/nip11_document.rs
index 51b147d..33599b1 100644
--- a/grasp-audit/src/specs/grasp01/nip11_document.rs
+++ b/grasp-audit/src/specs/grasp01/nip11_document.rs
@@ -32,12 +32,12 @@ impl Nip11DocumentTests {
 
     /// Test: Serve NIP-11 document
     ///
-    /// Spec: Line 11 of ../grasp/01.md
+    /// Spec: Line 20 of ../grasp/01.md
     /// Requirement: MUST serve NIP-11 document
     pub async fn test_nip11_document_exists(client: &AuditClient) -> TestResult {
         TestResult::new(
             "nip11_document_exists",
-            "GRASP-01:nostr-relay:11",
+            "GRASP-01:nostr-relay:20",
             "Serve NIP-11 relay information document",
         )
         .run(|| async {
@@ -91,12 +91,12 @@ impl Nip11DocumentTests {
 
     /// Test: NIP-11 includes supported_grasps field
     ///
-    /// Spec: Line 12 of ../grasp/01.md
+    /// Spec: Line 22 of ../grasp/01.md
     /// Requirement: MUST list supported GRASPs as string array
     pub async fn test_nip11_supported_grasps_field(client: &AuditClient) -> TestResult {
         TestResult::new(
             "nip11_supported_grasps_field",
-            "GRASP-01:nostr-relay:12",
+            "GRASP-01:nostr-relay:22",
             "NIP-11 document includes supported_grasps field with GRASP-01",
         )
         .run(|| async {
@@ -167,12 +167,12 @@ impl Nip11DocumentTests {
 
     /// Test: NIP-11 includes repo_acceptance_criteria field
     ///
-    /// Spec: Line 13 of ../grasp/01.md
+    /// Spec: Line 23 of ../grasp/01.md
     /// Requirement: MUST list repository acceptance criteria
     pub async fn test_nip11_repo_acceptance_criteria_field(client: &AuditClient) -> TestResult {
         TestResult::new(
             "nip11_repo_acceptance_criteria_field",
-            "GRASP-01:nostr-relay:13",
+            "GRASP-01:nostr-relay:23",
             "NIP-11 document includes repo_acceptance_criteria field",
         )
         .run(|| async {
@@ -222,12 +222,12 @@ impl Nip11DocumentTests {
 
     /// Test: NIP-11 curation field handling
     ///
-    /// Spec: Line 14 of ../grasp/01.md
+    /// Spec: Line 24 of ../grasp/01.md
     /// Requirement: MUST include curation if curated, omit otherwise
     pub async fn test_nip11_curation_field(client: &AuditClient) -> TestResult {
         TestResult::new(
             "nip11_curation_field",
-            "GRASP-01:nostr-relay:14",
+            "GRASP-01:nostr-relay:24",
             "NIP-11 curation field present if curated, absent otherwise",
         )
         .run(|| async {
diff --git a/grasp-audit/src/specs/grasp01/push_authorization.rs b/grasp-audit/src/specs/grasp01/push_authorization.rs
index af6247f..c06da0d 100644
--- a/grasp-audit/src/specs/grasp01/push_authorization.rs
+++ b/grasp-audit/src/specs/grasp01/push_authorization.rs
@@ -407,7 +407,7 @@ impl PushAuthorizationTests {
         let repo = match ctx.get_fixture(FixtureKind::ValidRepo).await {
             Ok(r) => r,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", "Push rejected without state event")
+                return TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected without state event")
                     .fail(format!("Failed to create repo: {}", e))
             }
         };
@@ -427,7 +427,7 @@ impl PushAuthorizationTests {
         let clone_path = match clone_repo(relay_domain, &npub, &repo_id) {
             Ok(p) => p,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", "Push rejected without state event")
+                return TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected without state event")
                     .fail(&e)
             }
         };
@@ -437,7 +437,7 @@ impl PushAuthorizationTests {
 
         if let Err(e) = create_commit(&clone_path, "Unauthorized commit") {
             cleanup();
-            return TestResult::new(test_name, "GRASP-01", "Push rejected without state event")
+            return TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected without state event")
                 .fail(&e);
         }
 
@@ -447,12 +447,12 @@ impl PushAuthorizationTests {
 
         match push_result {
             Ok(false) => {
-                TestResult::new(test_name, "GRASP-01", "Push rejected without state event").pass()
+                TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected without state event").pass()
             }
-            Ok(true) => TestResult::new(test_name, "GRASP-01", "Push rejected without state event")
+            Ok(true) => TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected without state event")
                 .fail("Push accepted but should be rejected"),
             Err(e) => {
-                TestResult::new(test_name, "GRASP-01", "Push rejected without state event").fail(&e)
+                TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected without state event").fail(&e)
             }
         }
     }
@@ -481,9 +481,9 @@ impl PushAuthorizationTests {
         // Generate → Send → Verify → DataPush
         match ctx.get_fixture(FixtureKind::OwnerStateDataPushed).await {
             Ok(_state_event) => {
-                TestResult::new(test_name, "GRASP-01", "Push authorized with matching state").pass()
+                TestResult::new(test_name, "GRASP-01:git-http:30", "Push authorized with matching state").pass()
             }
-            Err(e) => TestResult::new(test_name, "GRASP-01", "Push authorized with matching state")
+            Err(e) => TestResult::new(test_name, "GRASP-01:git-http:30", "Push authorized with matching state")
                 .fail(format!("{}", e)),
         }
     }
@@ -523,7 +523,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Push rejected when commit not in state event",
                 )
                 .fail(format!("Failed to create RepoState fixture: {}", e));
@@ -543,7 +543,7 @@ impl PushAuthorizationTests {
             None => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Push rejected when commit not in state event",
                 )
                 .fail("Missing repo_id in state event");
@@ -555,7 +555,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Push rejected when commit not in state event",
                 )
                 .fail(format!("Failed to convert pubkey to bech32: {}", e));
@@ -571,7 +571,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Push rejected when commit not in state event",
                 )
                 .fail(format!("Failed to clone repo: {}", e));
@@ -594,7 +594,7 @@ impl PushAuthorizationTests {
                 cleanup();
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Push rejected when commit not in state event",
                 )
                 .fail(format!("Failed to create/checkout main branch: {}", e));
@@ -603,7 +603,7 @@ impl PushAuthorizationTests {
                 cleanup();
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Push rejected when commit not in state event",
                 )
                 .fail(format!(
@@ -620,7 +620,7 @@ impl PushAuthorizationTests {
             cleanup();
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:30",
                 "Push rejected when commit not in state event",
             )
             .fail(format!("Failed to create wrong commit: {}", e));
@@ -634,10 +634,10 @@ impl PushAuthorizationTests {
         cleanup();
 
         match push_result {
-            Ok(false) => TestResult::new(test_name, "GRASP-01", "Push rejected when commit not in state event").pass(),
-            Ok(true) => TestResult::new(test_name, "GRASP-01", "Push rejected when commit not in state event")
+            Ok(false) => TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected when commit not in state event").pass(),
+            Ok(true) => TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected when commit not in state event")
                 .fail("Push accepted but should be rejected. The pushed commit is not in the state event."),
-            Err(e) => TestResult::new(test_name, "GRASP-01", "Push rejected when commit not in state event").fail(&e),
+            Err(e) => TestResult::new(test_name, "GRASP-01:git-http:30", "Push rejected when commit not in state event").fail(&e),
         }
     }
 
@@ -672,13 +672,13 @@ impl PushAuthorizationTests {
         {
             Ok(_maintainer_state_event) => TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:30",
                 "Push authorized by maintainer state event only (no announcement)",
             )
             .pass(),
             Err(e) => TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:30",
                 "Push authorized by maintainer state event only (no announcement)",
             )
             .fail(format!("{}", e)),
@@ -715,13 +715,13 @@ impl PushAuthorizationTests {
         {
             Ok(_recursive_maintainer_state_event) => TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:30",
                 "Push authorized by recursive maintainer state event",
             )
             .pass(),
             Err(e) => TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:30",
                 "Push authorized by recursive maintainer state event",
             )
             .fail(format!("{}", e)),
@@ -765,7 +765,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Non-maintainer state events ignored",
                 )
                 .fail(format!("Failed to get OwnerStateDataPushed fixture: {}", e));
@@ -783,7 +783,7 @@ impl PushAuthorizationTests {
             None => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Non-maintainer state events ignored",
                 )
                 .fail("Missing repo_id in state event");
@@ -795,7 +795,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Non-maintainer state events ignored",
                 )
                 .fail(format!("Failed to convert pubkey to bech32: {}", e));
@@ -810,7 +810,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Non-maintainer state events ignored",
                 )
                 .fail(format!("Failed to clone repo: {}", e));
@@ -832,7 +832,7 @@ impl PushAuthorizationTests {
                 cleanup();
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Non-maintainer state events ignored",
                 )
                 .fail(format!("Failed to create commit: {}", e));
@@ -858,7 +858,7 @@ impl PushAuthorizationTests {
                 cleanup();
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:30",
                     "Non-maintainer state events ignored",
                 )
                 .fail(format!("Failed to build rogue state event: {}", e));
@@ -868,7 +868,7 @@ impl PushAuthorizationTests {
         // Send the rogue state event using the raw client to bypass AuditClient's key check
         if let Err(e) = client.client().send_event(&rogue_state).await {
             cleanup();
-            return TestResult::new(test_name, "GRASP-01", "Non-maintainer state events ignored")
+            return TestResult::new(test_name, "GRASP-01:git-http:30", "Non-maintainer state events ignored")
                 .fail(format!("Failed to send rogue state event: {}", e));
         }
 
@@ -883,8 +883,8 @@ impl PushAuthorizationTests {
         cleanup();
 
         match push_result {
-            Ok(false) => TestResult::new(test_name, "GRASP-01", "Non-maintainer state events ignored").pass(),
-            Ok(true) => TestResult::new(test_name, "GRASP-01", "Non-maintainer state events ignored")
+            Ok(false) => TestResult::new(test_name, "GRASP-01:git-http:30", "Non-maintainer state events ignored").pass(),
+            Ok(true) => TestResult::new(test_name, "GRASP-01:git-http:30", "Non-maintainer state events ignored")
                 .fail(format!(
                     "Push accepted but should be rejected. A non-maintainer (pubkey: {}) published \
                     a state event announcing commit {}, but the push was accepted. The relay should \
@@ -893,7 +893,7 @@ impl PushAuthorizationTests {
                     new_commit,
                     client.public_key()
                 )),
-            Err(e) => TestResult::new(test_name, "GRASP-01", "Non-maintainer state events ignored").fail(&e),
+            Err(e) => TestResult::new(test_name, "GRASP-01:git-http:30", "Non-maintainer state events ignored").fail(&e),
         }
     }
 
@@ -924,7 +924,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:34",
                     "Push to refs/nostr/<invalid-event-id> rejected",
                 )
                 .fail(format!("Failed to create repo: {}", e));
@@ -950,7 +950,7 @@ impl PushAuthorizationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:34",
                     "Push to refs/nostr/<invalid-event-id> rejected",
                 )
                 .fail(&e);
@@ -965,7 +965,7 @@ impl PushAuthorizationTests {
             cleanup();
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:34",
                 "Push to refs/nostr/<invalid-event-id> rejected",
             )
             .fail(&e);
@@ -984,13 +984,13 @@ impl PushAuthorizationTests {
         match push_result {
             Ok(false) => TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:34",
                 "Push to refs/nostr/<invalid-event-id> rejected",
             )
             .pass(),
             Ok(true) => TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:34",
                 "Push to refs/nostr/<invalid-event-id> rejected",
             )
             .fail(format!(
@@ -1001,7 +1001,7 @@ impl PushAuthorizationTests {
             )),
             Err(e) => TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:34",
                 "Push to refs/nostr/<invalid-event-id> rejected",
             )
             .fail(format!("Push error: {}", e)),
@@ -1035,8 +1035,8 @@ impl PushAuthorizationTests {
             .get_fixture(FixtureKind::PRWrongCommitPushedBeforeEvent)
             .await
         {
-            Ok(_pr_event) => TestResult::new(test_name, "GRASP-01", desc).pass(),
-            Err(e) => TestResult::new(test_name, "GRASP-01", desc).fail(format!("{}", e)),
+            Ok(_pr_event) => TestResult::new(test_name, "GRASP-01:git-http:34", desc).pass(),
+            Err(e) => TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!("{}", e)),
         }
     }
 
@@ -1062,7 +1062,7 @@ impl PushAuthorizationTests {
         {
             Ok(e) => e,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!("{}", e));
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!("{}", e));
             }
         };
 
@@ -1072,7 +1072,7 @@ impl PushAuthorizationTests {
         let repo = match ctx.get_fixture(FixtureKind::ValidRepo).await {
             Ok(r) => r,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!("{}", e));
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!("{}", e));
             }
         };
 
@@ -1087,7 +1087,7 @@ impl PushAuthorizationTests {
         let owner_npub = match repo.pubkey.to_bech32() {
             Ok(n) => n,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc)
                     .fail(format!("Failed to get owner npub: {}", e));
             }
         };
@@ -1096,7 +1096,7 @@ impl PushAuthorizationTests {
         let clone_path = match clone_repo(relay_domain, &owner_npub, &repo_id) {
             Ok(p) => p,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
             }
         };
 
@@ -1106,7 +1106,7 @@ impl PushAuthorizationTests {
             Ok(exists) => exists,
             Err(e) => {
                 let _ = fs::remove_dir_all(&clone_path);
-                return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
             }
         };
 
@@ -1114,13 +1114,13 @@ impl PushAuthorizationTests {
 
         // Ref should be deleted since the pushed commit doesn't match the PR event's `c` tag
         if refs_exist {
-            TestResult::new(test_name, "GRASP-01", desc).fail(format!(
+            TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!(
                 "Expected refs/nostr/{} to be deleted when PR event published with non-matching commit, \
                  but the ref still exists. The relay should delete refs that don't match the event's `c` tag.",
                 pr_event_id
             ))
         } else {
-            TestResult::new(test_name, "GRASP-01", desc).pass()
+            TestResult::new(test_name, "GRASP-01:git-http:34", desc).pass()
         }
     }
 
@@ -1146,7 +1146,7 @@ impl PushAuthorizationTests {
         {
             Ok(e) => e,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!("{}", e));
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!("{}", e));
             }
         };
 
@@ -1156,7 +1156,7 @@ impl PushAuthorizationTests {
         let repo = match ctx.get_fixture(FixtureKind::ValidRepo).await {
             Ok(r) => r,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!("{}", e));
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!("{}", e));
             }
         };
 
@@ -1171,7 +1171,7 @@ impl PushAuthorizationTests {
         let owner_npub = match repo.pubkey.to_bech32() {
             Ok(n) => n,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc)
                     .fail(format!("Failed to get owner npub: {}", e));
             }
         };
@@ -1180,7 +1180,7 @@ impl PushAuthorizationTests {
         let clone_path = match clone_repo(relay_domain, &owner_npub, &repo_id) {
             Ok(p) => p,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
             }
         };
 
@@ -1188,7 +1188,7 @@ impl PushAuthorizationTests {
         if let Err(e) = create_deterministic_commit_with_variant(&clone_path, CommitVariant::Owner)
         {
             let _ = fs::remove_dir_all(&clone_path);
-            return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+            return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
         }
 
         // Try to push with wrong commit (should be rejected since PR event exists)
@@ -1196,7 +1196,7 @@ impl PushAuthorizationTests {
             Ok(success) => success,
             Err(e) => {
                 let _ = fs::remove_dir_all(&clone_path);
-                return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
             }
         };
 
@@ -1204,11 +1204,11 @@ impl PushAuthorizationTests {
 
         // Should REJECT - PR event exists with different commit hash
         if push_succeeded {
-            return TestResult::new(test_name, "GRASP-01", desc)
+            return TestResult::new(test_name, "GRASP-01:git-http:34", desc)
                 .fail("Push accepted (expected rejection due to commit hash mismatch)");
         }
 
-        TestResult::new(test_name, "GRASP-01", desc).pass()
+        TestResult::new(test_name, "GRASP-01:git-http:34", desc).pass()
     }
 
     /// Test 4: Push correct commit to refs/nostr/<pr-event-id> AFTER PR event exists
@@ -1233,7 +1233,7 @@ impl PushAuthorizationTests {
         {
             Ok(e) => e,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!("{}", e));
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!("{}", e));
             }
         };
 
@@ -1243,7 +1243,7 @@ impl PushAuthorizationTests {
         let repo = match ctx.get_fixture(FixtureKind::ValidRepo).await {
             Ok(r) => r,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!("{}", e));
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(format!("{}", e));
             }
         };
 
@@ -1258,7 +1258,7 @@ impl PushAuthorizationTests {
         let owner_npub = match repo.pubkey.to_bech32() {
             Ok(n) => n,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc)
                     .fail(format!("Failed to get owner npub: {}", e));
             }
         };
@@ -1267,14 +1267,14 @@ impl PushAuthorizationTests {
         let clone_path = match clone_repo(relay_domain, &owner_npub, &repo_id) {
             Ok(p) => p,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
             }
         };
 
         // Create the CORRECT PR test commit (the one expected by PR event)
         if let Err(e) = reset_to_correct_pr_commit(&clone_path) {
             let _ = fs::remove_dir_all(&clone_path);
-            return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+            return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
         }
 
         // Push correct commit (should succeed)
@@ -1282,7 +1282,7 @@ impl PushAuthorizationTests {
             Ok(success) => success,
             Err(e) => {
                 let _ = fs::remove_dir_all(&clone_path);
-                return TestResult::new(test_name, "GRASP-01", desc).fail(&e);
+                return TestResult::new(test_name, "GRASP-01:git-http:34", desc).fail(&e);
             }
         };
 
@@ -1290,11 +1290,11 @@ impl PushAuthorizationTests {
 
         // Should ACCEPT - commit matches PR event's c tag
         if !push_succeeded {
-            return TestResult::new(test_name, "GRASP-01", desc)
+            return TestResult::new(test_name, "GRASP-01:git-http:34", desc)
                 .fail("Push rejected (expected acceptance since commit matches PR event)");
         }
 
-        TestResult::new(test_name, "GRASP-01", desc).pass()
+        TestResult::new(test_name, "GRASP-01:git-http:34", desc).pass()
     }
 
     /// Test that HEAD is set after a state event is published with an existing commit
@@ -1331,7 +1331,7 @@ impl PushAuthorizationTests {
         {
             Ok(e) => e,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!(
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc).fail(format!(
                     "Failed to create HeadSetToDevelopBranch fixture: {}",
                     e
                 ));
@@ -1344,7 +1344,7 @@ impl PushAuthorizationTests {
         let valid_repo = match ctx.get_fixture(FixtureKind::ValidRepo).await {
             Ok(e) => e,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to get ValidRepo fixture: {}", e));
             }
         };
@@ -1357,7 +1357,7 @@ impl PushAuthorizationTests {
         {
             Some(id) => id.to_string(),
             None => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail("Missing repo_id in ValidRepo");
             }
         };
@@ -1365,7 +1365,7 @@ impl PushAuthorizationTests {
         let npub = match valid_repo.pubkey.to_bech32() {
             Ok(n) => n,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to convert pubkey to bech32: {}", e));
             }
         };
@@ -1377,16 +1377,16 @@ impl PushAuthorizationTests {
             match get_default_branch_from_info_refs(relay_domain, &npub, &repo_id).await {
                 Ok(branch) => branch,
                 Err(e) => {
-                    return TestResult::new(test_name, "GRASP-01", desc)
+                    return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                         .fail(format!("Failed to get default branch: {}", e));
                 }
             };
 
         // Verify HEAD points to refs/heads/develop
         if default_branch == "refs/heads/develop" {
-            TestResult::new(test_name, "GRASP-01", desc).pass()
+            TestResult::new(test_name, "GRASP-01:git-http:32", desc).pass()
         } else {
-            TestResult::new(test_name, "GRASP-01", desc).fail(format!(
+            TestResult::new(test_name, "GRASP-01:git-http:32", desc).fail(format!(
                 "Expected HEAD to point to 'refs/heads/develop' but got '{}'. \
                 GRASP-01 requires: 'MUST set repository HEAD per repository state announcement \
                 as soon as the git data related to that branch has been received.'",
@@ -1435,7 +1435,7 @@ impl PushAuthorizationTests {
         let _develop_state = match ctx.get_fixture(FixtureKind::HeadSetToDevelopBranch).await {
             Ok(e) => e,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc).fail(format!(
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc).fail(format!(
                     "Failed to create HeadSetToDevelopBranch fixture: {}",
                     e
                 ));
@@ -1448,7 +1448,7 @@ impl PushAuthorizationTests {
         let valid_repo = match ctx.get_fixture(FixtureKind::ValidRepo).await {
             Ok(e) => e,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to get ValidRepo fixture: {}", e));
             }
         };
@@ -1461,7 +1461,7 @@ impl PushAuthorizationTests {
         {
             Some(id) => id.to_string(),
             None => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail("Missing repo_id in ValidRepo");
             }
         };
@@ -1469,7 +1469,7 @@ impl PushAuthorizationTests {
         let npub = match valid_repo.pubkey.to_bech32() {
             Ok(n) => n,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to convert pubkey to bech32: {}", e));
             }
         };
@@ -1480,7 +1480,7 @@ impl PushAuthorizationTests {
         let clone_path = match clone_repo(relay_domain, &npub, &repo_id) {
             Ok(path) => path,
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to clone repo: {}", e));
             }
         };
@@ -1495,7 +1495,7 @@ impl PushAuthorizationTests {
 
         if let Err(e) = output {
             let _ = fs::remove_dir_all(&clone_path);
-            return TestResult::new(test_name, "GRASP-01", desc)
+            return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                 .fail(format!("Failed to create develop1 branch: {}", e));
         }
 
@@ -1504,7 +1504,7 @@ impl PushAuthorizationTests {
             Ok(hash) => hash,
             Err(e) => {
                 let _ = fs::remove_dir_all(&clone_path);
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to create commit: {}", e));
             }
         };
@@ -1529,7 +1529,7 @@ impl PushAuthorizationTests {
             Ok(e) => e,
             Err(e) => {
                 let _ = fs::remove_dir_all(&clone_path);
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to build state event: {}", e));
             }
         };
@@ -1537,7 +1537,7 @@ impl PushAuthorizationTests {
         // Send the state event (commit doesn't exist on relay yet)
         if let Err(e) = client.send_event(state_event).await {
             let _ = fs::remove_dir_all(&clone_path);
-            return TestResult::new(test_name, "GRASP-01", desc)
+            return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                 .fail(format!("Failed to send state event: {}", e));
         }
 
@@ -1550,11 +1550,11 @@ impl PushAuthorizationTests {
         match push_result {
             Ok(true) => { /* Push succeeded, continue to verify */ }
             Ok(false) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail("Push to refs/heads/develop1 was rejected");
             }
             Err(e) => {
-                return TestResult::new(test_name, "GRASP-01", desc)
+                return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                     .fail(format!("Failed to push develop1 branch: {}", e));
             }
         }
@@ -1567,16 +1567,16 @@ impl PushAuthorizationTests {
             match get_default_branch_from_info_refs(relay_domain, &npub, &repo_id).await {
                 Ok(branch) => branch,
                 Err(e) => {
-                    return TestResult::new(test_name, "GRASP-01", desc)
+                    return TestResult::new(test_name, "GRASP-01:git-http:32", desc)
                         .fail(format!("Failed to get default branch: {}", e));
                 }
             };
 
         // Verify HEAD points to refs/heads/develop1
         if default_branch == "refs/heads/develop1" {
-            TestResult::new(test_name, "GRASP-01", desc).pass()
+            TestResult::new(test_name, "GRASP-01:git-http:32", desc).pass()
         } else {
-            TestResult::new(test_name, "GRASP-01", desc).fail(format!(
+            TestResult::new(test_name, "GRASP-01:git-http:32", desc).fail(format!(
                 "Expected HEAD to point to 'refs/heads/develop1' but got '{}'. \
                 GRASP-01 requires: 'MUST set repository HEAD per repository state announcement \
                 as soon as the git data related to that branch has been received.'",
diff --git a/grasp-audit/src/specs/grasp01/repository_creation.rs b/grasp-audit/src/specs/grasp01/repository_creation.rs
index 1014aa3..a99b0d2 100644
--- a/grasp-audit/src/specs/grasp01/repository_creation.rs
+++ b/grasp-audit/src/specs/grasp01/repository_creation.rs
@@ -36,6 +36,7 @@ impl RepositoryCreationTests {
     /// Test that a bare repository is created when a valid announcement is accepted
     /// and is accessible via Smart HTTP service
     ///
+    /// Spec: Line 28 of ../grasp/01.md
     /// This test verifies:
     /// 1. Sends a valid repository announcement via TestContext
     /// 2. Verifies the announcement was accepted
@@ -54,7 +55,7 @@ impl RepositoryCreationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:28",
                     "Bare repository must be created and accessible via Smart HTTP when announcement is accepted",
                 )
                 .fail(format!("Failed to create repo fixture: {}", e))
@@ -75,7 +76,7 @@ impl RepositoryCreationTests {
             None => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:28",
                     "Bare repository must be created and accessible via Smart HTTP when announcement is accepted",
                 )
                 .fail("Repository announcement missing d tag")
@@ -87,7 +88,7 @@ impl RepositoryCreationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:28",
                     "Bare repository must be created and accessible via Smart HTTP when announcement is accepted",
                 )
                 .fail(format!("Failed to convert pubkey to npub: {}", e))
@@ -98,7 +99,7 @@ impl RepositoryCreationTests {
         if let Err(e) = check_repo_accessible_via_http(relay_domain, &npub, &repo_id).await {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:28",
                 "Bare repository must be created and accessible via Smart HTTP when announcement is accepted",
             )
             .fail(format!("Repository not accessible via HTTP: {}", e));
@@ -106,7 +107,7 @@ impl RepositoryCreationTests {
 
         TestResult::new(
             test_name,
-            "GRASP-01",
+            "GRASP-01:git-http:28",
             "Bare repository must be created and accessible via Smart HTTP when announcement is accepted",
         )
         .pass()
@@ -114,6 +115,7 @@ impl RepositoryCreationTests {
 
     /// Test that a webpage is served for an existing repository
     ///
+    /// Spec: Line 38 of ../grasp/01.md
     /// This test verifies:
     /// 1. Creates a valid repository announcement
     /// 2. Accesses the repository URL without git service parameters
@@ -133,7 +135,7 @@ impl RepositoryCreationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:38",
                     "Relay SHOULD serve a webpage for existing repositories",
                 )
                 .fail(format!("Failed to create repo fixture: {}", e))
@@ -154,7 +156,7 @@ impl RepositoryCreationTests {
             None => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:38",
                     "Relay SHOULD serve a webpage for existing repositories",
                 )
                 .fail("Repository announcement missing d tag")
@@ -166,7 +168,7 @@ impl RepositoryCreationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
+                    "GRASP-01:git-http:38",
                     "Relay SHOULD serve a webpage for existing repositories",
                 )
                 .fail(format!("Failed to convert pubkey to npub: {}", e))
@@ -177,7 +179,7 @@ impl RepositoryCreationTests {
         if let Err(e) = check_webpage_served(relay_domain, &npub, &repo_id).await {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:38",
                 "Relay SHOULD serve a webpage for existing repositories",
             )
             .fail(format!("Webpage not served: {}", e));
@@ -185,7 +187,7 @@ impl RepositoryCreationTests {
 
         TestResult::new(
             test_name,
-            "GRASP-01",
+            "GRASP-01:git-http:38",
             "Relay SHOULD serve a webpage for existing repositories",
         )
         .pass()
@@ -193,6 +195,7 @@ impl RepositoryCreationTests {
 
     /// Test that 404 is returned for non-existent repositories
     ///
+    /// Spec: Line 38 of ../grasp/01.md
     /// This test verifies:
     /// 1. Accesses a URL for a repository that doesn't exist
     /// 2. Verifies a 404 status is returned
@@ -211,8 +214,8 @@ impl RepositoryCreationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
-                    "Relay SHOULD serve a webpage for existing repositories",
+                    "GRASP-01:git-http:38",
+                    "Relay SHOULD return 404 for repositories it doesn't host",
                 )
                 .fail(format!("Failed to create repo fixture: {}", e))
             }
@@ -223,8 +226,8 @@ impl RepositoryCreationTests {
             Err(e) => {
                 return TestResult::new(
                     test_name,
-                    "GRASP-01",
-                    "Relay SHOULD serve a webpage for existing repositories",
+                    "GRASP-01:git-http:38",
+                    "Relay SHOULD return 404 for repositories it doesn't host",
                 )
                 .fail(format!("Failed to convert pubkey to npub: {}", e))
             }
@@ -236,7 +239,7 @@ impl RepositoryCreationTests {
         if let Err(e) = check_404_for_nonexistent_repo(relay_domain, &npub, fake_repo_id).await {
             return TestResult::new(
                 test_name,
-                "GRASP-01",
+                "GRASP-01:git-http:38",
                 "Relay SHOULD return 404 for repositories it doesn't host",
             )
             .fail(format!("Expected 404, got: {}", e));
@@ -244,7 +247,7 @@ impl RepositoryCreationTests {
 
         TestResult::new(
             test_name,
-            "GRASP-01",
+            "GRASP-01:git-http:38",
             "Relay SHOULD return 404 for repositories it doesn't host",
         )
         .pass()
diff --git a/grasp-audit/src/specs/grasp01/spec_requirements.rs b/grasp-audit/src/specs/grasp01/spec_requirements.rs
new file mode 100644
index 0000000..591fef1
--- /dev/null
+++ b/grasp-audit/src/specs/grasp01/spec_requirements.rs
@@ -0,0 +1,209 @@
+//! GRASP-01 Specification Requirements
+//!
+//! Embedded specification requirements from the GRASP-01 spec document.
+//! This is the single source of truth for spec text displayed in audit reports.
+
+/// GRASP spec repository commit ID that this version is based on
+pub const GRASP_COMMIT_ID: &str = "1fdb8f7";
+
+/// A single specification requirement
+#[derive(Debug, Clone)]
+pub struct SpecRequirement {
+    /// Line number in the spec document
+    pub line: u32,
+    /// Section name (e.g., "Nostr Relay", "Git Smart HTTP Service", "CORS Support")
+    pub section: &'static str,
+    /// The full requirement text
+    pub text: &'static str,
+    /// Requirement level: MUST, SHOULD, or MAY
+    pub level: RequirementLevel,
+}
+
+/// Requirement level per RFC 2119
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RequirementLevel {
+    Must,
+    Should,
+    May,
+}
+
+impl std::fmt::Display for RequirementLevel {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            RequirementLevel::Must => write!(f, "MUST"),
+            RequirementLevel::Should => write!(f, "SHOULD"),
+            RequirementLevel::May => write!(f, "MAY"),
+        }
+    }
+}
+
+/// All GRASP-01 specification requirements
+pub const GRASP_01_REQUIREMENTS: &[SpecRequirement] = &[
+    // Nostr Relay section
+    SpecRequirement {
+        line: 7,
+        section: "Nostr Relay",
+        text: "MUST serve a NIP-01 compliant nostr relay at `/` that accepts git repository announcements and their corresponding repo state announcements.",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 9,
+        section: "Nostr Relay",
+        text: "MUST reject git repository announcements that do not list the service in both `clone` and `relays` tags unless implementing `GRASP-05`.",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 11,
+        section: "Nostr Relay",
+        text: "MAY reject git repository announcements based on other criteria such as pre-payment, quotas, WoT, whitelist, SPAM prevention, etc.",
+        level: RequirementLevel::May,
+    },
+    SpecRequirement {
+        line: 13,
+        section: "Nostr Relay",
+        text: "MUST accept other events that tag, or are tagged by, either: 1. accepted git repository announcements; or 2. accepted issues or patches",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 18,
+        section: "Nostr Relay",
+        text: "MAY reject or delete events for generic SPAM prevention reasons or curation eg. WoT, whitelist, user bans and banned topics.",
+        level: RequirementLevel::May,
+    },
+    SpecRequirement {
+        line: 20,
+        section: "Nostr Relay",
+        text: "MUST serve a NIP-11 document",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 22,
+        section: "Nostr Relay",
+        text: "MUST list each supported GRASP under `supported_grasps` in format `GRASP-XX` eg `GRASP-01` as a string array",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 23,
+        section: "Nostr Relay",
+        text: "MUST list repository acceptance criteria under `repo_acceptance_criteria` as a human readable string",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 24,
+        section: "Nostr Relay",
+        text: "MUST list brief summary of curation policy under `curation` if events are curated beyond generic SPAM prevention; otherwise `curation` MUST be omitted",
+        level: RequirementLevel::Must,
+    },
+    // Git Smart HTTP Service section
+    SpecRequirement {
+        line: 28,
+        section: "Git Smart HTTP Service",
+        text: "MUST serve a git repository via an unauthenticated git smart http service at `/<npub>/<identifier>.git` for each accepted git repository announcement.",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 30,
+        section: "Git Smart HTTP Service",
+        text: "MUST accept pushes via this service that match the latest repo state announcement on the relay, respecting the recursive maintainer set.",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 32,
+        section: "Git Smart HTTP Service",
+        text: "MUST set repository HEAD per repo state announcement as soon as the git data related to that branch has been received.",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 34,
+        section: "Git Smart HTTP Service",
+        text: "MUST accept pushes via this service to `refs/nostr/<event-id>` but SHOULD reject if event exists on relay listing a different tip and MAY reject based on criteria such as size, SPAM prevention, etc. SHOULD delete and MAY garbage collect these refs if no corresponding git PR event or git PR update event, with a `c` tag that matches the ref tip, is accepted by relay within 20 minutes.",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 36,
+        section: "Git Smart HTTP Service",
+        text: "MUST include `allow-reachable-sha1-in-want` and `allow-tip-sha1-in-want` in advertisement and serve available oids.",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 38,
+        section: "Git Smart HTTP Service",
+        text: "SHOULD serve a webpage at the same endpoint linking to git nostr client(s) to browse the repository and a 404 page for repositories it doesn't host.",
+        level: RequirementLevel::Should,
+    },
+    // CORS Support section
+    SpecRequirement {
+        line: 44,
+        section: "CORS Support",
+        text: "Set `Access-Control-Allow-Origin: *` on ALL responses",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 45,
+        section: "CORS Support",
+        text: "Set `Access-Control-Allow-Methods: GET, POST` on ALL responses",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 46,
+        section: "CORS Support",
+        text: "Set `Access-Control-Allow-Headers: Content-Type` on ALL responses",
+        level: RequirementLevel::Must,
+    },
+    SpecRequirement {
+        line: 47,
+        section: "CORS Support",
+        text: "Respond to OPTIONS requests with 204 No Content",
+        level: RequirementLevel::Must,
+    },
+];
+
+/// Get a requirement by line number
+pub fn get_requirement(line: u32) -> Option<&'static SpecRequirement> {
+    GRASP_01_REQUIREMENTS.iter().find(|r| r.line == line)
+}
+
+/// Get all requirements for a section
+pub fn get_requirements_for_section(section: &str) -> Vec<&'static SpecRequirement> {
+    GRASP_01_REQUIREMENTS
+        .iter()
+        .filter(|r| r.section == section)
+        .collect()
+}
+
+/// Get all unique section names in order
+pub fn get_sections() -> Vec<&'static str> {
+    let mut sections = Vec::new();
+    for req in GRASP_01_REQUIREMENTS {
+        if !sections.contains(&req.section) {
+            sections.push(req.section);
+        }
+    }
+    sections
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_get_requirement() {
+        let req = get_requirement(7).expect("Line 7 should exist");
+        assert_eq!(req.section, "Nostr Relay");
+        assert!(req.text.contains("NIP-01"));
+    }
+
+    #[test]
+    fn test_get_sections() {
+        let sections = get_sections();
+        assert_eq!(sections.len(), 3);
+        assert_eq!(sections[0], "Nostr Relay");
+        assert_eq!(sections[1], "Git Smart HTTP Service");
+        assert_eq!(sections[2], "CORS Support");
+    }
+
+    #[test]
+    fn test_requirement_count() {
+        assert_eq!(GRASP_01_REQUIREMENTS.len(), 19);
+    }
+}
\ No newline at end of file