@openwop/openwop-conformance 1.149.0 → 1.151.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [1.151.0] — 2026-09-02 — RFC 0164: the subject-link scenarios gate on the profile pair; the opted-out shape fails
+
+No new scenario file. `auth-subject-link.test.ts` and `auth-subject-link-key-class.test.ts` re-gate every leg on the host advertising **both** `openwop-auth-saml` and `openwop-auth-scim`, not on `capabilities.auth.subjectLinking`, which RFC 0164 makes a derived advertisement. The RFC 0159 advertisement block gains a leg: both profiles advertised ⇒ `subjectLinking === true` and `subjectLinkKey ∈ {opaque-idp, configured-immutable}`, else `executed-fail` citing RFC 0164 §A.3. That is the shape a combined host that opted out used to present, and it used to read `inapplicable` — a host shipping the leaver bypass was invisible to the suite. `src/lib/capabilities-auth-subject-link.test.ts` pins the new schema conditional (both profiles with the flag absent, `false`, or without a key are rejected; with `true` + a class accepted; profile order irrelevant; single-profile hosts unaffected). `capabilities.schema.json` composes the RFC 0163 and RFC 0164 conditionals under `allOf`; `coverage.md` rows re-worded. No production host advertises both profiles, so no host's recorded evidence changes.
+
 ## [1.149.0] — 2026-09-02 — RFC 0163 `Active → Accepted` (tier-1 witness)
 
 No scenario change; `coverage.md` (packed) moves the `auth-subject-link-key-class.test.ts` behaviour grade from `host-pending` to host-pass, so the published tarball content changes and the identity gate asks for a bump. The reference host (openwop-app #3614, `2f6ca969d`, ADR 0620) emits `subjectLinkKey: "opaque-idp"` from the same gate as `subjectLinking`, reconstructs the suite's signed `<saml:Issuer>` in its validator, binds the SCIM connection to an IdP entityID (`idpUrl` accepted on the provision seam, SSRF-guarded), and refuses a cross-IdP identifier collision with `401 subject_link_trust_root_mismatch` on the validate seam and with no session on the production ACS. The host widened its seam SSRF allowlist to the second synthetic IdP first, so the cross-root negative is refused on trust root rather than on origin — sabotage-verified. Single-witness under the bootstrap waiver; no tier-2/3 host advertises `subjectLinking`.

package/coverage.md

@@ -117,8 +117,8 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `authorization-fail-closed.test.ts`                                                                                                                                                                                                                     | `capabilities.authorization` (RFC 0049 §C) + `SECURITY/invariants.yaml` `authorization-fail-closed`                                                                                                                                                                                                                     | A (advertisement `failClosed===true` always; fail-closed MUST-NOT via optional `POST /v1/host/sample/authorization/decide` seam — an unseeded-role principal resolves `allowed:false`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `host-pending`                                                                                                                   | Capability-gated on `authorization.supported`; behavioral probe soft-skips on 404. Scope-match + denial-audited scenarios deferred to a host.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `auth-saml-profile.test.ts`                                                                                                                                                                                                                             | `openwop-auth-saml` (RFC 0050, `auth-profiles.md` §`openwop-auth-saml`)                                                                                                                                                                                                                                                 | A+B (profile-advertisement shape always; **1-positive + 6-negative reference suite runs server-free** via the bundled synthetic IdP `conformance/src/lib/saml-idp.ts` — `alg:none`/unsigned/bad-sig/expired/not-yet-valid/wrapping; host-ACS validation opt-in via `OPENWOP_TEST_SAML_IDP_URL` + the `auth/saml/validate` seam)                                                                                                                                                                                                                                                                                                                                                                     | host-pass (server-free reference)                                                                                                | Synthetic IdP bundled (`node:crypto`, no deps). Host-ACS pass is the remaining graduation gate.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `auth-scim-profile.test.ts`                                                                                                                                                                                                                             | `openwop-auth-scim` (RFC 0050, `auth-profiles.md` §`openwop-auth-scim`)                                                                                                                                                                                                                                                 | B (profile-advertisement shape always; SCIM user/group provisioning → principal/role roundtrip opt-in via `OPENWOP_TEST_SCIM_URL` + the `auth/scim/provision` seam)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `host-pending`                                                                                                                   | Behavior opt-in (operator-supplied SCIM endpoint); deactivate ⇒ subsequent-deny assertion deferred to a host.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `auth-subject-link.test.ts` | `openwop-auth-saml` + `openwop-auth-scim` with `capabilities.auth.subjectLinking: true` (RFC 0159, `auth-profiles.md` §Subject linking) | B (advertisement gate always — `subjectLinking:true` only alongside both profiles; cross-lane leaver deny + mutable-key negative opt-in via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SCIM_URL` and the `auth/scim/provision` + `auth/saml/validate` seams) | host-pass (tier-1 in-process witness, openwop-app #3581) | Invariant `subject-link-leaver-deny`. No production host advertises `subjectLinking`. |
-| `auth-subject-link-key-class.test.ts` | as above (RFC 0163) | B (`subjectLinkKey` ∈ `{opaque-idp, configured-immutable}` when `subjectLinking:true`, unaided; same-IdP control + cross-IdP collision negative opt-in via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SAML_IDP_URL_B` + `OPENWOP_TEST_SCIM_URL`) | host-pass (tier-1 in-process witness, openwop-app #3614) | Invariants `subject-link-key-class-declared`, `subject-link-same-trust-root`. Fixture self-test lives in `src/lib/saml-idp.test.ts`, not here (G8). |
+| `auth-subject-link.test.ts` | `openwop-auth-saml` + `openwop-auth-scim` advertised together (RFC 0159 + RFC 0164, `auth-profiles.md` §Subject linking; `subjectLinking` is derived) | B (advertisement gate always — `subjectLinking:true` only alongside both profiles, AND both profiles ⇒ `subjectLinking:true` + `subjectLinkKey` (RFC 0164 vulnerable-shape leg, `executed-fail` never `inapplicable`); cross-lane leaver deny + mutable-key negative opt-in via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SCIM_URL` and the `auth/scim/provision` + `auth/saml/validate` seams) | host-pass (tier-1 in-process witness, openwop-app #3581) | Invariant `subject-link-leaver-deny`. No production host advertises `subjectLinking`. |
+| `auth-subject-link-key-class.test.ts` | as above (RFC 0163; gated on the profile pair since RFC 0164) | B (`subjectLinkKey` ∈ `{opaque-idp, configured-immutable}` when `subjectLinking:true`, unaided; same-IdP control + cross-IdP collision negative opt-in via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SAML_IDP_URL_B` + `OPENWOP_TEST_SCIM_URL`) | host-pass (tier-1 in-process witness, openwop-app #3614) | Invariants `subject-link-key-class-declared`, `subject-link-same-trust-root`. Fixture self-test lives in `src/lib/saml-idp.test.ts`, not here (G8). |
 | `runtime-requires-shape.test.ts`                                                                                                                                                                                                                        | `node-pack-manifest.schema.json` `$defs/Runtime.requires` (RFC 0076 §A, `node-packs.md` §"Runtime platform requirements")                                                                                                                                                                                               | Server-free (closed-vocabulary validation: 8 tokens validate; raw builtin `node:dns/promises` rejected → `invalid_manifest`; empty-array≡omission; `uniqueItems`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | host-pass (server-free)                                                                                                          | Always runs; no host needed. The install-time GATE behavior is in `runtime-requires-install-gate.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `runtime-requires-install-gate.test.ts`                                                                                                                                                                                                                 | RFC 0076 §A install gate (no capability flag; seam `POST /v1/host/sample/packs/install-gate`)                                                                                                                                                                                                                           | A (install-grant; install-refuse → `pack_runtime_requirement_unmet { unmet, manifest, advice? }`; non-sandbox SHOULD-projection — all via the optional seam)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `host-pending`                                                                                                                   | Seam-gated; soft-skips on 404. First adopter: MyndHyve's install-time gate against `core.openwop.http` declaring `["net.dns","net.outbound"]`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `safefetch-behavior.test.ts`                                                                                                                                                                                                                            | `capabilities.httpClient.safeFetch` (RFC 0076 §B, `host-capabilities.md` §host.http) + `SECURITY/invariants.yaml` `http-client-ssrf-guard`                                                                                                                                                                              | A (SSRF block + DNS-rebinding defeat + `Connection: upgrade` refusal + tool-hooks audit-when-`prePostEvents`, via the optional `POST /v1/host/sample/http/safe-fetch` seam)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | in-memory ✅                                                                                                                     | **5/5 PASS against the in-memory reference host** (2026-05-29, `OPENWOP_REQUIRE_BEHAVIOR=true`); seam-gated, soft-skips on 404 elsewhere. Reuses the existing `http-client-ssrf-guard` invariant (no new invariant). Advertisement contract in `http-client-ssrf.test.ts`. §B → Accepted still awaits `core.openwop.http@2.0.0` consumer + non-steward adoption.                                                                                                                                                                                                                                                                        |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.149.0",
+  "version": "1.151.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/CORPUS-STAMP.json

@@ -1,5 +1,5 @@
 {
   "_comment": "Provenance of this vendored schemas/ copy. See conformance/README.md \u00a7\"Resolving the contract\". Compare against the stamp in your installed @openwop/openwop-conformance to detect a stale hand-copied contract.",
-  "suiteVersion": "1.149.0",
-  "corpusCommit": "6cdf17d36ce5856f9ba775fd393ee02a6da3eded"
+  "suiteVersion": "1.151.0",
+  "corpusCommit": "b1203c4399516184e2ad36aaedfec35331abb175"
 }

package/schemas/capabilities.schema.json

@@ -3693,7 +3693,7 @@
         },
         "subjectLinking": {
           "type": "boolean",
-          "description": "RFC 0159 (auth-profiles.md \u00a7Subject linking). When true, this host advertises BOTH `openwop-auth-saml` and `openwop-auth-scim` AND honours the cross-profile subject-linking obligation: it links the SAML and SCIM principals of one human on an opaque, IdP-stable subject id (SCIM `externalId` \u2194 persistent SAML `NameID`), same-tenant only, and on SCIM deactivation fail-closes the linked SAML identity too (composing RFC 0049 \u00a7C) \u2014 so a provisioned leaver cannot still SSO in. The link key MUST NOT be a mutable/PII attribute (email, userName). Optional; absent/false means the SAML and SCIM lanes are independent and the combined leaver guarantee is NOT claimed. A host MUST NOT set this true unless both profiles are advertised and the obligation holds."
+          "description": "RFC 0164: DERIVED and DEPRECATED toward v2. A host that advertises both `openwop-auth-saml` and `openwop-auth-scim` MUST set this true (schema conditional on `profiles[]`); a document advertising both with this absent/false is invalid. Kept through v1.x for clients pinned to it; clients SHOULD derive the guarantee from the profile pair. Original (RFC 0159) semantics follow. RFC 0159 (auth-profiles.md \u00a7Subject linking). When true, this host advertises BOTH `openwop-auth-saml` and `openwop-auth-scim` AND honours the cross-profile subject-linking obligation: it links the SAML and SCIM principals of one human on an opaque, IdP-stable subject id (SCIM `externalId` \u2194 persistent SAML `NameID`), same-tenant only, and on SCIM deactivation fail-closes the linked SAML identity too (composing RFC 0049 \u00a7C) \u2014 so a provisioned leaver cannot still SSO in. The link key MUST NOT be a mutable/PII attribute (email, userName). Optional; absent/false means the SAML and SCIM lanes are independent and the combined leaver guarantee is NOT claimed. A host MUST NOT set this true unless both profiles are advertised and the obligation holds."
         },
         "subjectLinkKey": {
           "type": "string",
@@ -3862,14 +3862,36 @@
           }
         }
       },
-      "if": {
-        "properties": { "subjectLinking": { "const": true } },
-        "required": ["subjectLinking"]
-      },
-      "then": {
-        "required": ["subjectLinkKey"],
-        "$comment": "RFC 0163 \u00a7A.1 / \u00a7C: a host that claims subject linking MUST declare the class it joins on. A conditional required on a flag no host emitted when it landed is a tightening of an unemitted shape (COMPATIBILITY.md \u00a72.2), not closure of a server-emitted shape (\u00a72.1)."
-      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "subjectLinking": { "const": true } },
+            "required": ["subjectLinking"]
+          },
+          "then": {
+            "required": ["subjectLinkKey"],
+            "$comment": "RFC 0163 \u00a7A.1 / \u00a7C: a host that claims subject linking MUST declare the class it joins on. A conditional required on a flag no host emitted when it landed is a tightening of an unemitted shape (COMPATIBILITY.md \u00a72.2), not closure of a server-emitted shape (\u00a72.1)."
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "profiles": {
+                "allOf": [
+                  { "contains": { "const": "openwop-auth-saml" } },
+                  { "contains": { "const": "openwop-auth-scim" } }
+                ]
+              }
+            },
+            "required": ["profiles"]
+          },
+          "then": {
+            "properties": { "subjectLinking": { "const": true } },
+            "required": ["subjectLinking", "subjectLinkKey"],
+            "$comment": "RFC 0164 \u00a7A.3 / \u00a7B: advertising BOTH openwop-auth-saml and openwop-auth-scim implies the combined leaver contract, so `subjectLinking` MUST be true (a derived statement of fact, deprecated toward v2) and `subjectLinkKey` MUST name the class. Binds only documents that emit both profile strings; none did when it landed (COMPATIBILITY.md \u00a72.2 / \u00a74 default-on row with an empty harm set)."
+          }
+        }
+      ],
       "additionalProperties": true
     },
     "discovery": {

package/src/lib/capabilities-auth-subject-link.test.ts

@@ -2,8 +2,9 @@
  * Server-free pin of the RFC 0163 §C schema conditional in
  * `schemas/capabilities.schema.json`:
  *
- *   auth.subjectLinking: true  ⇒  auth.subjectLinkKey required
- *   auth.subjectLinkKey        ∈  { opaque-idp, configured-immutable }
+ *   auth.subjectLinking: true  ⇒  auth.subjectLinkKey required            (RFC 0163)
+ *   auth.subjectLinkKey        ∈  { opaque-idp, configured-immutable }   (RFC 0163)
+ *   profiles ⊇ {saml, scim}    ⇒  subjectLinking const true + key required (RFC 0164)
  *
  * This checks the SCHEMA ARTIFACT, not any host, which is why it lives under
  * `src/lib/` (no scenario ledger row — see `saml-idp.test.ts` for the G8
@@ -68,8 +69,35 @@ describe('capabilities.schema.json: auth.subjectLinkKey conditional (RFC 0163 §
     }
   });
 
-  it('subjectLinking absent or false does not require a key (nothing de-conforms)', () => {
-    expect(validate(doc({ profiles: PROFILES }))).toBe(true);
-    expect(validate(doc({ profiles: PROFILES, subjectLinking: false }))).toBe(true);
+  it('one profile alone does not require the flag or a key (SAML-only / SCIM-only hosts are unaffected)', () => {
+    expect(validate(doc({ profiles: ['openwop-auth-saml'] }))).toBe(true);
+    expect(validate(doc({ profiles: ['openwop-auth-scim'], subjectLinking: false }))).toBe(true);
+  });
+});
+
+describe('capabilities.schema.json: the profile pair implies the contract (RFC 0164 §B)', () => {
+  const validate = compileCapabilities();
+
+  it('BOTH profiles with subjectLinking absent fails validation (the vulnerable pre-0164 shape)', () => {
+    const ok = validate(doc({ profiles: PROFILES }));
+    expect(ok, JSON.stringify(validate.errors)).toBe(false);
+    expect(JSON.stringify(validate.errors)).toContain('subjectLinking');
+  });
+
+  it('BOTH profiles with subjectLinking:false fails validation (the flag is derived, not a choice)', () => {
+    expect(validate(doc({ profiles: PROFILES, subjectLinking: false, subjectLinkKey: 'opaque-idp' }))).toBe(false);
+  });
+
+  it('BOTH profiles with subjectLinking:true but no subjectLinkKey fails validation', () => {
+    expect(validate(doc({ profiles: PROFILES, subjectLinking: true }))).toBe(false);
+  });
+
+  it('BOTH profiles with subjectLinking:true + a class member validates (the derived advertisement)', () => {
+    expect(validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: 'opaque-idp' }))).toBe(true);
+  });
+
+  it('profile order does not matter', () => {
+    expect(validate(doc({ profiles: ['openwop-auth-scim', 'openwop-auth-api-key-rotation', 'openwop-auth-saml'], subjectLinking: true, subjectLinkKey: 'configured-immutable' }))).toBe(true);
+    expect(validate(doc({ profiles: ['openwop-auth-scim', 'openwop-auth-api-key-rotation', 'openwop-auth-saml'] }))).toBe(false);
   });
 });

package/src/lib/webhook-receiver.ts

@@ -169,6 +169,27 @@ export function signPayload(
  * for a single-tenant host (which omits `owner`) or when no probe
  * fixture is available — callers then omit `tenantId`, which single-tenant hosts
  * accept. (RFC 0093 / webhooks.md §Register; suite defect fixed 2026-08-09.)
+ *
+ * **Prefers `owner.workspace`, and that is not a fallback ordering — it is which
+ * field the route actually takes.** `webhooks.md` §Register documents the body's
+ * `tenantId` as *"Workspace under which the subscription lives. Caller MUST be a
+ * member."*, and every example in that document passes a workspace
+ * (`workspace-123`, `workspace-prod`). RFC 0048 §A defines `owner.tenant` as
+ * something else entirely — the **top-level isolation boundary** — with
+ * `workspace` an optional sub-tenant beneath it. The two coincide only on hosts
+ * where tenant ≡ workspace, which is why reading `owner.tenant` worked
+ * everywhere it had been run.
+ *
+ * Reported 2026-09-02 by a tier-2 host with a real workspace layer: its
+ * schema-correct `owner` is `{tenant: "<instance>", workspace: "<workspaceId>",
+ * principal: …}`, so this helper derived the instance label — a value **nobody
+ * is a member of** — and registration 403'd by design. Registering with
+ * `owner.workspace` returns 201, verified by curl on that host. The host is
+ * conformant and the suite was wrong; the docblock above already stated the
+ * right intent ("a tenant the calling bearer provably OWNS") while reading the
+ * field that does not carry it.
+ *
+ * The `tenant` read is retained beneath it for hosts that emit no `workspace`.
  */
 export async function discoverOwnedTenant(
   driver: { post: (p: string, b: unknown) => Promise<{ status: number; json: unknown }>; get: (p: string) => Promise<{ status: number; json: unknown }> },
@@ -179,7 +200,12 @@ export async function discoverOwnedTenant(
   const runId = (create.json as { runId?: string } | null)?.runId;
   if (typeof runId !== 'string') return undefined;
   const snap = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
-  const owner = (snap.json as { owner?: { tenant?: unknown; tenantId?: unknown } } | null)?.owner;
+  const owner = (snap.json as { owner?: { tenant?: unknown; workspace?: unknown; tenantId?: unknown } } | null)
+    ?.owner;
+  // `tenantId` on POST /v1/webhooks is the WORKSPACE (webhooks.md §Register), not
+  // the RFC 0048 §A `tenant` isolation boundary. Where a host distinguishes them,
+  // only the workspace is a scope the bearer is a member of.
+  if (typeof owner?.workspace === 'string' && owner.workspace.length > 0) return owner.workspace;
   if (typeof owner?.tenant === 'string' && owner.tenant.length > 0) return owner.tenant;
   // Pre-S29 hosts that copied the suite's misnamed field: tolerated, never asserted.
   return typeof owner?.tenantId === 'string' && owner.tenantId.length > 0 ? owner.tenantId : undefined;

package/src/scenarios/auth-subject-link-key-class.test.ts

@@ -11,7 +11,7 @@
  * `capabilities.auth.subjectLinking` opt-in as RFC 0159.
  *
  * TWO LEGS:
- *   (§A) ADVERTISEMENT — a discovery read, runs whenever subjectLinking:true.
+ *   (§A) ADVERTISEMENT — a discovery read, runs whenever both profiles are advertised.
  *        A subjectLinking:true host MUST advertise a subjectLinkKey that is a
  *        member of the CLOSED enum {opaque-idp, configured-immutable}. The
  *        enum names classes, not attributes. Mutable/PII keys are
@@ -58,6 +58,12 @@ interface DiscoveryDoc {
   extensions?: { auth?: DiscoveryAuth };
 }
 
+/** RFC 0164: the gate is the profile PAIR, not the (now derived) flag. */
+function advertisesBoth(auth: DiscoveryAuth | null): auth is DiscoveryAuth {
+  const p = auth?.profiles ?? [];
+  return p.includes(SAML_PROFILE) && p.includes(SCIM_PROFILE);
+}
+
 async function readAuth(): Promise<DiscoveryAuth | null> {
   const res = await driver.get('/.well-known/openwop');
   const body = res.json as DiscoveryDoc | undefined;
@@ -67,11 +73,12 @@ async function readAuth(): Promise<DiscoveryAuth | null> {
 describe('auth-subject-link-key-class: advertisement shape (RFC 0163 §A)', () => {
   it('subjectLinking:true requires a subjectLinkKey drawn from the closed safe-class enum', async () => {
     const auth = await readAuth();
-    if (auth === null || auth.subjectLinking !== true) {
-      return softSkip('inapplicable', 'auth.subjectLinking not claimed');
+    if (!advertisesBoth(auth)) {
+      return softSkip('inapplicable', 'RFC 0164 gate: host does not advertise both openwop-auth-saml and openwop-auth-scim');
     }
 
-    // §A.1 — a subjectLinking:true host MUST advertise a subjectLinkKey.
+    // §A.1 — a subjectLinking:true host (RFC 0164: any host advertising both
+    // profiles) MUST advertise a subjectLinkKey.
     expect(
       typeof auth.subjectLinkKey === 'string' && auth.subjectLinkKey.length > 0,
       driver.describe(
@@ -120,7 +127,7 @@ describe('auth-subject-link-key-class: same-IdP trust root (RFC 0163 §B — beh
 
   it('a same-IdP link forms (control) but a cross-IdP collision MUST NOT link', async () => {
     const auth = await readAuth();
-    if (auth === null || auth.subjectLinking !== true) return softSkip('inapplicable', 'capability-gated on auth.subjectLinking');
+    if (!advertisesBoth(auth)) return softSkip('inapplicable', 'RFC 0164 gate: host does not advertise both openwop-auth-saml and openwop-auth-scim');
     if (!idpAUrl || !idpBUrl || !scimUrl) {
       return softSkip('inapplicable', 'opt-in: the two-trust-root seam needs OPENWOP_TEST_SAML_IDP_URL (IdP-A) + OPENWOP_TEST_SAML_IDP_URL_B (IdP-B) + OPENWOP_TEST_SCIM_URL');
     }

package/src/scenarios/auth-subject-link.test.ts

@@ -6,14 +6,20 @@
  * documented in `auth-profiles.md` §"Subject linking (SAML ⟷ SCIM)" and is
  * discoverable via `capabilities.auth.subjectLinking`.
  *
- * Advertisement shape runs unconditionally when the flag is set. The
- * cross-lane behavioral legs (a SCIM deactivation fail-closing the linked SAML
- * identity; a mutable-key link never producing a cross-lane pass) are opt-in
- * via `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SCIM_URL` (operator-supplied
+ * GATE (RFC 0164): every leg runs whenever the host advertises BOTH
+ * `openwop-auth-saml` and `openwop-auth-scim` — the profile PAIR is the gate,
+ * not `capabilities.auth.subjectLinking`, which since RFC 0164 is a DERIVED
+ * advertisement that MUST be true when both profiles are present. A host that
+ * advertises both and omits the flag is the vulnerable pre-0164 shape and
+ * FAILS the advertisement leg (never `inapplicable`). The cross-lane
+ * behavioral legs (a SCIM deactivation fail-closing the linked SAML identity;
+ * a mutable-key link never producing a cross-lane pass) are opt-in via
+ * `OPENWOP_TEST_SAML_IDP_URL` + `OPENWOP_TEST_SCIM_URL` (operator-supplied
  * endpoints), following the `auth-scim-profile.test.ts` opt-in precedent.
  * Soft-skips otherwise; soft-skips `blocked` until the host wires the seam.
  *
  * @see RFCS/0159-scim-saml-subject-linking.md
+ * @see RFCS/0164-mandatory-subject-linking.md (the profile-pair gate + the vulnerable-shape leg)
  * @see spec/v1/auth-profiles.md §"Subject linking (SAML ⟷ SCIM)"
  */
 
@@ -28,6 +34,15 @@ const SCIM_PROFILE = 'openwop-auth-scim';
 interface DiscoveryAuth {
   profiles?: string[];
   subjectLinking?: boolean;
+  subjectLinkKey?: string;
+}
+
+const SUBJECT_LINK_KEY_CLASSES: readonly string[] = ['opaque-idp', 'configured-immutable'];
+
+/** RFC 0164: the gate is the profile PAIR. */
+function advertisesBoth(auth: DiscoveryAuth | null): auth is DiscoveryAuth {
+  const p = auth?.profiles ?? [];
+  return p.includes(SAML_PROFILE) && p.includes(SCIM_PROFILE);
 }
 
 interface DiscoveryDoc {
@@ -41,7 +56,7 @@ async function readAuth(): Promise<DiscoveryAuth | null> {
   return capabilityFamily<DiscoveryAuth>(body, 'auth') ?? body?.extensions?.auth ?? null;
 }
 
-describe('auth-subject-link: advertisement shape (RFC 0159 §B)', () => {
+describe('auth-subject-link: advertisement shape (RFC 0159 §B + RFC 0164 §A.3)', () => {
   it('subjectLinking:true is only claimed alongside both SAML and SCIM profiles', async () => {
     const auth = await readAuth();
     if (auth === null || auth.subjectLinking !== true) {
@@ -56,6 +71,31 @@ describe('auth-subject-link: advertisement shape (RFC 0159 §B)', () => {
       ),
     ).toBe(true);
   });
+
+  it('advertising BOTH profiles REQUIRES subjectLinking:true + a subjectLinkKey (RFC 0164 — the vulnerable shape fails, never inapplicable)', async () => {
+    const auth = await readAuth();
+    if (!advertisesBoth(auth)) {
+      return softSkip('inapplicable', 'host does not advertise both openwop-auth-saml and openwop-auth-scim');
+    }
+    // The pre-RFC-0164 "opted out" shape: both lanes advertised, no flag. That
+    // host ships the combined-deployment leaver bypass under a conforming
+    // banner. RFC 0164 §A.3 makes the flag a DERIVED statement of fact, so its
+    // absence alongside both profiles is a conformance FAILURE.
+    expect(
+      auth.subjectLinking,
+      driver.describe(
+        'auth-profiles.md §Subject linking (RFC 0164)',
+        'RFC 0164 §A.3: a host advertising BOTH openwop-auth-saml and openwop-auth-scim MUST advertise capabilities.auth.subjectLinking:true — the leaver contract follows the profile pair; omitting the flag is the vulnerable pre-0164 shape',
+      ),
+    ).toBe(true);
+    expect(
+      typeof auth.subjectLinkKey === 'string' && SUBJECT_LINK_KEY_CLASSES.includes(auth.subjectLinkKey),
+      driver.describe(
+        'auth-profiles.md §Subject linking (RFC 0164)',
+        `RFC 0164 §A.3 / RFC 0163 §A.1: a host advertising both profiles MUST advertise subjectLinkKey ∈ {${SUBJECT_LINK_KEY_CLASSES.join(', ')}}`,
+      ),
+    ).toBe(true);
+  });
 });
 
 describe('auth-subject-link: cross-lane deactivation (RFC 0159 §A.3 — opt-in)', () => {
@@ -64,7 +104,7 @@ describe('auth-subject-link: cross-lane deactivation (RFC 0159 §A.3 — opt-in)
 
   it('a SCIM deactivation fail-closes the linked SAML identity', async () => {
     const auth = await readAuth();
-    if (auth === null || auth.subjectLinking !== true) return softSkip('inapplicable', 'capability-gated');
+    if (!advertisesBoth(auth)) return softSkip('inapplicable', 'RFC 0164 gate: host does not advertise both openwop-auth-saml and openwop-auth-scim');
     if (!idpUrl || !scimUrl) return softSkip('inapplicable', 'opt-in: SAML IdP and/or SCIM endpoint not provided');
 
     // 1. Provision a SCIM user carrying an opaque, IdP-stable externalId.
@@ -110,7 +150,7 @@ describe('auth-subject-link: link-key hygiene (RFC 0159 §A.2 — opt-in)', () =
 
   it('a mutable/PII link key (email) never produces a cross-lane pass', async () => {
     const auth = await readAuth();
-    if (auth === null || auth.subjectLinking !== true) return softSkip('inapplicable', 'capability-gated');
+    if (!advertisesBoth(auth)) return softSkip('inapplicable', 'RFC 0164 gate: host does not advertise both openwop-auth-saml and openwop-auth-scim');
     if (!idpUrl || !scimUrl) return softSkip('inapplicable', 'opt-in: SAML IdP and/or SCIM endpoint not provided');
 
     // Attempt to form the cross-lane link on email (a mutable/PII attribute).