Cockburn's book is a wonderful resource, isn't it?
The best and most vague advice is to put it in the format that best communicates to the audience. In my world there are three readers: Business folk confirm that we understood their requirements, developers write code to meet the requirements, testers verify each requirement with tests. We seem to have stuck ourselves in a rut with overly formal langauge that makes it a real effort to dig through a
doc and find simple things like this.
Any of your suggested locations is ok, but may be more or less convenient for your audience depending on who they are and how they like to work. I'd just encourage you to keep it as clear and simple as possible. Figure out who needs to know this stuff and why, and write for them. Don't let any rules make you clutter it up.
Let us know how it work out!