@openwop/openwop-conformance 2.4.7 → 2.6.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.6.0] — 2026-09-18 — a relaxed profile cannot certify, and five corpus ids for the umbrella
+
+### Fixed
+
+- **`--certify` wrote `certified: true` for a profile carrying a relaxation.**
+  `security-defaults.md` §Relaxations and RFC 0173 §A.2 both say it MUST NOT.
+  The predicate had no relaxation term and parsed relaxations on the next line;
+  the emitter then excluded `relaxed-profile-certified` from its self-check and
+  exited 0, so only `--verify` disagreed with the shipped file. Relaxations are
+  now parsed first and folded into the verdict, matched exactly as the verifier
+  matches them.
+
+### Added
+
+- Five `src/coherence/` wrappers minting `openwop.requirement.0167.*`, so the v2
+  umbrella's falsifiability table stops passing rule 4 on zero ids. One spawns
+  `check-codemods.mjs --at-active`, which the merge gate never ran.
+- `apps/workflow-engine` added to the public-docs banned-pattern scan.
+
+## [2.5.0] — 2026-09-18 — `--verify`, for auditing a bundle you did not cut
+
+### Added
+
+- **`--verify <bundle> [--host-key <pem>]`** audits a certification bundle with
+  no host and no corpus clone. Exit `0` verified · `1` rejected · **`2` coherent
+  but NOT independently verified** · `3` not a bundle. Exit 2 is load-bearing:
+  without it, `--verify` with no key returns green and the program re-creates
+  the vacuous pass that bundle v3 exists to eliminate. The output states what
+  the command does NOT do — it never re-runs anything, so a host that measured
+  itself wrongly and signed the result verifies clean here.
+
 ## [2.4.7] — 2026-09-18 — schema examples are validated now
 
 **Why a patch.** No conformance code changes; the corpus version moves because

package/README.md

@@ -11,11 +11,21 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.4.7 @openwop/spec-artifacts@2.4.7
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.6.0 @openwop/spec-artifacts@2.6.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
 
+### Auditing someone else's bundle
+
+```bash
+npx @openwop/openwop-conformance --verify bundle-v3.json --host-key host.pub.pem
+```
+
+No host, no clone. Exit `0` verified · `1` rejected · **`2` coherent but not independently verified** · `3` not a bundle.
+
+Exit 2 is the one that matters: without `--host-key` the signature is unchecked, and a bundle that merely *hangs together* is not a bundle that has been *verified*. The command also prints what it does **not** do — it never re-runs anything, so a host that measured itself wrongly and signed the result verifies clean here. It audits an attestation, not a host.
+
 > **Spec:** [github.com/openwop/openwop](https://github.com/openwop/openwop) · See `CHANGELOG.md` below for release history.
 
 The suite is intentionally self-contained — it does NOT depend on the reference implementation. A spec-compliant server written in any language can run this suite against itself by spinning up its server, exporting the env vars, and running `npx vitest run`.
@@ -89,6 +99,8 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 
 | Variable                                  | Effect                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `OPENWOP_HOST_RELAXATIONS`                | Sets `host.relaxations[]` in the bundle. **It relaxes nothing in the suite** — it is your declaration that the HOST runs relaxed, and the suite cannot detect an undeclared one. A profile carrying a relaxation **cannot certify** (`security-defaults.md` §Relaxations, RFC 0173 §A.2), and since 2.6.0 the emitter enforces that rather than writing `certified: true` and leaving the contradiction to `--verify`. JSON array of `{obligation, durability, reason}`; `durability` is `session \| deployment \| persisted` — **not** `permanent`. Unparseable JSON exits 2; a wrong enum value exits 2 later, at schema validation. |
+| `OPENWOP_TARGET_MAJOR`                    | Selects the scenario lane. **Only the literal `"2"` selects major 2** — unlike `--target-major`, which validates and exits 2 on a bad value, the env var falls back to major 1 for `"1"`, `"3"`, `"two"` or empty. The runner and every vitest worker MUST see the same value: when they disagreed, the worker minted `openwop.floor.*` while the runner looked up `openwop.scenario.*`, producing a vacuous-pass emitter defect and **no bundle at all**. Prefer `--target-major`; set this only when driving `vitest` directly. |
 | `OPENWOP_REQUIRE_BEHAVIOR=true`           | Capability-gated scenarios (audit-log integrity, rate-limit envelope, multi-region idempotency, `configurableSchema`, webhook sig versioning, etc.) FAIL instead of skipping when the host doesn't advertise the profile. Lets a host claim "full coverage" mechanically. See [`coverage.md`](./coverage.md) §"Capability-gated scenarios".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `OPENWOP_TEST_PUBLIC_REGISTRY=true`       | Runs `registry-public.test.ts` against the hosted registry at `packs.openwop.dev`. Skipped by default so the suite doesn't depend on outbound connectivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `OPENWOP_OTEL_COLLECTOR=true`             | Boots the in-suite OTLP collector for `otel-emission.test.ts`, `otel-trace-propagation.test.ts`, `metric-emission.test.ts`, and `otel-emission-grpc.test.ts`. The collector accepts OTLP/HTTP-JSON (`application/json`), OTLP/HTTP-protobuf (`application/x-protobuf` — hand-rolled decoder at `src/lib/otlp-protobuf.ts`), and OTLP/gRPC (when `OPENWOP_OTEL_COLLECTOR_GRPC=true` — h2c HTTP/2 + hand-rolled framing at `src/lib/grpc-framing.ts`). Zero new npm deps. Hosts may emit via `OTEL_EXPORTER_OTLP_PROTOCOL=http/json`, `http/protobuf`, or `grpc`. Skipped by default. **Run OTel scenarios with `--no-file-parallelism`** — each vitest worker spawns its own collector and only one can bind the same port, so concurrent file execution causes ephemeral-port fallbacks that don't receive the host's OTLP traffic. |

package/dist/cli.js

@@ -62,6 +62,7 @@ function parseArgs(argv) {
     let bundleVersion = '3';
     let hostBuild;
     let evidenceTier = 'self';
+    let verifyPath, verifyHostKeyPath;
     let signingKeyPath, signingKeyId, verifierKeyPath, verifierKeyId;
     let targetMajor;
     let maxWorkers = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
@@ -169,6 +170,12 @@ function parseArgs(argv) {
             // `OPENWOP_REQUIRE_BEHAVIOR=true` did anything. So a cut that named the
             // flag measured the LOOSE answer and reported the strict one — the exact
             // failure shape the runbook warns about, in the tool that measures it.
+            case '--verify':
+                verifyPath = nextValue();
+                break;
+            case '--host-key':
+                verifyHostKeyPath = nextValue();
+                break;
             case '--require-behavior':
                 process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
                 break;
@@ -202,6 +209,8 @@ function parseArgs(argv) {
         verifierKeyPath,
         verifierKeyId,
         maxWorkers,
+        verifyPath,
+        verifyHostKeyPath,
     };
 }
 /** Parse a `--max-workers` / `OPENWOP_MAX_WORKERS` value: a positive integer, else exit 2. */
@@ -260,6 +269,17 @@ Certification (RFC 0089):
                         to <out.json>. Requires --base-url (and --api-key as usual).
 
 Other:
+  --verify <bundle>     Audit a certification bundle WITHOUT a host. Exit codes:
+                          0  verified — no rejections, host signature checked,
+                             certified list re-derived from the bundle's own
+                             discovery document
+                          1  rejected — one or more problems, each printed
+                          2  coherent but NOT independently verified (no
+                             --host-key, or the certified list is the emitter's
+                             word). Do not quote this as "verified"
+                          3  the file is missing or is not a bundle
+  --host-key <pem>      The key --verify checks the host signature under. Without
+                        it the signature is unverified and --verify exits 2.
   --require-behavior    Strict mode: an ADVERTISED behaviour that cannot be
                         observed FAILS instead of soft-skipping (RFC 0148 §B).
                         Equivalent to OPENWOP_REQUIRE_BEHAVIOR=true.
@@ -620,7 +640,16 @@ async function runCertify(args, baseUrl, apiKey) {
         // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide
         // blocked rule). Until rc.45 it was `!notHeld && !rejected && blocked === 0`
         // and never read `certifiable` — an empty v2 floor certified on no evidence.
-        const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+        // Relaxations are parsed BEFORE the verdict, because they are part of it.
+        // `security-defaults.md` §Relaxations is explicit: "A bundle that records a
+        // relaxation MUST NOT certify the profile the relaxed obligation belongs to"
+        // (RFC 0173 §A.2). The emitter computed `certified` with no relaxation term —
+        // and parsed relaxations on the NEXT line, so it was structurally impossible
+        // for one to affect the verdict — then excluded `relaxed-profile-certified`
+        // from its own self-check. The shipped artifact asserted `certified: true`
+        // for a profile that cannot certify, and only `--verify` disagreed with the
+        // file. A reader who parses `.certified` — the obvious thing to do — got the
+        // wrong answer.
         let relaxations;
         if (process.env['OPENWOP_HOST_RELAXATIONS']) {
             try {
@@ -631,6 +660,12 @@ async function runCertify(args, baseUrl, apiKey) {
                 process.exit(2);
             }
         }
+        // RFC 0173 §A.2: a recorded relaxation denies the profile its obligation
+        // belongs to. Matched the same way the verifier matches it, so the emitter
+        // and `verifyBundleV3` cannot disagree about the same bundle.
+        const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
+        const relaxedProfile = (p) => [...relaxedObligations].some((o) => p.includes(o));
+        const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
         const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
         const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : undefined;
         const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
@@ -668,7 +703,10 @@ async function runCertify(args, baseUrl, apiKey) {
         const scrubbed3 = scrubEvidence(v3, secrets3);
         const v3Out = scrubbed3.value;
         const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
-        const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
+        // `relaxed-profile-certified` is no longer excused: the emitter now computes
+        // the relaxation into `certified`, so if the verifier still finds that
+        // contradiction the bundle is genuinely malformed and MUST NOT be written.
+        const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'independent-unverifiable'].includes(r.kind));
         if (emitterDefects.length > 0) {
             // Keep the rejected bundle: a self-verification failure with nothing to
             // inspect sent a host patching a scratch copy of this CLI to see it.
@@ -811,6 +849,79 @@ async function main() {
         process.stdout.write(HELP_TEXT);
         process.exit(0);
     }
+    // `--verify <bundle.json>` — audit a bundle WITHOUT a host and without cloning
+    // the corpus. `verifyBundleV3` was exported but only ever called as the
+    // emitter's self-check, so auditing a third party's certification claim meant
+    // writing a driver script — which means in practice nobody did, and a
+    // certification program whose verifier ships only as a library function is
+    // asking to be taken on trust.
+    //
+    // The exit contract has FOUR values on purpose. "Structurally coherent" and
+    // "verified" are different facts, and collapsing them is how the vacuous pass
+    // gets rebuilt: without exit 2, every CI that runs `--verify` with no key
+    // prints green and reports "verified".
+    if (args.verifyPath !== undefined) {
+        if (!existsSync(args.verifyPath)) {
+            process.stderr.write(`openwop-conformance --verify: no such file: ${args.verifyPath}\n`);
+            process.exit(3);
+        }
+        let bundle;
+        try {
+            bundle = JSON.parse(readFileSync(args.verifyPath, 'utf8'));
+        }
+        catch (e) {
+            process.stderr.write(`openwop-conformance --verify: ${args.verifyPath} is not readable JSON — ${e.message}\n`);
+            process.exit(3);
+        }
+        const hostKey = args.verifyHostKeyPath !== undefined ? readFileSync(args.verifyHostKeyPath, 'utf8') : undefined;
+        const verifierKey = args.verifierKeyPath !== undefined ? readFileSync(args.verifierKeyPath, 'utf8') : undefined;
+        const verdict = verifyBundleV3(bundle, {
+            ...(hostKey !== undefined ? { hostPublicKeyPem: hostKey } : {}),
+            ...(verifierKey !== undefined ? { verifierPublicKeyPem: verifierKey } : {}),
+        });
+        const t = bundle.results?.totals ?? {};
+        const out = [
+            `bundle:    ${args.verifyPath}`,
+            `host:      ${bundle.host?.name ?? '?'} build ${bundle.host?.build?.kind ?? '?'}:${String(bundle.host?.build?.id ?? '?').slice(0, 12)}`,
+            `suite:     ${bundle.suite?.version ?? '?'} (this CLI is ${suiteVersion()})`,
+            `totals:    executedPass=${t.executedPass ?? '?'} executedFail=${t.executedFail ?? '?'} blocked=${t.blocked ?? '?'} inapplicable=${t.inapplicable ?? '?'} skipped=${t.skipped ?? '?'}`,
+            `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
+            '',
+            'What this command does NOT do:',
+            '  · It does not re-run anything. A host that measured itself wrongly, and signed',
+            '    the result, verifies clean here. This audits an attestation, not a host.',
+            '  · It does not resolve keyId against the live host. It checks the signature under',
+            '    the key YOU supply with --host-key; it cannot tell you that key is the host\u2019s.',
+            '  · It does not judge suite currency. The suite version is reported above as data:',
+            '    an older bundle measured less, and whose fact that is belongs to its emitter.',
+            '',
+        ];
+        if (verdict.rejections.length > 0) {
+            out.push(`REJECTED \u2014 ${verdict.rejections.length} problem(s):`);
+            for (const r of verdict.rejections)
+                out.push(`  [${r.kind}]${r.profile ? ` (${r.profile})` : ''} ${r.detail}`);
+            process.stdout.write(out.join('\n') + '\n');
+            process.exit(1);
+        }
+        const gaps = [];
+        if (!verdict.signatureVerified)
+            gaps.push('the host signature was NOT verified (no --host-key supplied)');
+        if (!verdict.derivabilityChecked)
+            gaps.push('the certified list was NOT re-derived from the bundle\u2019s discovery document \u2014 it is the emitter\u2019s word');
+        if ((bundle.claimedProfiles ?? []).some((p) => p.evidenceTier === 'independent') && !verdict.verifierSignatureVerified)
+            gaps.push('an `independent` tier is claimed but the verifier signature was NOT verified (no --verifier-key)');
+        if (gaps.length > 0) {
+            out.push('COHERENT, NOT INDEPENDENTLY VERIFIED \u2014 zero rejections, but:');
+            for (const g of gaps)
+                out.push(`  \u00b7 ${g}`);
+            out.push('', 'Do not quote this as "verified". Exit 2 exists to keep that distinction.');
+            process.stdout.write(out.join('\n') + '\n');
+            process.exit(2);
+        }
+        out.push('VERIFIED \u2014 zero rejections, host signature checked, certified list re-derived.');
+        process.stdout.write(out.join('\n') + '\n');
+        process.exit(0);
+    }
     // Env vars OVERRIDE flags only when the flag was unset (consistent
     // with the rest of the harness — env wins on the absence of CLI input).
     const env = { ...process.env };

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.4.7",
-  "stampSha256": "6e8184e89578f988554805cf61423b656f7d1b9b0d1f7454513962c77547d7ad"
+  "version": "2.6.0",
+  "stampSha256": "68531a1a3ebfe85e53f55273ab72f627ab8730218fd8557395633bef0a0c8338"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.4.7",
+  "version": "2.6.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.4.7"
+    "@openwop/spec-artifacts": "2.6.0"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 571,
-    "tests": 2174,
-    "withStableId": 2174,
+    "files": 576,
+    "tests": 2179,
+    "withStableId": 2179,
     "interpolatedTitles": 0,
-    "explicitIds": 2127
+    "explicitIds": 2132
   },
   "records": [
     {
@@ -35390,7 +35390,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.scans-public-docs-and-schemas",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1397,
+      "line": 1406,
       "title": "scans public docs and schemas",
       "explicitId": "openwop.it.spec-corpus-validity.scans-public-docs-and-schemas",
       "citations": [
@@ -35403,7 +35403,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.has-no-private-implementation-or-pre-v1-breadcrumbs",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1403,
+      "line": 1412,
       "title": null,
       "explicitId": "openwop.it.spec-corpus-validity.has-no-private-implementation-or-pre-v1-breadcrumbs",
       "citations": [
@@ -35417,7 +35417,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-fixture-id-mentioned-in-fixtures-md-has-a-corresponding-json",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1432,
+      "line": 1441,
       "title": "every fixture id mentioned in fixtures.md has a corresponding JSON",
       "explicitId": "openwop.it.spec-corpus-validity.every-fixture-id-mentioned-in-fixtures-md-has-a-corresponding-json",
       "citations": [
@@ -35431,7 +35431,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.every-fixture-json-file-is-referenced-by-fixtures-md",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1474,
+      "line": 1483,
       "title": "every fixture JSON file is referenced by fixtures.md",
       "explicitId": "openwop.it.spec-corpus-validity.every-fixture-json-file-is-referenced-by-fixtures-md",
       "citations": [
@@ -35445,7 +35445,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.a-sample-bundle-validates-against-conformance-certification-bundle-schema-json",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1527,
+      "line": 1536,
       "title": "a sample bundle validates against conformance-certification-bundle.schema.json",
       "explicitId": "openwop.it.spec-corpus-validity.a-sample-bundle-validates-against-conformance-certification-bundle-schema-json",
       "citations": [
@@ -35459,7 +35459,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-accepts-a-claim-that-is-discovery-derivable-and-floor-proven-b",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1533,
+      "line": 1542,
       "title": "verifyBundle ACCEPTS a claim that is discovery-derivable AND floor-proven (§B)",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-accepts-a-claim-that-is-discovery-derivable-and-floor-proven-b",
       "citations": [
@@ -35472,7 +35472,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-profile-its-discovery-document-does-not-derive-b-1",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1540,
+      "line": 1549,
       "title": "verifyBundle REJECTS a profile its discovery document does not derive (§B(1))",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-profile-its-discovery-document-does-not-derive-b-1",
       "citations": [
@@ -35485,7 +35485,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-bundle-missing-a-floor-scenario-b-2",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1550,
+      "line": 1559,
       "title": "verifyBundle REJECTS a bundle missing a floor scenario (§B(2))",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-a-bundle-missing-a-floor-scenario-b-2",
       "citations": [
@@ -35498,7 +35498,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-committed-bundle-file-exists-generated-by-certify",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1587,
+      "line": 1596,
       "title": "the committed bundle file exists (generated by --certify)",
       "explicitId": "openwop.it.spec-corpus-validity.the-committed-bundle-file-exists-generated-by-certify",
       "citations": [
@@ -35512,7 +35512,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-committed-reference-bundle-validates-against-the-bundle-schema-a",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1591,
+      "line": 1600,
       "title": "the committed reference bundle validates against the bundle schema (§A)",
       "explicitId": "openwop.it.spec-corpus-validity.the-committed-reference-bundle-validates-against-the-bundle-schema-a",
       "citations": [
@@ -35526,7 +35526,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.verifybundle-rejects-the-committed-reference-bundle-it-is-invalidated-rfc-0148-d",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1598,
+      "line": 1607,
       "title": "verifyBundle REJECTS the committed reference bundle — it is `invalidated` (RFC 0148 §D)",
       "explicitId": "openwop.it.spec-corpus-validity.verifybundle-rejects-the-committed-reference-bundle-it-is-invalidated-rfc-0148-d",
       "citations": [
@@ -35547,7 +35547,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.discovery-sha256-is-the-canonical-json-sha-256-of-the-captured-discovery-documen",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1624,
+      "line": 1633,
       "title": "discovery.sha256 is the canonical-JSON SHA-256 of the captured discovery.document",
       "explicitId": "openwop.it.spec-corpus-validity.discovery-sha256-is-the-canonical-json-sha-256-of-the-captured-discovery-documen",
       "citations": [
@@ -35560,7 +35560,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.the-requestbody-closes-at-the-composition-unevaluatedproperties-not-inside-a-bra",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1685,
+      "line": 1694,
       "title": "the requestBody closes at the composition (unevaluatedProperties), not inside a branch",
       "explicitId": "openwop.it.spec-corpus-validity.the-requestbody-closes-at-the-composition-unevaluatedproperties-not-inside-a-bra",
       "citations": [
@@ -35573,7 +35573,7 @@
     {
       "id": "openwop.it.spec-corpus-validity.canonical-createrun-bodies-pass-the-composed-schema-an-undeclared-property-fails",
       "file": "spec-corpus-validity.test.ts",
-      "line": 1700,
+      "line": 1709,
       "title": "canonical createRun bodies PASS the composed schema; an undeclared property FAILS",
       "explicitId": "openwop.it.spec-corpus-validity.canonical-createrun-bodies-pass-the-composed-schema-an-undeclared-property-fails",
       "citations": [
@@ -36221,6 +36221,81 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-umbrella-alias-covered.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-alias-covered.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.alias-covered",
+      "citations": [
+        {
+          "section": "RFC 0167 §E.2",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-child-parts.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-child-parts.test.ts",
+      "line": 33,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.child-parts",
+      "citations": [
+        {
+          "section": "RFC 0167 §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0167 §C",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-codemod-at-active.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-codemod-at-active.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.codemod-at-active",
+      "citations": [
+        {
+          "section": "RFC 0167 §D.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-codemod-legs.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-codemod-legs.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.codemod-legs",
+      "citations": [
+        {
+          "section": "RFC 0167 §D.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-umbrella-migration-deprecation.the-corpus-gate-script-exits-0",
+      "file": "v2-umbrella-migration-deprecation.test.ts",
+      "line": 32,
+      "title": "the corpus gate script exits 0",
+      "explicitId": "openwop.requirement.0167.migration-deprecation-bound",
+      "citations": [
+        {
+          "section": "RFC 0167 §D.1",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-witness-required.the-corpus-gate-script-exits-0",
       "file": "v2-witness-required.test.ts",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.4.7",
-  "corpusTag": "v2.4.7",
+  "version": "2.6.0",
+  "corpusTag": "v2.6.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "ea8ac475df166b0c3ad47268819020eb247bb4d24a78798c5ffa725a91fefe78",
-    "api/v2/asyncapi.yaml": "6ad6a2c8415f26542fd7b9e0871457bbbfb910486faa50e982583a388651c48e",
-    "api/v2/openapi.yaml": "4a6d428b18eb95cd312d39944300714359e682513b8602e6ac7198fbfe7f46e4",
+    "api/seams-v2.yaml": "7f6637d38e3c4e6abd26486045250e49510e47f88c369d182c4c58f9100e641b",
+    "api/v2/asyncapi.yaml": "8cbc0edc6dbf62726ff48e1a1d5f6ac90e2eecee42b005ab5b3d093aa2d11f81",
+    "api/v2/openapi.yaml": "ea0138814ca4766e2575ab5964ff03c7dba0a41ba7041897f5f1d1ac5808680b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -116,7 +116,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "fa9b80a9107fc322ecadbac808e7fbe5e16ccf0af1a6bf673181faa8379dde33",
-    "schemas/v2/certification-bundle.schema.json": "d2cbc5cadddff13630a528dc9673162f582c035c6a6663ca02c1ac53e8fec40c",
+    "schemas/v2/certification-bundle.schema.json": "0bcf8f297266505ca39d30eea8100e3c0fb048f2651717fd746da8129fcb7920",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "8df0d9d273ae22efc6876d5586833f1d4c2e551edc3ac6cf6e8f0719329f03dd",
@@ -200,7 +200,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "e90916db12d2297e2e560b2d54d2c4702d6cb3bef7179a575844687a7ec17262",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "2d78ebddc7b5142cefd5c2314bfee1502e7b3b6823cdeaf96fe2820cd82ee544",
+    "spec/v1/core-standard-manifest.json": "de1f6bd9dc3f602b6893d66cbfb79a055457e18d0be5ff70a2611ee69f672727",
     "spec/v1/deprecations.json": "c81c8f71460936c8d489d8270477c7661cf4a5d7b7bad86c98899750b5656027",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -213,26 +213,26 @@
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "eb3bfcb9c7d05c9a6845d4a40ec9493cfaa5a671932daf1af561310136fdabe8",
     "spec/v2/README.md": "5d49f56f41e06b44312c61ad8144b786c9a90ec42fd0660a40d89520ef206137",
-    "spec/v2/core/capabilities.md": "c5107a4964e487c20bbb5254cfe1f706e0d9ba7e34da9070bc43b50b385e7948",
-    "spec/v2/core/conformance.md": "b8d7dae142e3708a7597533cb77827363b6cfc91b89538081a9afe5e23c975f4",
-    "spec/v2/core/connection-packs.md": "1d759681e2962f5103228c52c45f24607ed4bb9ae73e30605f690c1d5a59e9ee",
-    "spec/v2/core/errors.md": "ad85fc830139e587f20deabf88297b91b1fb6ce31e80d5442624a650246ab16e",
-    "spec/v2/core/events.md": "f1bac16419740f3b722febb6f5caaabed8838e092cba3d080fe9184024049dcf",
-    "spec/v2/core/form-content-packs.md": "6ffaae85d4550be48dd53fb6e2959af8aceb35bd87c5343b722885084f197713",
-    "spec/v2/core/headers.md": "6d56dca18fc5dfe3870a40863247a33f57bba3dad624200e9cf9fa9358df90b9",
-    "spec/v2/core/idempotency.md": "b86c352d964aebad532727f314e26ed2177d49de382076fa64d3162e2f56118d",
-    "spec/v2/core/identity.md": "9d2b823eb899463807452fe5721dcf09881837c161be024175957db27870b243",
-    "spec/v2/core/interop.md": "d4c404e469e1d9d9be88bc2c939d777e7d7c1d0419b1251c18770f039838a401",
-    "spec/v2/core/interrupt.md": "548c7a7bdfcab56db33dfad3d397cae2ed5f9828a63418021936eb392395e3e4",
-    "spec/v2/core/overview.md": "69377c90bbb87b6bfe4b8be4f1b65810094b0759c8d4f93ca6df92cc530ea023",
-    "spec/v2/core/packs.md": "8b3e1587270bb1aec814befbd287181a05b7f76aeb0802787ee7ebdc85901205",
-    "spec/v2/core/persistence.md": "898dc929d021a03d245691148fe4fdec4582b4faa9237aa32037bbd3a2993b7d",
-    "spec/v2/core/replay.md": "bd191a2565aa7ad0df9b35a0716f3de53be34b8722f1807c5e5b02859404a9b9",
-    "spec/v2/core/runs.md": "f7a95fc82fda5b7c0c613de6e5edd376bbd6d8ba4c665a500c94eacbe42b86f2",
-    "spec/v2/core/security-defaults.md": "d69a8dfc9057e189caa61f14810e3090b3b053e8fde419d09db84729a42b84c7",
-    "spec/v2/core/versioning.md": "fd6564879cf043b68338db20b20de93755a1e7147000afb4738c07770deeddaf",
-    "spec/v2/core/webhooks.md": "969c367650e5e93beb090242bcbec59f43b95bdf646fa6c512f6c7fa1f05912e",
-    "spec/v2/core/workflow-chain-packs.md": "ef2b07d2d99334eaec0cc370314e2ad2f84ea58deb699e5d92e6e52d6056613f",
+    "spec/v2/core/capabilities.md": "35696991582729c86b5760f292251734e37cee45398fa5179764cefa5a91037f",
+    "spec/v2/core/conformance.md": "a451c0a2ba79d93c55e540ccef480eba7de9602d59bbb03eead05daafde0beac",
+    "spec/v2/core/connection-packs.md": "2e53c92476f68304139faf0c370874dc27bbba56a127a07e0906ff06edbb8ff1",
+    "spec/v2/core/errors.md": "c3ac131dff970ab7574629d72735ace52cc56cd4a7ab5d1206ce91f382bc9a68",
+    "spec/v2/core/events.md": "6ab8c727df3ebc5a60de3837c82a0075b4357d6f7e28435c6f80585687d41a76",
+    "spec/v2/core/form-content-packs.md": "d4c5295dfd28972be205c87c34d0d34ced64f4a2561ebff7f9d24b436d83df25",
+    "spec/v2/core/headers.md": "6c5eb48d998c141b5f0cb61fea926833a072748fdc4034e1a90a4dfe5448659c",
+    "spec/v2/core/idempotency.md": "803cd85947b1b2151cd2fb42cf0e0c52c9bcd19cdc6c23dcf34b1eddc600921a",
+    "spec/v2/core/identity.md": "ae24870df315b527dfe9ecf7a4c26582bcc1113da7954f44acf69bf463ac390d",
+    "spec/v2/core/interop.md": "8d8f4b040cb3625044c6aa586c8dcf5e9d15797de3d3b1cea631f44b8924701c",
+    "spec/v2/core/interrupt.md": "bdb2879a52a2504d84146e46108c4a4c2dd3a6f27865a295c80375b331cced21",
+    "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
+    "spec/v2/core/packs.md": "3254fd060c2b690cea70ef2b1b1a119711bb04fb5f13bf8936d4d718df9b2322",
+    "spec/v2/core/persistence.md": "e75c6d8cc6a31747f8559931c420ed0debbdec16ae01fed28df5aa79a51e5899",
+    "spec/v2/core/replay.md": "dee513b6ca313a0647c853e713af94a3e077f3e58f71851ddb0ef8adcb3b0afe",
+    "spec/v2/core/runs.md": "b4c0bb2869077fcbf26e15bc6bbac06819f68b8241944b903a275a37db1c71fa",
+    "spec/v2/core/security-defaults.md": "9ab1d1a88ccd0929f354422b151ec6d3164e8cd3784f8e58bb6f11cb7ee1e7d5",
+    "spec/v2/core/versioning.md": "27b88cde88f9060567ef7e46f4897b6be8892ade9f4a46c2ab16e314c515eabd",
+    "spec/v2/core/webhooks.md": "ecec4d22a35aeafd34276bb0579ae28610e79ab8850ebf42188cb51bc946a093",
+    "spec/v2/core/workflow-chain-packs.md": "26bb65721f826285b7d90c3cb62fa7e9fb2414c1bc6e0fd25b33209168c3102e",
     "spec/v2/declaration.json": "a09bac61c1b825e4a77b5abc0f86f1f8c20c381e0650eb08c2f6d0ef0aaec1dc",
     "spec/v2/declaration.schema.json": "c86e3083fb9789c1958ecb4576cc6f71aa90e6f339521139238543ed08211dd4",
     "spec/v2/errors.json": "4ff032033f02d7e3fb4204581456408ba5e7642b438c1f349bbd1c264e63e419",
@@ -271,8 +271,8 @@
     "spec/v2/path-manifest.json": "a6f4e652e866889e8bde815874062f62929aee95dc8e58e7152c56adee262163",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "5452e872bc486fbf8aa970e8cd42333c05a48c31422ceb858f5142dbc30181a6",
+    "spec/v2/release.json": "2c0e277e6ef93e5f439947c546f3ec10696d1f3a7235dedaf5d6973954d1652d",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "bbdafa8e3a46a3c26d8fa0280d3fb541f9993d84"
+  "corpusCommit": "dff4852f36271da77a30a88494cde1e027199d7c"
 }

package/src/cli.ts

@@ -75,6 +75,10 @@ interface ParsedArgs {
   readonly signingKeyPath: string | undefined;
   readonly signingKeyId: string | undefined;
   readonly verifierKeyPath: string | undefined;
+  /** `--verify <bundle.json>` — audit a bundle someone else cut, without cloning the corpus. */
+  readonly verifyPath: string | undefined;
+  /** `--host-key <pem>` — the key `--verify` checks the host signature under. Absent ⇒ the verdict is INCOMPLETE, not clean. */
+  readonly verifyHostKeyPath: string | undefined;
   readonly verifierKeyId: string | undefined;
   /**
    * S43 (2026-08-18) — cap on concurrently running scenario FILES, forwarded to
@@ -100,6 +104,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let bundleVersion: '2' | '3' = '3';
   let hostBuild: ParsedArgs['hostBuild'];
   let evidenceTier: ParsedArgs['evidenceTier'] = 'self';
+  let verifyPath: string | undefined, verifyHostKeyPath: string | undefined;
   let signingKeyPath: string | undefined, signingKeyId: string | undefined, verifierKeyPath: string | undefined, verifierKeyId: string | undefined;
   let targetMajor: 1 | 2 | undefined;
   let maxWorkers: number | undefined = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
@@ -187,6 +192,12 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       // `OPENWOP_REQUIRE_BEHAVIOR=true` did anything. So a cut that named the
       // flag measured the LOOSE answer and reported the strict one — the exact
       // failure shape the runbook warns about, in the tool that measures it.
+      case '--verify':
+        verifyPath = nextValue();
+        break;
+      case '--host-key':
+        verifyHostKeyPath = nextValue();
+        break;
       case '--require-behavior':
         process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
         break;
@@ -223,6 +234,8 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     verifierKeyPath,
     verifierKeyId,
     maxWorkers,
+    verifyPath,
+    verifyHostKeyPath,
   };
 }
 
@@ -283,6 +296,17 @@ Certification (RFC 0089):
                         to <out.json>. Requires --base-url (and --api-key as usual).
 
 Other:
+  --verify <bundle>     Audit a certification bundle WITHOUT a host. Exit codes:
+                          0  verified — no rejections, host signature checked,
+                             certified list re-derived from the bundle's own
+                             discovery document
+                          1  rejected — one or more problems, each printed
+                          2  coherent but NOT independently verified (no
+                             --host-key, or the certified list is the emitter's
+                             word). Do not quote this as "verified"
+                          3  the file is missing or is not a bundle
+  --host-key <pem>      The key --verify checks the host signature under. Without
+                        it the signature is unverified and --verify exits 2.
   --require-behavior    Strict mode: an ADVERTISED behaviour that cannot be
                         observed FAILS instead of soft-skipping (RFC 0148 §B).
                         Equivalent to OPENWOP_REQUIRE_BEHAVIOR=true.
@@ -653,9 +677,24 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide
     // blocked rule). Until rc.45 it was `!notHeld && !rejected && blocked === 0`
     // and never read `certifiable` — an empty v2 floor certified on no evidence.
-    const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+    // Relaxations are parsed BEFORE the verdict, because they are part of it.
+    // `security-defaults.md` §Relaxations is explicit: "A bundle that records a
+    // relaxation MUST NOT certify the profile the relaxed obligation belongs to"
+    // (RFC 0173 §A.2). The emitter computed `certified` with no relaxation term —
+    // and parsed relaxations on the NEXT line, so it was structurally impossible
+    // for one to affect the verdict — then excluded `relaxed-profile-certified`
+    // from its own self-check. The shipped artifact asserted `certified: true`
+    // for a profile that cannot certify, and only `--verify` disagreed with the
+    // file. A reader who parses `.certified` — the obvious thing to do — got the
+    // wrong answer.
     let relaxations: BundleV3['host']['relaxations'];
     if (process.env['OPENWOP_HOST_RELAXATIONS']) { try { relaxations = JSON.parse(process.env['OPENWOP_HOST_RELAXATIONS']) as BundleV3['host']['relaxations']; } catch { process.stderr.write('openwop-conformance --certify: OPENWOP_HOST_RELAXATIONS is not JSON\n'); process.exit(2); } }
+    // RFC 0173 §A.2: a recorded relaxation denies the profile its obligation
+    // belongs to. Matched the same way the verifier matches it, so the emitter
+    // and `verifyBundleV3` cannot disagree about the same bundle.
+    const relaxedObligations = new Set((relaxations ?? []).map((r) => r.obligation));
+    const relaxedProfile = (p: string): boolean => [...relaxedObligations].some((o) => p.includes(o));
+    const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !relaxedProfile(p) && (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
     const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
     const lock = existsSync(lockPath) ? (JSON.parse(readFileSync(lockPath, 'utf8')) as { version: string; stampSha256: string }) : undefined;
     const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
@@ -690,7 +729,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     const scrubbed3 = scrubEvidence(v3, secrets3);
     const v3Out = scrubbed3.value as BundleV3;
     const audit3 = verifyBundleV3(v3Out, { hostPublicKeyPem: publicKeyFromPrivate(signingKeyPem) });
-    const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'relaxed-profile-certified', 'independent-unverifiable'].includes(r.kind));
+    // `relaxed-profile-certified` is no longer excused: the emitter now computes
+    // the relaxation into `certified`, so if the verifier still finds that
+    // contradiction the bundle is genuinely malformed and MUST NOT be written.
+    const emitterDefects = audit3.rejections.filter((r) => !['blocked-certified', 'independent-unverifiable'].includes(r.kind));
     if (emitterDefects.length > 0) {
       // Keep the rejected bundle: a self-verification failure with nothing to
       // inspect sent a host patching a scratch copy of this CLI to see it.
@@ -861,6 +903,74 @@ async function main(): Promise<never> {
     process.exit(0);
   }
 
+  // `--verify <bundle.json>` — audit a bundle WITHOUT a host and without cloning
+  // the corpus. `verifyBundleV3` was exported but only ever called as the
+  // emitter's self-check, so auditing a third party's certification claim meant
+  // writing a driver script — which means in practice nobody did, and a
+  // certification program whose verifier ships only as a library function is
+  // asking to be taken on trust.
+  //
+  // The exit contract has FOUR values on purpose. "Structurally coherent" and
+  // "verified" are different facts, and collapsing them is how the vacuous pass
+  // gets rebuilt: without exit 2, every CI that runs `--verify` with no key
+  // prints green and reports "verified".
+  if (args.verifyPath !== undefined) {
+    if (!existsSync(args.verifyPath)) {
+      process.stderr.write(`openwop-conformance --verify: no such file: ${args.verifyPath}\n`);
+      process.exit(3);
+    }
+    let bundle: BundleV3;
+    try {
+      bundle = JSON.parse(readFileSync(args.verifyPath, 'utf8')) as BundleV3;
+    } catch (e) {
+      process.stderr.write(`openwop-conformance --verify: ${args.verifyPath} is not readable JSON — ${(e as Error).message}\n`);
+      process.exit(3);
+    }
+    const hostKey = args.verifyHostKeyPath !== undefined ? readFileSync(args.verifyHostKeyPath, 'utf8') : undefined;
+    const verifierKey = args.verifierKeyPath !== undefined ? readFileSync(args.verifierKeyPath, 'utf8') : undefined;
+    const verdict = verifyBundleV3(bundle, {
+      ...(hostKey !== undefined ? { hostPublicKeyPem: hostKey } : {}),
+      ...(verifierKey !== undefined ? { verifierPublicKeyPem: verifierKey } : {}),
+    });
+    const t = bundle.results?.totals ?? {};
+    const out: string[] = [
+      `bundle:    ${args.verifyPath}`,
+      `host:      ${bundle.host?.name ?? '?'} build ${bundle.host?.build?.kind ?? '?'}:${String(bundle.host?.build?.id ?? '?').slice(0, 12)}`,
+      `suite:     ${bundle.suite?.version ?? '?'} (this CLI is ${suiteVersion()})`,
+      `totals:    executedPass=${t.executedPass ?? '?'} executedFail=${t.executedFail ?? '?'} blocked=${t.blocked ?? '?'} inapplicable=${t.inapplicable ?? '?'} skipped=${t.skipped ?? '?'}`,
+      `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
+      '',
+      'What this command does NOT do:',
+      '  · It does not re-run anything. A host that measured itself wrongly, and signed',
+      '    the result, verifies clean here. This audits an attestation, not a host.',
+      '  · It does not resolve keyId against the live host. It checks the signature under',
+      '    the key YOU supply with --host-key; it cannot tell you that key is the host\u2019s.',
+      '  · It does not judge suite currency. The suite version is reported above as data:',
+      '    an older bundle measured less, and whose fact that is belongs to its emitter.',
+      '',
+    ];
+    if (verdict.rejections.length > 0) {
+      out.push(`REJECTED \u2014 ${verdict.rejections.length} problem(s):`);
+      for (const r of verdict.rejections) out.push(`  [${r.kind}]${r.profile ? ` (${r.profile})` : ''} ${r.detail}`);
+      process.stdout.write(out.join('\n') + '\n');
+      process.exit(1);
+    }
+    const gaps: string[] = [];
+    if (!verdict.signatureVerified) gaps.push('the host signature was NOT verified (no --host-key supplied)');
+    if (!verdict.derivabilityChecked) gaps.push('the certified list was NOT re-derived from the bundle\u2019s discovery document \u2014 it is the emitter\u2019s word');
+    if ((bundle.claimedProfiles ?? []).some((p) => p.evidenceTier === 'independent') && !verdict.verifierSignatureVerified) gaps.push('an `independent` tier is claimed but the verifier signature was NOT verified (no --verifier-key)');
+    if (gaps.length > 0) {
+      out.push('COHERENT, NOT INDEPENDENTLY VERIFIED \u2014 zero rejections, but:');
+      for (const g of gaps) out.push(`  \u00b7 ${g}`);
+      out.push('', 'Do not quote this as "verified". Exit 2 exists to keep that distinction.');
+      process.stdout.write(out.join('\n') + '\n');
+      process.exit(2);
+    }
+    out.push('VERIFIED \u2014 zero rejections, host signature checked, certified list re-derived.');
+    process.stdout.write(out.join('\n') + '\n');
+    process.exit(0);
+  }
+
   // Env vars OVERRIDE flags only when the flag was unset (consistent
   // with the rest of the harness — env wins on the absence of CLI input).
   const env: NodeJS.ProcessEnv = { ...process.env };