@openwop/openwop-conformance 2.0.10 → 2.0.11

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.0.11] — 2026-09-10 — the emitter scrubbed the key id it was required to publish
+
+`--certify` fix. `evidenceSecretsFromEnv` selected every `OPENWOP_*` variable
+whose name matched `/(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/` and replaced its
+value throughout the bundle after `discovery.sha256` was taken.
+`OPENWOP_BUNDLE_SIGNING_KEY_ID` — the variable `--help` offers — matches on
+`KEY`, and its value is the identifier RFC 0168 §E.2 requires
+`discovery.document.signingKeys[].keyId` to publish. The embedded document lost
+its keyId, the digest kept it, and the emitter rejected its own output
+(`discovery.document ≠ discovery.sha256`). Three MyndHyve cuts on 2.0.8 and
+2.0.9 failed on this alone; the same host passed the day before with the id
+on `--signing-key-id`.
+
+- `*_ID` variable names are excluded from the classifier — an identifier of a
+  key is not the key.
+- The emitter passes the keyId it is about to publish as `except`, so it
+  survives whichever variable carried it.
+- On a self-verification failure the rejected bundle is written to
+  `<out>.rejected.json` and named on stderr, instead of being discarded — the
+  diagnostic a host had to patch a scratch copy of this CLI to obtain.
+- New redaction leg `openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed`.
+
+No scenario logic changes.
+
 ## [2.0.10] — 2026-09-10 — the bare-id leg
 
 One new leg in `v2-id-grammar` (`openwop.requirement.0170.id-grammar.bare-id`):

package/dist/cli.js

@@ -643,13 +643,20 @@ async function runCertify(args, baseUrl, apiKey) {
             }
             v3.verifierSignature = verifierSign(unsigned, vk, vkId);
         }
-        const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem]);
+        // The published keyId is never a secret, whichever variable carried it
+        // (evidenceSecretsFromEnv: the `_ID` exclusion is the rule, `except` is
+        // the belt for a host that names its env var differently).
+        const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem], [keyId]);
         const scrubbed3 = scrubEvidence(v3, secrets3);
         const v3Out = scrubbed3.value;
         const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
         const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
         if (emitterDefects.length > 0) {
-            process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED self-verification (emitter defect):\n' + emitterDefects.map((r) => `  - [${r.kind}] ${r.detail}`).join('\n') + '\n');
+            // Keep the rejected bundle: a self-verification failure with nothing to
+            // inspect sent a host patching a scratch copy of this CLI to see it.
+            const rejectedPath = `${outPath}.rejected.json`;
+            writeFileSync(rejectedPath, `${JSON.stringify(v3Out, null, 2)}\n`);
+            process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED self-verification (emitter defect):\n' + emitterDefects.map((r) => `  - [${r.kind}] ${r.detail}`).join('\n') + `\n  the rejected bundle is at ${rejectedPath} (NOT a certification artifact — do not check it in)\n`);
             process.exit(2);
         }
         const v3Schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'certification-bundle.schema.json'), 'utf8'));

package/dist/lib/certification-bundle-verify.js

@@ -255,19 +255,33 @@ export function scrubEvidence(value, secrets) {
  * The secrets a `--certify` run must keep out of its own evidence: the
  * credential it was handed, plus every `OPENWOP_*` environment value that
  * names a key/token/secret/password, plus the conformance canary.
+ *
+ * An *identifier* of a key is not the key. `OPENWOP_BUNDLE_SIGNING_KEY_ID`
+ * (and `_VERIFIER_KEY_ID`) name the public `keyId` RFC 0168 §E.2 requires the
+ * host to publish in `discovery.document.signingKeys[]`; matching them on
+ * `KEY` scrubbed that id out of the embedded document AFTER `discovery.sha256`
+ * was taken, so every host that passed the id by env failed its own bundle's
+ * self-verification (`discovery.document` ≠ `discovery.sha256`) — suites 2.0.8
+ * and 2.0.9, found by MyndHyve 2026-09-10 across three cuts; the same host had
+ * passed the day before by passing the id as a flag. Names ending in `_ID`
+ * are excluded, and a caller may name values that MUST stay visible (`except`)
+ * regardless of which variable carried them.
  */
-export function evidenceSecretsFromEnv(env, extra = []) {
+export function evidenceSecretsFromEnv(env, extra = [], except = []) {
+    const keep = new Set(except.filter((s) => s !== undefined && s.trim() !== ''));
     const out = new Set();
     for (const [k, v] of Object.entries(env)) {
         if (!k.startsWith('OPENWOP_'))
             continue;
         if (!/(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/.test(k))
             continue;
-        if (v !== undefined && v.trim() !== '')
+        if (/_ID$/.test(k))
+            continue; // a key's identifier is published, not secret
+        if (v !== undefined && v.trim() !== '' && !keep.has(v))
             out.add(v);
     }
     for (const s of extra)
-        if (s !== undefined && s.trim() !== '')
+        if (s !== undefined && s.trim() !== '' && !keep.has(s))
             out.add(s);
     out.add(CONFORMANCE_SECRET_CANARY);
     return [...out];

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.10",
-  "stampSha256": "6958747f86a6caa1edac56ec46696255efeff5f5c4e725d275995203276a7058"
+  "version": "2.0.11",
+  "stampSha256": "73ec5b7c6f2dceeefad0afb5d47446c3566a33ed6123db4bafcb26af38767fa6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.10"
+    "@openwop/spec-artifacts": "2.0.11"
   }
 }

package/requirements.json

@@ -3,10 +3,10 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 565,
-    "tests": 2152,
-    "withStableId": 2152,
+    "tests": 2153,
+    "withStableId": 2153,
     "interpolatedTitles": 0,
-    "explicitIds": 2107
+    "explicitIds": 2108
   },
   "records": [
     {
@@ -7082,9 +7082,26 @@
       ]
     },
     {
-      "id": "openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc",
+      "id": "openwop.it.certification-bundle-redaction.evidencesecretsfromenv-never-scrubs-a-key-identifier-id-variables-are-excluded-a",
       "file": "certification-bundle-redaction.test.ts",
       "line": 157,
+      "title": "evidenceSecretsFromEnv never scrubs a key IDENTIFIER: *_ID variables are excluded and `except` values stay visible whichever variable carried them",
+      "explicitId": "openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed",
+      "citations": [
+        {
+          "section": "RFC 0168 §E.2",
+          "requirement": "the keyId a host publishes in discovery.document.signingKeys[] MUST survive evidence scrubbing — a *_ID variable is an identifier, not a secret"
+        },
+        {
+          "section": "RFC 0168 §E.2",
+          "requirement": "a value the emitter names as `except` (the keyId it is about to publish) is never scrubbed, whichever variable carried it"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc",
+      "file": "certification-bundle-redaction.test.ts",
+      "line": 177,
       "title": "verifyBundleV2 REJECTS a bundle carrying the conformance canary anywhere, and accepts the scrubbed twin",
       "explicitId": "openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc",
       "citations": [
@@ -7097,7 +7114,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.the-canary-in-a-discovery-document-key-is-still-a-rejection-keys-are-evidence",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 172,
+      "line": 192,
       "title": "the canary in a discovery-document KEY is still a rejection (keys are evidence)",
       "explicitId": "openwop.it.certification-bundle-redaction.the-canary-in-a-discovery-document-key-is-still-a-rejection-keys-are-evidence",
       "citations": [
@@ -7110,7 +7127,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.the-target-configuration-digest-is-a-digest-the-api-key-is-not-a-substring-of-an",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 178,
+      "line": 198,
       "title": "the target-configuration digest is a digest: the API key is not a substring of any string in the document",
       "explicitId": "openwop.it.certification-bundle-redaction.the-target-configuration-digest-is-a-digest-the-api-key-is-not-a-substring-of-an",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.10",
-  "corpusTag": "v2.0.10",
+  "version": "2.0.11",
+  "corpusTag": "v2.0.11",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "3417edc9197081b8854d60afd4758f84c86c53e2b9686012ed0f764b0c3150a7",
-    "api/v2/asyncapi.yaml": "bc2c53438cb143d2b98ba96f5470ca182017711715e66b2d00d1b9e797df3c41",
-    "api/v2/openapi.yaml": "a500508bf79ab2fe651ebc74e5fc5f30aaee2c1a6fc29fb7ae698e761e4c0696",
+    "api/seams-v2.yaml": "94727fc973ebe2ed2fbe54dfec1300bc56d23b27f6d5f248672b68926921d64e",
+    "api/v2/asyncapi.yaml": "8d8728a51cd6113cabb5c0ee700ddcae4b8232633f86024fcbbba5818d47ccc8",
+    "api/v2/openapi.yaml": "aa98fa0c2efc8dfede85f94113e900b4bec5432d3b679b8e574a8d01a061a22e",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c19060310025c9e5622cf5218f54da8e681c1e7dd84a89f7177aaea295d42a6a",
+    "spec/v1/core-standard-manifest.json": "ef8d7fe2710c243c6d2451720167d8da0bbbebb6fb0ee64a420a3efdc296d8fe",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -211,27 +211,27 @@
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "6cc9962c6b969f632e07a78b52a4f61447ff579e2990cbae989866f584a86042",
-    "spec/v2/README.md": "d7af039a68c81af57ac0a91521308f038c71608988edb196a34d9da9d9474f1e",
-    "spec/v2/core/capabilities.md": "95d1eee8d21e66c0c84591f2cf8bc81438bd39d7419f0ca67a589ec6e6cda4d1",
-    "spec/v2/core/conformance.md": "c235144f9a83bd5fcc9d15998e480970f5ac05ea9e57fc0036abe3a21f3d2016",
-    "spec/v2/core/connection-packs.md": "4b3fb729d94842000f0af91e2dcc6f163a910a37de41f3ac07dfcfb03179c3f1",
-    "spec/v2/core/errors.md": "f2ca092dce5d599111c28fb58638a82cc46807a1cefc38e65df454d3f133334e",
-    "spec/v2/core/events.md": "6f76e236b345e0c2a20e5b33e8230ebb73b8d20559fcc67a1c47041b6c633f87",
-    "spec/v2/core/form-content-packs.md": "eb84cda14d567c3d6a81d1806566b7fb20b70cf85bdc534183bf66529e213179",
-    "spec/v2/core/headers.md": "7e522187bac1de477ede8071d2241f8baca6df0909b20b09b01748e618a33685",
-    "spec/v2/core/idempotency.md": "ed6981d0021b101c244d2d4d2222d72bf01ceb6e12622c9b720d4e120c29bd47",
-    "spec/v2/core/identity.md": "ea5a5626aa6189f7cb8949fe5404d213df19f9452b872fa1ed7f1e0449e889d4",
-    "spec/v2/core/interop.md": "4d3aa4aff637edd4f8ae064ac9fcbabb0d650d55b2a95a3a0b021a2e737df616",
-    "spec/v2/core/interrupt.md": "e456eb307d43121baf0f1b6c7d514f11f71c1f3fbd0f36ded99d8d804cf8ba49",
-    "spec/v2/core/overview.md": "7e9ec5f693f59f36139671138050c731abeb1b33eb262abe51554371e0c86991",
-    "spec/v2/core/packs.md": "c0a98373f5d10a1fbc6d6865d9068125eca8983b9bc5d45780776e010c4cf1b4",
-    "spec/v2/core/persistence.md": "fdfc2269ebf63972626654a6907c648aa9b231be65a54679930b6279dd12afeb",
-    "spec/v2/core/replay.md": "793e0256c3d7551e20ccaf9ff51990f1ac9db096508e80ff57dd1bbf9f89f7fb",
-    "spec/v2/core/runs.md": "7fe674de4c54a9f86f00c4fc0f3ff18ea191a2bdd9b048beafc2b93f97857fcc",
-    "spec/v2/core/security-defaults.md": "8bd0a3be854310bb7ec49c757e75914a0c9713e94db25193d5c158e1e3e04ac9",
-    "spec/v2/core/versioning.md": "9da951272cb11a7f66c4f294c8d6dca97408535ea16445cb63f1d9330ae2cdae",
-    "spec/v2/core/webhooks.md": "7a8a5c5eebe3226b5eacecfb222abd91d2e44a20eb201a15b36a7ffced2e1cde",
-    "spec/v2/core/workflow-chain-packs.md": "79f5ea4e52020531fd360868c12ebf0640c2e833f6b6fb207091a063130a68e5",
+    "spec/v2/README.md": "202d95478ebbc7eb5efd2c3016168054bc16b263085eadb42d132e50d80c2e40",
+    "spec/v2/core/capabilities.md": "fee5eb083ec5f6173c57e2673f4d5a264807f71ad00ef8847e51cefc552eea84",
+    "spec/v2/core/conformance.md": "dc42444698fdac31bdb8cb9de0c4d36b25ee770158b6e4bab59c67f19560fa35",
+    "spec/v2/core/connection-packs.md": "7f767bb12a39e737503625b163e088c432d2095c98a1040ae78044008101234f",
+    "spec/v2/core/errors.md": "b46467fe39cf87fb3514ae8d498939a61cd7df306e73eaf5112833a8b6afb740",
+    "spec/v2/core/events.md": "2f3aedf07e9267ff559cf48b106d433ce76d7ff1bb6fd5f4ddcaaa9edc3c0cb0",
+    "spec/v2/core/form-content-packs.md": "405486e105b6d3b0bf727317af3dfc91af06f727d5bdf8991c71ddeef61d9bae",
+    "spec/v2/core/headers.md": "882dfb34febcc669812c7cd1b0c640b6f40fc7a8e806cf49eef8d3ad1b8ec1c3",
+    "spec/v2/core/idempotency.md": "220faad1e01c49cd2f5ab4849c5cd276850a11213906de38caba96a72c132320",
+    "spec/v2/core/identity.md": "d2c87c8c59ac92cb1df1550afe910d069a21b6967a966c2d54b9c247a15646e9",
+    "spec/v2/core/interop.md": "54a0e2c8b4ada51d5fa37f3828777a1f0ccf67120af79fcfbfad4fab9e2fa9ba",
+    "spec/v2/core/interrupt.md": "c44bd714563224aa2c3806376a07b265017140be2643d7a3ac340198159ab36d",
+    "spec/v2/core/overview.md": "3fef48a6e5b2a6ba01b881d48a3b671d5345c33475d15555dae6946599c25eb9",
+    "spec/v2/core/packs.md": "00ea589b627f8027d39e4c99463530129815c973b437c8fbef1ad05d952051bf",
+    "spec/v2/core/persistence.md": "682f2bad8c87df8af021e276c02f502e3d1131465d332e960f46e5caa66dedf0",
+    "spec/v2/core/replay.md": "ebc4a530e583c31447e95457ca9a3f64e8a51d71ce838a66705b7ae88ee55ab7",
+    "spec/v2/core/runs.md": "de5ed935f86edb7f5f3aeb7ae1f714ec1b586786c0096773ef0f58514cbc7edb",
+    "spec/v2/core/security-defaults.md": "cf51b04fab31ef82376d08f33b5a62af9014be1e6db7240bf2493c37cf62d360",
+    "spec/v2/core/versioning.md": "e98bb5de4261f6fac71e22be9f3a5b5e88060ea2b6d1d88870e4af88b097801b",
+    "spec/v2/core/webhooks.md": "a1a32fb8f283f0bbc57cb35cdd5272b79657f1bb97df13a8f8daa232d06e8fc5",
+    "spec/v2/core/workflow-chain-packs.md": "004935d6776658d1c33d06fa4fe9aba40efae4a9ca1e5031d759316d3144adaf",
     "spec/v2/declaration.json": "bd8a1dcee899a4478ac96b52da6ee07e1cb5fce4465939ac32e19e52f4d5c6b2",
     "spec/v2/declaration.schema.json": "eac5f8080bd572f147bd57d0c4ac8ad73b14536d9236222490ae29a33b21e184",
     "spec/v2/errors.json": "f179414a92f30b5dadf26e9e57699649a67324bd7186d5287647d17605d137d3",
@@ -268,8 +268,8 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c866befad1b142734532a7bf987ead39497369ee50678b107c1a0c3f5fea6c6d",
+    "spec/v2/release.json": "5e98d2087cd69d3d2a7a6ab011c2f8ee6c86a7e3c98630267b6175d067f23649",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "203d6e8c285fc45875a3f1beca4f4812bb6bbb7e"
+  "corpusCommit": "2487cf4f9855684a4e874ec7cd8ad0a80b7b3ca6"
 }

package/src/cli.ts

@@ -663,13 +663,20 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       if (!vk || !vkId) { process.stderr.write('openwop-conformance --certify: --evidence-tier independent needs --verifier-key and --verifier-key-id (RFC 0168 §E.2)\n'); process.exit(2); }
       v3.verifierSignature = verifierSign(unsigned, vk, vkId);
     }
-    const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem]);
+    // The published keyId is never a secret, whichever variable carried it
+    // (evidenceSecretsFromEnv: the `_ID` exclusion is the rule, `except` is
+    // the belt for a host that names its env var differently).
+    const secrets3 = evidenceSecretsFromEnv(process.env, [apiKey, signingKeyPem], [keyId]);
     const scrubbed3 = scrubEvidence(v3, secrets3);
     const v3Out = scrubbed3.value as BundleV3;
     const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
     const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
     if (emitterDefects.length > 0) {
-      process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED self-verification (emitter defect):\n' + emitterDefects.map((r) => `  - [${r.kind}] ${r.detail}`).join('\n') + '\n');
+      // Keep the rejected bundle: a self-verification failure with nothing to
+      // inspect sent a host patching a scratch copy of this CLI to see it.
+      const rejectedPath = `${outPath}.rejected.json`;
+      writeFileSync(rejectedPath, `${JSON.stringify(v3Out, null, 2)}\n`);
+      process.stderr.write('openwop-conformance --certify: assembled v3 bundle FAILED self-verification (emitter defect):\n' + emitterDefects.map((r) => `  - [${r.kind}] ${r.detail}`).join('\n') + `\n  the rejected bundle is at ${rejectedPath} (NOT a certification artifact — do not check it in)\n`);
       process.exit(2);
     }
     const v3Schema = JSON.parse(readFileSync(join(SCHEMAS_DIR, 'v2', 'certification-bundle.schema.json'), 'utf8')) as Record<string, unknown>;

package/src/lib/certification-bundle-verify.ts

@@ -342,15 +342,32 @@ export function scrubEvidence<T>(value: T, secrets: readonly string[]): ScrubRes
  * The secrets a `--certify` run must keep out of its own evidence: the
  * credential it was handed, plus every `OPENWOP_*` environment value that
  * names a key/token/secret/password, plus the conformance canary.
+ *
+ * An *identifier* of a key is not the key. `OPENWOP_BUNDLE_SIGNING_KEY_ID`
+ * (and `_VERIFIER_KEY_ID`) name the public `keyId` RFC 0168 §E.2 requires the
+ * host to publish in `discovery.document.signingKeys[]`; matching them on
+ * `KEY` scrubbed that id out of the embedded document AFTER `discovery.sha256`
+ * was taken, so every host that passed the id by env failed its own bundle's
+ * self-verification (`discovery.document` ≠ `discovery.sha256`) — suites 2.0.8
+ * and 2.0.9, found by MyndHyve 2026-09-10 across three cuts; the same host had
+ * passed the day before by passing the id as a flag. Names ending in `_ID`
+ * are excluded, and a caller may name values that MUST stay visible (`except`)
+ * regardless of which variable carried them.
  */
-export function evidenceSecretsFromEnv(env: NodeJS.ProcessEnv, extra: readonly (string | undefined)[] = []): string[] {
+export function evidenceSecretsFromEnv(
+  env: NodeJS.ProcessEnv,
+  extra: readonly (string | undefined)[] = [],
+  except: readonly (string | undefined)[] = [],
+): string[] {
+  const keep = new Set(except.filter((s): s is string => s !== undefined && s.trim() !== ''));
   const out = new Set<string>();
   for (const [k, v] of Object.entries(env)) {
     if (!k.startsWith('OPENWOP_')) continue;
     if (!/(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/.test(k)) continue;
-    if (v !== undefined && v.trim() !== '') out.add(v);
+    if (/_ID$/.test(k)) continue; // a key's identifier is published, not secret
+    if (v !== undefined && v.trim() !== '' && !keep.has(v)) out.add(v);
   }
-  for (const s of extra) if (s !== undefined && s.trim() !== '') out.add(s);
+  for (const s of extra) if (s !== undefined && s.trim() !== '' && !keep.has(s)) out.add(s);
   out.add(CONFORMANCE_SECRET_CANARY);
   return [...out];
 }

package/src/scenarios/certification-bundle-redaction.test.ts

@@ -154,6 +154,26 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
     expect(secrets.sort(), req('openwop.it.certification-bundle-redaction.evidencesecretsfromenv-selects-openwop-key-token-secret-password-variables-the-h', 'RFC 0148 §C', 'evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary')).toEqual([API_KEY, 'k1', 'p1', 's1', 't1', CONFORMANCE_SECRET_CANARY].sort());
   });
 
+  it('evidenceSecretsFromEnv never scrubs a key IDENTIFIER: *_ID variables are excluded and `except` values stay visible whichever variable carried them', () => {
+    // Suites 2.0.8–2.0.10: OPENWOP_BUNDLE_SIGNING_KEY_ID matched on KEY and the
+    // published keyId was redacted out of discovery.document after its digest —
+    // three MyndHyve cuts failed self-verification on 2026-09-10 for this alone.
+    const env = {
+      OPENWOP_BUNDLE_SIGNING_KEY: '-----BEGIN PRIVATE KEY-----\nsecret\n-----END PRIVATE KEY-----',
+      OPENWOP_BUNDLE_SIGNING_KEY_ID: 'myndhyve-bundle-2026-09',
+      OPENWOP_BUNDLE_VERIFIER_KEY_ID: 'steward-verifier-1',
+      OPENWOP_API_KEY: 'k1',
+      OPENWOP_ODDLY_NAMED_KEY: 'published-key-id-in-a-secret-shaped-variable',
+    } as NodeJS.ProcessEnv;
+    const secrets = evidenceSecretsFromEnv(env, [], ['published-key-id-in-a-secret-shaped-variable']);
+    expect(secrets, req('openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed', 'RFC 0168 §E.2', 'the keyId a host publishes in discovery.document.signingKeys[] MUST survive evidence scrubbing — a *_ID variable is an identifier, not a secret')).not.toContain('myndhyve-bundle-2026-09');
+    expect(secrets).not.toContain('steward-verifier-1');
+    expect(secrets, req('openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed', 'RFC 0168 §E.2', 'a value the emitter names as `except` (the keyId it is about to publish) is never scrubbed, whichever variable carried it')).not.toContain('published-key-id-in-a-secret-shaped-variable');
+    expect(secrets).toContain('k1');
+    expect(secrets.some((s) => s.includes('BEGIN PRIVATE KEY'))).toBe(true);
+    expect(secrets).toContain(CONFORMANCE_SECRET_CANARY);
+  });
+
   it('verifyBundleV2 REJECTS a bundle carrying the conformance canary anywhere, and accepts the scrubbed twin', () => {
     const rs = rows();
     rs[1] = { ...(rs[1] as BundleV2Requirement), detail: `resolved ${CONFORMANCE_SECRET_CANARY} in plain text` };