docs(openspec): carry every scenario, because a delta replaces

The MODIFIED delta restated the signature envelope requirement but carried only
one of its three scenarios, so `Version is read before parameters` and
`Signatures compare as whole strings` would have been deleted from the standing
spec by a change whose proposal calls itself strictly additive.

Measured rather than reasoned about: archiving the change and diffing the result
shows `openspec archive` rewrites the requirement to exactly what the delta
contains. It is a replacement, not a patch, and an omitted scenario is dropped
silently. Re-run with the scenarios restored, all four survive.

Recorded as task 2.3 so the next MODIFIED delta in this repository does not
learn it the same way.

Author: theCodeDrift

openspec/changes/signature-coverage-statement/specs/cli-rule-reconciliation/spec.md

@@ -25,6 +25,17 @@ teams hold the same binding as a private assumption.
 - **WHEN** the CLI computes a signature for a rule file's bytes using algoVersion 1
 - **THEN** the signature SHALL be the string `1;h=sha-256;d=<hex>` for that file's normalized bytes
 
+#### Scenario: Version is read before parameters
+
+- **WHEN** the CLI parses a signature string
+- **THEN** it SHALL read the algoVersion as the substring before the first `;`
+- **AND** SHALL NOT rely on the `key=value` parameter syntax to determine the version
+
+#### Scenario: Signatures compare as whole strings
+
+- **WHEN** the CLI compares two signatures for equality
+- **THEN** it SHALL compare the full envelope strings, not the bare digests
+
 #### Scenario: A v1 signature covers the engine's rule file
 
 - **WHEN** a runtime rule carries a signature at algoVersion 1

openspec/changes/signature-coverage-statement/tasks.md

@@ -13,6 +13,8 @@ One PR. A single requirement gains two sentences.
 - [x] 2.1 Confirm no source change is implied. **Verified**: `ALGO_VERSION` is 1 (`rule-hash.ts:14`), `signRuleFile` reads one path and hashes it (`rule-hash.ts:116`), `run-set.ts:41` signs `rule.checkFile` once per rule, and `ENGINE_LAYOUTS` gives every engine exactly one `ruleFile` (`<id>.yml` for sg and vale, `check.ts` for runtime) so the statement generalises rather than special-casing runtime
 - [x] 2.2 Confirm the statement matches what the service does. **Confirmed by the generator team**, who declined-and-accepted in the same round: "a v1 signature covers the engine's ruleFile, multi-file signing would be v2" is recorded in their half of the cross-team document as settled, not proposed
 
+- [x] 2.3 Carry every existing scenario into the MODIFIED delta. **A delta is a replacement, not a patch**: measured by archiving this change and diffing the result, `openspec archive` rewrites the requirement to exactly what the delta contains, so `Version is read before parameters` and `Signatures compare as whole strings` were dropped from the standing spec until they were restated here
+
 ## 3. Close out
 
 - [ ] 3.1 Archive the change