@openwop/openwop-conformance 2.40.1 → 2.40.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.40.2] — 2026-09-26 — production bundles stop carrying harness-issuer blocked rows, and a colocated companion is marked
+
+- **RFC 0216: `--as-colocated-companion`, and a companion witnesses only the harness-trust-anchor rows.** The flag marks a v3 bundle `host.deployment: "colocated-companion"`. It is refused without `--certify` and bundle version 3. `witnessDigest` takes the marker into the preimage when present (`{ rows, relaxations?, deployment }`), so a signed companion cannot shed it: `--verify` then refuses with `witness-digest`. New coherence scenario `v2-colocated-companion` (7 legs, one id each) drives `scripts/check-harness-trust-anchors.mjs` and `scripts/check-companion-pairing.mjs` on tmpdir fixtures signed by the suite's own `signBundleV3`. Five sabotages were each run red.
+- **The harness OIDC issuer is an instrument a host claims, so an honest production bundle is no longer uncertifiable.** Before this, `v2-oidc-id-token-audience` (`0200.id-token-aud`) and `v2-lane-exp-only-bound` (the four `0210.exp-only-*` / `credential-lifetime-code` rows) recorded `blocked` whenever the host did not trust `OPENWOP_TEST_OIDC_ISSUER_URL`. A production host must never trust a test issuer, and one `blocked` row denies certification bundle-wide (RFC 0168 §E.1). Every production bundle advertising an `oidc` or `exp-only` lane was therefore uncertifiable (openwop-app ADR 0745, corpus defect 1). The rows are `seam-gated`, and RFC 0168 §C.1 already rules that an unclaimed suite instrument is `inapplicable`, with `blocked` reserved for a claimed instrument that does not answer. The new `lib/harness-issuer.ts` treats the harness as claimed when the gated lane's advertised `issuers[]` lists it. When the lane does not list it, the row is `inapplicable` and names the issuers the host does trust. When it does, the legs run as before (a failed serve or a refused control is still `blocked`). RFC 0200 and RFC 0210 carry dated correction notes, and `SECURITY/invariants.yaml` `lane-exp-only-lifetime-bounded` is updated. No MUST changes. The residual is stated in the RFC 0210 note: a production bundle does not witness these rows, just as it witnesses no seam-gated row. The witness comes from a cut whose lane lists the harness. **The issuer now has a bind knob:** it listens via `receiverBinding()`, which is loopback, or `0.0.0.0` under `OPENWOP_CONFORMANCE_HARNESS_HOST`, on 2.39.4's `issuerListenPort()`. It waits out `EADDRINUSE` while the other scenario holds the shared URL. Before this, it always bound `127.0.0.1`, so a host in a Linux container reaching it through `host-gateway` found nothing listening (ADR 0745 defect 2; 2.39.4 fixed the port half). **`requirements.json` resolves `const ID` declared inside a test body** (`generate-requirement-registry.mjs`). Before, only module-level constants resolved, so 14 real ids recorded `explicitId: null`: `0210.lane-rule-surfaces-agree` (ADR 0745 defect 4), three `0199.*`, six `0201.*` and four `0214.*`. Those rows were labelled by their title-derived id whenever the leg did not reach its assertion. ADR 0745 defect 5, the reused kid, was already fixed in 2.37.0: every instance mints `openwop-conformance-key-<instance>-<n>`, pinned by `oidc-issuer.test.ts`. New suite self-test `src/lib/harness-issuer.test.ts` covers the claim predicate and the port knob. It is sabotage-proved: dropping the `issuers[]` check makes it fail 2/4.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.40.2` because `2.40.1` is released, and `spec-artifacts` now carries a changed `spec/v2/core/oauth.md` (RFC 0199's text restored; editorial, `COMPATIBILITY.md` §3 entry of 2026-09-26). No scenario changes. Not tagged, not published.
+
 ## [2.40.1] — 2026-09-26 — three declared-unwitnessable rows are reached and say why
 
 - **Three Falsifiability rows declared non-executable now have a leg that records the reason** (RFC 0174 §B.1 rule 4, second branch: "the suite must reach the leg and record a reason"). Each RFC's table declares one of these rows unwitnessable, but no suite leg referenced it, so no bundle could account for it. Each of RFCs 0197, 0205 and 0209 was held from `Accepted` by that one row. No leg can record `executed-pass` without observing the requirement.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.1 @openwop/spec-artifacts@2.40.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.2 @openwop/spec-artifacts@2.40.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/cli.js

@@ -70,6 +70,7 @@ function parseArgs(argv) {
     let signingKeyPath, signingKeyId, verifierKeyPath, verifierKeyId;
     let targetMajor;
     let maxWorkers = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
+    let colocatedCompanion = false;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i] ?? '';
         if (arg === '-h' || arg === '--help') {
@@ -180,6 +181,12 @@ function parseArgs(argv) {
             case '--host-key':
                 verifyHostKeyPath = nextValue();
                 break;
+            // RFC 0216 §B — marks the bundle as cut from a colocated companion (the
+            // served host's image beside the suite, trusting a suite-held anchor).
+            // The marker is inside witnessSha256, so a signed companion cannot shed it.
+            case '--as-colocated-companion':
+                colocatedCompanion = true;
+                break;
             case '--require-behavior':
                 process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
                 break;
@@ -215,6 +222,7 @@ function parseArgs(argv) {
         maxWorkers,
         verifyPath,
         verifyHostKeyPath,
+        colocatedCompanion,
     };
 }
 /** Parse a `--max-workers` / `OPENWOP_MAX_WORKERS` value: a positive integer, else exit 2. */
@@ -261,6 +269,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --as-colocated-companion  v3 (RFC 0216): mark the bundle as cut from a colocated companion — the
+                        served host's image run beside the suite so it can trust a suite-held
+                        trust anchor. Signed (inside witnessSha256). A companion is acceptance
+                        evidence only for spec/v2/harness-trust-anchors.json rows.
   --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
                         Default: one worker per CPU. Use a small number against a
                         rate-limited production origin so 429s don't read as failures.
@@ -680,7 +692,7 @@ async function runCertify(args, baseUrl, apiKey) {
             bundleVersion: '3',
             generatedAt: new Date().toISOString(),
             suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
-            host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+            host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}), ...(args.colocatedCompanion ? { deployment: 'colocated-companion' } : {}) },
             // `document` is what makes `claimedProfiles[].certified` checkable by
             // someone other than this process (RFC 0148 §B(1)); v2 carried it and v3
             // dropped it. `sha256` is a digest of `canonicalJSON(document)`, so the
@@ -688,7 +700,7 @@ async function runCertify(args, baseUrl, apiKey) {
             discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
             claimedProfiles: claimed3,
             results: { totals: totals3, requirements: rows3 },
-            witnessSha256: witnessDigest(rows3, relaxations),
+            witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
             assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
             ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
             // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -856,6 +868,10 @@ async function runCertify(args, baseUrl, apiKey) {
 }
 async function main() {
     const args = parseArgs(process.argv.slice(2));
+    if (args.colocatedCompanion && (!args.certify || args.bundleVersion !== '3')) {
+        process.stderr.write('openwop-conformance: --as-colocated-companion marks a v3 certification bundle; it needs --certify with bundle version 3 (RFC 0216 §B)\n');
+        process.exit(2);
+    }
     // Refused before anything runs: a pinned-port certification that is not
     // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
     const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);

package/dist/lib/certification-bundle-v3.js

@@ -49,12 +49,20 @@ export { canonicalJSON } from './jcs.js';
  * from the same bundle anywhere else (Czech sorts `ch` after `h`). Every
  * committed bundle's ids are `[a-z0-9.-]`, where the two orders coincide, so no
  * stored digest changes (v2-bundle-witness-preimage.test.ts pins that).
+ *
+ * RFC 0216 §B.7 — a colocated companion's `host.deployment` joins the preimage
+ * the same way, ONLY WHEN PRESENT (`{ rows, relaxations?, deployment }`), so a
+ * signed companion cannot shed the marker and pass as a served-host bundle, and
+ * every bundle without it digests exactly as before.
  */
-export function witnessDigest(rows, relaxations) {
+export function witnessDigest(rows, relaxations, deployment) {
     const canonicalRows = [...rows].sort((a, b) => codeUnitCompare(a.id, b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
         // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
         ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-    const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+    const relaxed = relaxations !== undefined && relaxations.length > 0;
+    const preimage = relaxed || deployment !== undefined
+        ? { rows: canonicalRows, ...(relaxed ? { relaxations } : {}), ...(deployment !== undefined ? { deployment } : {}) }
+        : canonicalRows;
     return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 /** The bytes the attestation covers. */
@@ -140,9 +148,9 @@ export function verifyBundleV3(bundle, opts = {}) {
     for (const k of Object.keys(expected))
         if (bundle.results?.totals?.[k] !== expected[k])
             rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-    const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations));
+    const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations, bundle.host?.deployment));
     if (digest !== undefined && bundle.witnessSha256 !== digest)
-        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
+        rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows, declared relaxations and deployment marker (${digest.slice(0, 12)})` });
     const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
     if (bundle.assertionCount !== assertions)
         rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.1",
-  "stampSha256": "1fb5733bb565913ac21afc3e5179ea3cb4d1b98ab39f543fb3c70f9a936453bd"
+  "version": "2.40.2",
+  "stampSha256": "5b784776f9088d58f1fd29e14efa113715876aac5940b728f775a779c59a962a"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.40.1",
+  "version": "2.40.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.40.1"
+    "@openwop/spec-artifacts": "2.40.2"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 635,
-    "tests": 2430,
-    "withStableId": 2430,
+    "files": 636,
+    "tests": 2437,
+    "withStableId": 2437,
     "interpolatedTitles": 0,
-    "explicitIds": 2310
+    "explicitIds": 2331
   },
   "records": [
     {
@@ -26810,7 +26810,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 275,
       "title": "a host not advertising a2a.pushNotifications refuses all four push-config operations with PushNotificationNotSupportedError",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-unadvertised-refused",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26823,7 +26823,7 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.errors PushNotificationNotSupportedError (serverWhen: push config without a2a.pushNotifications) and the push-config operation rows; A2A v1.0.1 §3.3.4",
           "requirement": null,
           "interpolated": true
         }
@@ -26834,7 +26834,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 306,
       "title": "RFC 0214 — CreateTaskPushNotificationConfig refuses a non-https or private destination",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-register-ssrf",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26842,12 +26842,12 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations CreateTaskPushNotificationConfig (\"the url MUST pass the webhooks.md egress guard\"); webhooks.md §Egress; RFC 0214 §B",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations CreateTaskPushNotificationConfig (\"the url MUST pass the webhooks.md egress guard\"); webhooks.md §Egress; RFC 0214 §B",
           "requirement": null,
           "interpolated": true
         }
@@ -26858,41 +26858,40 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 324,
       "title": "RFC 0214 §E — a push config of another tenant's task, of another task, or unknown, is answered identically",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-config-isolation",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
           "requirement": "SendMessage MUST start two tasks with tenant-bound ids"
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
-          "requirement": "a delete naming another tenant's task MUST NOT delete the caller's config",
-          "interpolated": true
+          "section": "interop.md §\"A2A push delivery\" (RFC 0214 §E); interop.md §\"The operation mappings\" Isolation",
+          "requirement": "a delete naming another tenant's task MUST NOT delete the caller's config"
         },
         {
           "section": "A2A v1.0.1 §3.1.10 (\"MUST be idempotent\")",
@@ -26906,7 +26905,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 368,
       "title": "RFC 0214 §A — a push config's token and credentials are never returned, and never reach task, events or state",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0214.a2a-push-secrets-not-returned",
       "citations": [
         {
           "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
@@ -26914,12 +26913,12 @@
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations push rows (\"secrets are never returned\"); security-defaults.md §\"Onward hops\" (RFC 0214 §A)",
           "requirement": null,
           "interpolated": true
         },
         {
-          "section": null,
+          "section": "interop-map.json a2a.operations push rows (\"secrets are never returned\"); security-defaults.md §\"Onward hops\" (RFC 0214 §A)",
           "requirement": null,
           "interpolated": true
         }
@@ -27062,7 +27061,7 @@
       "file": "v2-a2a-operation-map.test.ts",
       "line": 509,
       "title": "a run suspended on a credential interrupt projects to TASK_STATE_AUTH_REQUIRED, naming the provider and carrying connectUrl",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.a2a-auth-required",
       "citations": [
         {
           "section": "runs.md createRun",
@@ -29657,7 +29656,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-inside-the-advertised-window-is-accepted-the-control-the-two-refusa",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 149,
+      "line": 152,
       "title": "a credential inside the advertised window is accepted — the control the two refusals rest on",
       "explicitId": "openwop.requirement.0210.exp-only-control-accepted",
       "citations": [
@@ -29671,7 +29670,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-total-lifetime-exceeds-the-window-is-refused-401-and-so-is-on",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 164,
+      "line": 167,
       "title": "a credential whose TOTAL lifetime exceeds the window is refused 401, and so is one carrying no iat",
       "explicitId": "openwop.requirement.0210.exp-only-lifetime-bound",
       "citations": [
@@ -29690,7 +29689,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.the-over-lifetime-refusal-names-credential-lifetime-exceeded-not-a-generic-unaut",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 199,
+      "line": 202,
       "title": "the over-lifetime refusal names credential_lifetime_exceeded, not a generic unauthenticated",
       "explicitId": "openwop.requirement.0210.credential-lifetime-code",
       "citations": [
@@ -29704,7 +29703,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-remaining-lifetime-exceeds-the-window-is-refused-though-its-t",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 217,
+      "line": 220,
       "title": "a credential whose REMAINING lifetime exceeds the window is refused, though its total lifetime does not",
       "explicitId": "openwop.requirement.0210.exp-only-remaining-bound",
       "citations": [
@@ -30394,7 +30393,7 @@
       "file": "v2-mcp-mount-map.test.ts",
       "line": 287,
       "title": "a credential interrupt is answered in URL mode (url = connectUrl), isError without URL support, and input_required again on an accept retry with no credential",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.mcp-url-mode",
       "citations": [
         {
           "section": "interop-map.json mcp.mrtr InputRequiredResult (host as server)",
@@ -30432,7 +30431,7 @@
       "file": "v2-mcp-mount-map.test.ts",
       "line": 328,
       "title": "form mode is never emitted for a nested schema or a sensitive (format password) field",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0199.form-mode-no-secret",
       "citations": [
         {
           "section": "interop-map.json mcp.mrtr InputRequiredResult (host as server)",
@@ -31251,7 +31250,7 @@
     {
       "id": "openwop.it.v2-oidc-id-token-audience.a-same-audience-id-token-is-admissible-and-one-minted-for-another-relying-party",
       "file": "v2-oidc-id-token-audience.test.ts",
-      "line": 74,
+      "line": 68,
       "title": "a same-audience ID token is admissible, and one minted for another relying party is audience_mismatch",
       "explicitId": "openwop.requirement.0200.id-token-aud",
       "citations": [
@@ -33419,7 +33418,7 @@
       "file": "v2-webhook-endpoint-verification.test.ts",
       "line": 64,
       "title": "no-echo, wrong-echo and a redirect are refused and persist nothing; an echo is accepted",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.endpoint-verification",
       "citations": [
         {
           "section": "RFC 0201 §D.14",
@@ -33487,7 +33486,7 @@
       "file": "v2-webhook-message-id-stable.test.ts",
       "line": 69,
       "title": "every attempt of one delivery carries one webhook-id, and distinct deliveries carry distinct ids",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.message-id-stable",
       "citations": [
         {
           "section": "RFC 0201 §C.10",
@@ -33520,7 +33519,7 @@
       "file": "v2-webhook-secret-rotation.test.ts",
       "line": 67,
       "title": "a rotation dual-signs for overlapSeconds, keeps OpenWOP-Signature on the previous secret, and is tenant-checked",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.secret-rotation",
       "citations": [
         {
           "section": "RFC 0201 §E.18 / identity.md §5",
@@ -33603,7 +33602,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 77,
       "title": "a subscription that did not opt in is neither verified nor given webhook-* headers",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.opt-in-only",
       "citations": [
         {
           "section": "RFC 0201 §B.8 / §D.15",
@@ -33637,7 +33636,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 110,
       "title": "the opt-in is validated, its 201 echoes the applied list, and no response carries the secret",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.registration-validated",
       "citations": [
         {
           "section": "RFC 0201 §B.5–§B.6",
@@ -33669,7 +33668,7 @@
       "file": "v2-webhook-standard-webhooks-delivery.test.ts",
       "line": 155,
       "title": "an opted-in delivery is dual-signed and its Standard Webhooks signature covers the id",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0201.delivery-signed",
       "citations": [
         {
           "section": "RFC 0201 §B",
@@ -41095,7 +41094,7 @@
     {
       "id": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
       "file": "v2-bundle-witness-preimage.test.ts",
-      "line": 66,
+      "line": 69,
       "title": "every committed v3 bundle re-derives its witnessSha256 from the prose preimage",
       "explicitId": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
       "citations": [
@@ -41122,7 +41121,7 @@
     {
       "id": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
       "file": "v2-bundle-witness-preimage.test.ts",
-      "line": 80,
+      "line": 83,
       "title": "the row comparator is code-unit order, which a locale collation contradicts",
       "explicitId": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
       "citations": [
@@ -41136,6 +41135,167 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-colocated-companion.a-3-the-anchor-list-is-closed-and-exact",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 157,
+      "title": "§A.3 the anchor list is closed and exact",
+      "explicitId": "openwop.requirement.0216.anchor-list-closed",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base fixture list MUST pass the anchor gate, or every sabotage below proves nothing"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.b-7-the-marker-is-inside-the-signed-digest",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 175,
+      "title": "§B.7 the marker is inside the signed digest",
+      "explicitId": "openwop.requirement.0216.deployment-in-preimage",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "host.deployment MUST enter the witnessSha256 preimage when present"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a bundle without the marker MUST digest exactly as before RFC 0216"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a signed companion that sheds host.deployment MUST fail verification with witness-digest"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the unaltered companion MUST NOT be refused for its digest"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-a-companion-counts-only-for-listed-rows",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 187,
+      "title": "§C.9 a companion counts only for listed rows",
+      "explicitId": "openwop.requirement.0216.companion-anchor-rows-only",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base companion MUST pair with the served-host bundle of the same image, key and configuration"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a paired companion MUST witness its harness-trust-anchor rows"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a paired companion MUST NOT witness a row off the anchor list, however it passed"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "an uncertified companion MUST witness nothing"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-a-b-the-same-host-and-the-same-image-digest",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 197,
+      "title": "§C.9(a)/(b) the same host and the same image digest",
+      "explicitId": "openwop.requirement.0216.companion-same-image",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a commit-kind build MUST NOT pair — a commit does not name the bytes that ran"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "image digests differing in one byte MUST NOT pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion of another host MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-c-signed-under-a-key-the-served-bundle-publishes",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 209,
+      "title": "§C.9(c) signed under a key the served bundle publishes",
+      "explicitId": "openwop.requirement.0216.companion-attributable",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the base MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion whose attestation does not verify under the named published key MUST NOT pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion signed under a key the served bundle does not publish MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-9-d-equivalent-discovery-origin-and-oidc-issuers-aside",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 218,
+      "title": "§C.9(d) equivalent discovery, origin and oidc issuers aside",
+      "explicitId": "openwop.requirement.0216.companion-equivalent",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a companion differing only in origin and oidc issuers MUST pair"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a different revocationWindowSeconds MUST NOT pair — it is a different claim"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "a difference in a non-oidc lane MUST NOT pair"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-colocated-companion.c-10-the-committed-unmarked-companion-witnesses-nothing",
+      "file": "v2-colocated-companion.test.ts",
+      "line": 227,
+      "title": "§C.10 the committed unmarked companion witnesses nothing",
+      "explicitId": "openwop.requirement.0216.legacy-companion",
+      "citations": [
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the committed 2026-09-25 companion MUST be recognised as a companion by its witnessSha256"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the committed unmarked companion MUST witness nothing (commit-kind build, throwaway key)"
+        },
+        {
+          "section": "RFC 0216 · spec/v2/core/conformance.md §\"Bundle v3\"",
+          "requirement": "the legacy file carries no marker — it is caught by digest, not by a field it could drop"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",
@@ -41522,7 +41682,7 @@
       "file": "v2-lane-exp-only-schema.test.ts",
       "line": 127,
       "title": "the gate refuses an enum member with no §2.2 row, and a suite map the table does not license",
-      "explicitId": null,
+      "explicitId": "openwop.requirement.0210.lane-rule-surfaces-agree",
       "citations": [
         {
           "section": "scripts/check-lane-revocation-rules.mjs",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.1",
-  "corpusTag": "v2.40.1",
+  "version": "2.40.2",
+  "corpusTag": "v2.40.2",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "23c87c259cbe4b6d087faa9f358684921d400a11330bde6b27c8cacbf0b16d78",
-    "api/v2/asyncapi.yaml": "3629ae4718168e424aee3e93b3c785df904a12229a2c58c0eec0ecaf9f8f5b2e",
-    "api/v2/openapi.yaml": "74d9beac93b861a3d191ee5e87ce047a907171df6ecdb3fcb0854d28e8df119c",
+    "api/seams-v2.yaml": "c92bde1fb2ac949edfb50519651ac3755cfc88b8a2a8785eab0e15bcb6a8dbb9",
+    "api/v2/asyncapi.yaml": "87d5b9de8e3fa920a0ddecce7f51018f8f573b5ef14f954973a0776d3b9d9a0f",
+    "api/v2/openapi.yaml": "532467b699c179c355349c8bb483a801156a68b003d02aa9d7cf576f867c3097",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -117,7 +117,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "740944d7f0a00c91308449f3a3f52fa7b91b16b8fd36a0171b917afe9f4b0f09",
-    "schemas/v2/certification-bundle.schema.json": "67ac56bbf5f8deeec58b32e8d7bc9ce854a6a8c3cd81693e65192e5c3b726154",
+    "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "77d77c3ee245f8f7855a530a3aa610a0a7c00a26df6c97962f1600c93e8b13c1",
+    "spec/v1/core-standard-manifest.json": "a16e3a91b9121d7b6d58fd9f65a348f92a07636417406f56bc3173571e9d55ea",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "45483b0932d4b2a80b0781419abc697f7d363be46bddfd8163a48364b8f76a36",
+    "spec/v1/gaps.json": "3decfec271c30f796ba76586ca06ab31e6ea3b8bcae174c3af0b8bb1c19709b5",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -218,7 +218,7 @@
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ccfed7d978ce7293a6d8f3c0f6045835dfb7e488f2b67a68f6b04d67c4b0cfc9",
     "spec/v2/core/capabilities.md": "e22381fed3a93376ad478fa7f07571fdad9653aefd7c05f189a2ef45a49f6c63",
-    "spec/v2/core/conformance.md": "38ebc9e56a830d0ee0ade429b81b0cd302c23e49a13647b1b902275262d6610d",
+    "spec/v2/core/conformance.md": "e4d3b34ef5b7c6a34675ed59a086143e8bfd0e00d0d04ce0f2a2ec6245275084",
     "spec/v2/core/connection-packs.md": "7257339a4fc125011bf89961588c949cb058a0c0f7d9808ad08a5288deb3f8fc",
     "spec/v2/core/conversation.md": "c9a937e410fdb4e092cec2f05a7cab8b5232745090cfb20041c03c70ccbb5cdc",
     "spec/v2/core/errors.md": "619cd74381c41acf33d012eb1afd834e148ac292663a1a6fa6744dbaff9661d9",
@@ -231,7 +231,7 @@
     "spec/v2/core/interop.md": "9a6b37e07c0235856199ace6b3a84f592fa5903fcf6c442f8a18f4d6b6aa5525",
     "spec/v2/core/interrupt.md": "1dc94f7c791dd5a547b1abafde6a8a76acd3d2993d288057f302f57911dc83bf",
     "spec/v2/core/node-pack-runtimes.md": "c435ad506f618831b6c0a9fd9150d83a5dc6caa1e3d755b949af2ff8949f1140",
-    "spec/v2/core/oauth.md": "08e558a742259e75cfb2123f4c364d238dc4c57eea1a3c25d8f420ab4dff8244",
+    "spec/v2/core/oauth.md": "38ec0e70d46f328430138559095f261ae4fcd3d32c2d994a2d3e630a062c0e6c",
     "spec/v2/core/overview.md": "8f9d4a68b6185664e40d226cb82d9a9270a6c6630e3db59bddff300be781947d",
     "spec/v2/core/packs.md": "91cd577b4a636c1587ef78742e583a203244b8508b289b01a18a8ef2ef0a9b3e",
     "spec/v2/core/persistence.md": "d32736bd74e51df7c552565b4105a8ec801ece6d2292c8676421368ee9bffec1",
@@ -284,6 +284,8 @@
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
     "spec/v2/facets/webhooks.schema.json": "2fac635ee5fbc10a14a1a46cf512a11bac660bfbabe0aea79f6c7b657ecb9e4e",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
+    "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
+    "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
     "spec/v2/id-field-bindings.json": "9f6fd280250447e26a6704811c352bb8f2ff6c4bd242befe3da0ba38962370e9",
     "spec/v2/interop-map.json": "02255dafe7eb55f61ca7f9ae7c21f079d1848a6756991343088975ac9d184b8d",
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
@@ -292,9 +294,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c24fde3d12b1732d9f0162ef0a0596ebd24501935cd28801eb892fbb6ec57949",
+    "spec/v2/release.json": "f04bc2406dfc3af40a495d8750349409f053bb56f009359ebc62a8877251c90f",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "72d51a1bd81cbe3cee07f9ad0ab7b481b60d4e74e651704e9b3242c49c93ec11"
+    "spec/v2/surface-baseline.json": "26f2a03c650413ac9c0d0b5facee47ee0eaebeb01d377c808fe6e737bb08687c"
   },
-  "corpusCommit": "470ee4d7a2cb94ddb893d82d57ade4d95644d74b"
+  "corpusCommit": "70c93c0fcd5c595893c1cac7cf1020d5c5835ec2"
 }

package/src/cli.ts

@@ -83,6 +83,8 @@ interface ParsedArgs {
   readonly verifyPath: string | undefined;
   /** `--host-key <pem>` — the key `--verify` checks the host signature under. Absent ⇒ the verdict is INCOMPLETE, not clean. */
   readonly verifyHostKeyPath: string | undefined;
+  /** RFC 0216 §B — `--as-colocated-companion`. */
+  readonly colocatedCompanion: boolean;
   readonly verifierKeyId: string | undefined;
   /**
    * S43 (2026-08-18) — cap on concurrently running scenario FILES, forwarded to
@@ -112,6 +114,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let signingKeyPath: string | undefined, signingKeyId: string | undefined, verifierKeyPath: string | undefined, verifierKeyId: string | undefined;
   let targetMajor: 1 | 2 | undefined;
   let maxWorkers: number | undefined = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
+  let colocatedCompanion = false;
 
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i] ?? '';
@@ -202,6 +205,12 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--host-key':
         verifyHostKeyPath = nextValue();
         break;
+      // RFC 0216 §B — marks the bundle as cut from a colocated companion (the
+      // served host's image beside the suite, trusting a suite-held anchor).
+      // The marker is inside witnessSha256, so a signed companion cannot shed it.
+      case '--as-colocated-companion':
+        colocatedCompanion = true;
+        break;
       case '--require-behavior':
         process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
         break;
@@ -240,6 +249,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     maxWorkers,
     verifyPath,
     verifyHostKeyPath,
+    colocatedCompanion,
   };
 }
 
@@ -288,6 +298,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --as-colocated-companion  v3 (RFC 0216): mark the bundle as cut from a colocated companion — the
+                        served host's image run beside the suite so it can trust a suite-held
+                        trust anchor. Signed (inside witnessSha256). A companion is acceptance
+                        evidence only for spec/v2/harness-trust-anchors.json rows.
   --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
                         Default: one worker per CPU. Use a small number against a
                         rate-limited production origin so 429s don't read as failures.
@@ -709,7 +723,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       bundleVersion: '3',
       generatedAt: new Date().toISOString(),
       suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
-      host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+      host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}), ...(args.colocatedCompanion ? { deployment: 'colocated-companion' as const } : {}) },
       // `document` is what makes `claimedProfiles[].certified` checkable by
       // someone other than this process (RFC 0148 §B(1)); v2 carried it and v3
       // dropped it. `sha256` is a digest of `canonicalJSON(document)`, so the
@@ -717,7 +731,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
       claimedProfiles: claimed3,
       results: { totals: totals3, requirements: rows3 },
-      witnessSha256: witnessDigest(rows3, relaxations),
+      witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
       assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
       ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
       // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -908,6 +922,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
 
 async function main(): Promise<never> {
   const args = parseArgs(process.argv.slice(2));
+  if (args.colocatedCompanion && (!args.certify || args.bundleVersion !== '3')) {
+    process.stderr.write('openwop-conformance: --as-colocated-companion marks a v3 certification bundle; it needs --certify with bundle version 3 (RFC 0216 §B)\n');
+    process.exit(2);
+  }
   // Refused before anything runs: a pinned-port certification that is not
   // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
   const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);

package/src/lib/certification-bundle-v3.ts

@@ -41,12 +41,14 @@ export interface BundleV3Profile {
   readonly certified: boolean;
 }
 export interface BundleV3Relaxation { readonly obligation: string; readonly durability: 'session' | 'deployment' | 'persisted'; readonly reason: string }
+/** RFC 0216 §B — absent means the bundle measures the served host. */
+export type BundleV3Deployment = 'colocated-companion';
 export interface BundleV3Signature { readonly alg: 'ed25519'; readonly keyId: string; readonly sig: string; readonly over: readonly string[]; readonly verifierKeyId?: string }
 export interface BundleV3 {
   bundleVersion: '3';
   generatedAt: string;
   suite: { name: '@openwop/openwop-conformance'; version: string; targetMajor: 1 | 2; specArtifactsVersion: string; stampSha256?: string };
-  host: { name: string; version: string; vendor?: string; build: { kind: 'image-digest' | 'commit' | 'artifact-sha256'; id: string }; signingKeyId?: string; relaxations?: BundleV3Relaxation[] };
+  host: { name: string; version: string; vendor?: string; build: { kind: 'image-digest' | 'commit' | 'artifact-sha256'; id: string }; signingKeyId?: string; relaxations?: BundleV3Relaxation[]; deployment?: BundleV3Deployment };
   /**
    * `document` is the captured `/.well-known/openwop` payload, OPTIONAL.
    *
@@ -106,12 +108,20 @@ export { canonicalJSON } from './jcs.js';
  * from the same bundle anywhere else (Czech sorts `ch` after `h`). Every
  * committed bundle's ids are `[a-z0-9.-]`, where the two orders coincide, so no
  * stored digest changes (v2-bundle-witness-preimage.test.ts pins that).
+ *
+ * RFC 0216 §B.7 — a colocated companion's `host.deployment` joins the preimage
+ * the same way, ONLY WHEN PRESENT (`{ rows, relaxations?, deployment }`), so a
+ * signed companion cannot shed the marker and pass as a served-host bundle, and
+ * every bundle without it digests exactly as before.
  */
-export function witnessDigest(rows: readonly BundleV3Requirement[], relaxations?: readonly BundleV3Relaxation[]): string {
+export function witnessDigest(rows: readonly BundleV3Requirement[], relaxations?: readonly BundleV3Relaxation[], deployment?: BundleV3Deployment): string {
   const canonicalRows = [...rows].sort((a, b) => codeUnitCompare(a.id, b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
     // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
     ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-  const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+  const relaxed = relaxations !== undefined && relaxations.length > 0;
+  const preimage = relaxed || deployment !== undefined
+    ? { rows: canonicalRows, ...(relaxed ? { relaxations } : {}), ...(deployment !== undefined ? { deployment } : {}) }
+    : canonicalRows;
   return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 
@@ -219,8 +229,8 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   const count = (d: BundleV3Result): number => rows.filter((r) => r.result === d).length;
   const expected = { executedPass: count('executed-pass'), executedFail: count('executed-fail'), skipped: count('skipped'), inapplicable: count('inapplicable'), blocked: count('blocked') };
   for (const k of Object.keys(expected) as (keyof typeof expected)[]) if (bundle.results?.totals?.[k] !== expected[k]) rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-  const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations));
-  if (digest !== undefined && bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
+  const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations, bundle.host?.deployment));
+  if (digest !== undefined && bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows, declared relaxations and deployment marker (${digest.slice(0, 12)})` });
   const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
   if (bundle.assertionCount !== assertions) rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });
   const nonPass = rows.filter((r) => r.result !== 'executed-pass');

package/src/lib/harness-issuer.ts

@@ -0,0 +1,101 @@
+/**
+ * The suite's harness OIDC issuer, as an INSTRUMENT a host claims.
+ *
+ * Two major-2 scenarios need a token the host would accept, and the suite can
+ * mint one only with a key it holds: `v2-oidc-id-token-audience` (RFC 0200 §D)
+ * and `v2-lane-exp-only-bound` (RFC 0210 §B). The suite holds the key of exactly
+ * one issuer, the one it stands up at `OPENWOP_TEST_OIDC_ISSUER_URL`.
+ *
+ * ── Why the gate reads the host's lane, not only the environment ────────────
+ * Until 2.40.2 both files recorded `blocked` whenever the harness was not the
+ * host's trust root. A PRODUCTION host MUST NOT trust a test issuer — a deployed
+ * service that accepts tokens signed by a key living on a test runner has an
+ * authentication bypass — so every honest production bundle advertising an
+ * `oidc` or `exp-only` lane carried `blocked` rows, and RFC 0168 §E.1 makes one
+ * `blocked` row deny certification bundle-wide. Measured on openwop-app
+ * (ADR 0745 corpus defect 1); MyndHyve is in the same position.
+ *
+ * RFC 0168 §C.1 already rules on this shape for the other suite instrument a
+ * host has to be configured for, the seams profile: "a scenario that finds the
+ * exact advert absent records `inapplicable` — never `blocked`, which is
+ * reserved for an advertised profile whose seam does not answer". The harness
+ * issuer is claimed the same way, by the host's own advertisement: a lane's
+ * `issuers[]` (`spec/v2/facets/auth.schema.json`) names the trust roots that
+ * lane accepts. So:
+ *
+ *   - the lane's `issuers[]` does not name the harness URL (or no harness URL is
+ *     configured) → `inapplicable`, and the reason names the issuers the host
+ *     DOES trust — a fact about the host, not about the suite;
+ *   - the lane names it → the host has claimed the instrument; a harness that
+ *     cannot be served, or a control token the host then refuses, is `blocked`
+ *     or a failure exactly as before.
+ *
+ * The cost, stated rather than hidden: a production bundle no longer witnesses
+ * these rows at all, just as it witnesses no seam-gated row. The witness comes
+ * from a cut whose lane advertises the harness issuer — the reference host, or
+ * a colocated boot of the same release image.
+ *
+ * ── Reachability ─────────────────────────────────────────────────────────────
+ * The PORT is `issuerListenPort()` (2.39.4: `OPENWOP_TEST_OIDC_ISSUER_PORT`,
+ * else the URL's port). The BIND is `receiverBinding()`, as for the webhook
+ * receiver and the OAuth doubles: loopback, or `0.0.0.0` when
+ * `OPENWOP_CONFORMANCE_HARNESS_HOST` says the host is in a container or on
+ * another box. Until 2.40.2 the issuer always bound `127.0.0.1`, so a host in a
+ * Linux container reaching it through `host-gateway` found nothing listening on
+ * the interface it arrived at (openwop-app ADR 0745 defect 2). The URL is what
+ * the host was configured with and is what `iss` and discovery carry; only the
+ * listening socket moves.
+ */
+
+import { createServer, type Server } from 'node:http';
+import { receiverBinding } from './webhook-receiver.js';
+import { issuerListenPort, type SyntheticOIDCIssuer } from './oidc-issuer.js';
+
+const norm = (u: string): string => u.trim().replace(/\/+$/, '');
+
+export type HarnessClaim =
+  | { readonly ok: true; readonly url: string }
+  | { readonly ok: false; readonly kind: 'inapplicable'; readonly reason: string };
+
+/**
+ * Has the host claimed the harness issuer on `lane`? Pure: decided from the
+ * advertised lane record and the configured harness URL.
+ */
+export function harnessClaimed(lane: Readonly<Record<string, unknown>>, harnessUrl: string | undefined): HarnessClaim {
+  const name = String(lane['lane']);
+  const issuers = Array.isArray(lane['issuers']) ? (lane['issuers'] as unknown[]).filter((x): x is string => typeof x === 'string') : [];
+  const listed = issuers.length > 0 ? issuers.join(', ') : 'none';
+  const url = harnessUrl?.trim();
+  if (!url) {
+    return { ok: false, kind: 'inapplicable', reason: `lane ${name} trusts ${listed}, and no harness issuer is configured (OPENWOP_TEST_OIDC_ISSUER_URL unset): the suite holds a signing key for none of the host's trust roots, so no token it mints could be accepted. A host claims the harness by listing it in the lane's issuers[] (RFC 0168 §C.1's reading for suite instruments)` };
+  }
+  if (!issuers.some((i) => norm(i) === norm(url))) {
+    return { ok: false, kind: 'inapplicable', reason: `lane ${name} trusts ${listed}, which does not include the harness issuer ${url}: this host has not claimed the suite's issuer as a trust root (a production host must not), so the suite holds no key the host accepts. RFC 0168 §C.1's reading for suite instruments — witnessed on a cut whose lane lists the harness` };
+  }
+  return { ok: true, url: norm(url) };
+}
+
+/** Serve `issuer`'s discovery + JWKS for the host to fetch. Resolves to the listening server. */
+export async function serveHarnessIssuer(issuer: SyntheticOIDCIssuer, url: string): Promise<Server> {
+  const port = issuerListenPort(url);
+  const { bind } = receiverBinding();
+  const srv = createServer((r, res) => {
+    if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(issuer.jwksJson); return; }
+    if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(issuer.discoveryJson); return; }
+    res.writeHead(404); res.end();
+  });
+  // Two scenario files serve the one issuer URL, and vitest runs files in
+  // parallel: wait for the holder to close rather than fail (each instance has
+  // its own kid, so a host that cached the other file's JWKS re-fetches).
+  const deadline = Date.now() + 25_000;
+  for (;;) {
+    const e = await new Promise<NodeJS.ErrnoException | null>((ok) => {
+      const onErr = (err: NodeJS.ErrnoException): void => ok(err);
+      srv.once('error', onErr);
+      srv.listen(port, bind, () => { srv.off('error', onErr); ok(null); });
+    });
+    if (e === null) return srv;
+    if (e.code !== 'EADDRINUSE' || Date.now() > deadline) throw e;
+    await new Promise((ok) => setTimeout(ok, 250));
+  }
+}

package/src/scenarios/v2-lane-exp-only-bound.test.ts

@@ -23,9 +23,14 @@
  * test.
  *
  * **Gate:** an advertised `auth.lanes[]` member with `revocation: "exp-only"`
- * (`inapplicable`, naming that, otherwise) AND `OPENWOP_TEST_OIDC_ISSUER_URL` naming a
- * synthetic issuer the operator has configured that lane to trust (`blocked` otherwise —
- * without a token the host would ever accept, "it refused a string" witnesses nothing).
+ * (`inapplicable`, naming that, otherwise) whose `issuers[]` lists
+ * `OPENWOP_TEST_OIDC_ISSUER_URL`, the synthetic issuer the suite holds the key for. A lane
+ * that does not list it records `inapplicable` naming the issuers it does trust: the
+ * harness is a suite instrument the host claims by advertising it (RFC 0168 §C.1's reading
+ * for the seams profile; lib/harness-issuer.ts), and a production host must never trust a
+ * test issuer. Corrected in 2.40.1; this was `blocked`, which denied certification to
+ * every honest production bundle. A claimed harness that cannot be served is `blocked` —
+ * without a token the host would ever accept, "it refused a string" witnesses nothing.
  * A window under 120 s is `blocked`: the control token needs room inside it.
  *
  * **Each refusal leg is skewed so it isolates ONE bound.** A token minted at `now` with
@@ -54,13 +59,14 @@
 
 import { afterAll, describe, it, expect } from 'vitest';
 import { randomBytes } from 'node:crypto';
-import { createServer, type Server } from 'node:http';
+import type { Server } from 'node:http';
 import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { v2Discovery, familyAdvertised } from '../lib/v2.js';
-import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { harnessClaimed, serveHarnessIssuer } from '../lib/harness-issuer.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
   'the suite stands up the synthetic OIDC issuer and the host fetches its JWKS; no request returns to the suite\'s own API, so no host-reachable callback is needed';
@@ -113,23 +119,20 @@ async function gate(): Promise<Gate | { readonly kind: 'inapplicable' | 'blocked
   if (window < 2 * MARGIN) {
     return { kind: 'blocked', reason: `lane ${String(lane['lane'])} advertises a ${window}s window; the control token needs ${MARGIN}s of room inside it and the sabotage tokens ${MARGIN}s outside, so a window under ${2 * MARGIN}s cannot be probed without the two cases overlapping` };
   }
-  const url = process.env['OPENWOP_TEST_OIDC_ISSUER_URL']?.trim();
-  if (!url) {
-    return { kind: 'blocked', reason: 'OPENWOP_TEST_OIDC_ISSUER_URL is not set — without an issuer the host is configured to trust, every minted token is refused for the wrong reason and the control leg (which is what makes the refusals non-vacuous) cannot run' };
-  }
+  // The harness is an instrument the host claims by listing it in THIS lane's issuers[]
+  // (RFC 0168 §C.1's reading; lib/harness-issuer.ts). A production host lists its real
+  // IdP and must never list a test issuer, so it records `inapplicable` naming the issuers
+  // it does trust. Before 2.40.1 this was `blocked`, which denied certification to every
+  // honest production bundle advertising an exp-only lane.
+  const claim = harnessClaimed(lane, process.env['OPENWOP_TEST_OIDC_ISSUER_URL']);
+  if (!claim.ok) return { kind: claim.kind, reason: claim.reason };
+  const url = claim.url;
   const audience = process.env['OPENWOP_TEST_OIDC_AUDIENCE']?.trim() ?? 'openwop-conformance';
   if (issuer === null) {
     const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-    const srv = createServer((r, res) => {
-      if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
-      if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
-      res.writeHead(404); res.end();
-    });
-    await new Promise<void>((resolve, reject) => {
-      srv.once('error', reject);
-      srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
-    });
-    server = srv;
+    try { server = await serveHarnessIssuer(made, url); } catch (e) {
+      return { kind: 'blocked', reason: `lane ${String(lane['lane'])} lists the harness issuer, but it could not be served for ${url}: ${(e as Error).message}` };
+    }
     issuer = made;
   }
   return { issuer, url, window, lane: String(lane['lane']) };

package/src/scenarios/v2-oidc-id-token-audience.test.ts

@@ -10,10 +10,14 @@
  * ID-token case explicitly as admissible under the audience MUST `identity.md` §2.1
  * already carries, and refuses everything else.
  *
- * **Gate:** an advertised `oidc` lane AND `OPENWOP_TEST_OIDC_ISSUER_URL` naming a
- * synthetic issuer the host trusts as that lane's trust root. Without the harness issuer
- * the suite cannot mint a token the host would ever accept, so the leg is `blocked` — an
- * assertion that a random string is refused would witness nothing.
+ * **Gate:** an advertised `oidc` lane whose `issuers[]` lists `OPENWOP_TEST_OIDC_ISSUER_URL`,
+ * the synthetic issuer the suite holds the key for. A lane that does not list it (every
+ * production host, which must not trust a test issuer) records `inapplicable`, naming the
+ * issuers it does trust — the harness is a suite instrument the host claims by advertising
+ * it, RFC 0168 §C.1's reading for the seams profile (lib/harness-issuer.ts; corrected in
+ * 2.40.1, when this was `blocked` and denied certification to every production bundle).
+ * A claimed harness that cannot be served, or whose same-audience control is refused, is
+ * `blocked`: an assertion that a random string is refused would witness nothing.
  *
  * `HOST_CALLBACK_NOT_REQUIRED`: the suite stands the issuer up itself and the host reaches
  * it for JWKS; nothing calls back into the suite's own API.
@@ -29,13 +33,14 @@
 
 import { afterAll, describe, it, expect } from 'vitest';
 import { randomBytes } from 'node:crypto';
-import { createServer, type Server } from 'node:http';
+import type { Server } from 'node:http';
 import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 import { prmGate } from '../lib/protected-resource.js';
+import { harnessClaimed, serveHarnessIssuer } from '../lib/harness-issuer.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
   'the suite stands up the synthetic OIDC issuer and the host fetches its JWKS; no request returns to the suite\'s own API, so no host-reachable callback is needed';
@@ -50,22 +55,11 @@ afterAll(async () => {
   issuer = null;
 });
 
-/** Stand the issuer up on the URL the operator told the host to trust. */
-async function harness(audience: string): Promise<{ url: string; issuer: SyntheticOIDCIssuer } | null> {
-  const url = process.env['OPENWOP_TEST_OIDC_ISSUER_URL']?.trim();
-  if (!url) return null;
+/** Stand the issuer up on the URL the host's oidc lane lists (the claim is checked by the caller). */
+async function harness(url: string, audience: string): Promise<{ url: string; issuer: SyntheticOIDCIssuer } | string> {
   if (issuer !== null) return { url, issuer };
   const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-  const srv = createServer((r, res) => {
-    if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
-    if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
-    res.writeHead(404); res.end();
-  });
-  await new Promise<void>((resolve, reject) => {
-    srv.once('error', reject);
-    srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
-  });
-  server = srv;
+  try { server = await serveHarnessIssuer(made, url); } catch (e) { return `the harness issuer could not be served for ${url}: ${(e as Error).message}`; }
   issuer = made;
   return { url, issuer: made };
 }
@@ -76,9 +70,16 @@ describe('RFC 0200 §D — v2-oidc-id-token-audience (gated on an oidc lane and
     if (!g.ok) return softSkip(g.kind, g.reason);
     const oidc = g.lanes.find((l) => l.lane === 'oidc');
     if (oidc === undefined) return softSkip('inapplicable', 'no oidc lane advertised — §D names the ID-token case ON that lane and binds no other');
+    // The harness is an instrument the host claims by listing it in the lane's issuers[]
+    // (RFC 0168 §C.1's reading; lib/harness-issuer.ts). A production host lists its real
+    // IdP and must never list a test issuer, so that host records `inapplicable` with the
+    // issuers it does trust, not `blocked` — before 2.40.1 this was `blocked` and denied
+    // certification to every honest production bundle with an oidc lane.
+    const claim = harnessClaimed(oidc as unknown as Record<string, unknown>, process.env['OPENWOP_TEST_OIDC_ISSUER_URL']);
+    if (!claim.ok) return softSkip(claim.kind, claim.reason);
     const audience = process.env['OPENWOP_TEST_OIDC_AUDIENCE']?.trim() ?? 'openwop-conformance';
-    const h = await harness(audience);
-    if (h === null) return softSkip('blocked', 'OPENWOP_TEST_OIDC_ISSUER_URL is not set — without an issuer the host trusts, no minted token could ever be accepted and the admissible half of §D cannot run');
+    const h = await harness(claim.url, audience);
+    if (typeof h === 'string') return softSkip('blocked', `the oidc lane lists the harness issuer, but ${h}`);
 
     // An ID token, not an access token: `nonce` and `auth_time` are what make it one.
     const good = h.issuer.mint({ sub: `conformance-${randomBytes(6).toString('hex')}`, nonce: randomBytes(8).toString('hex'), auth_time: Math.floor(Date.now() / 1000) });
@@ -90,7 +91,7 @@ describe('RFC 0200 §D — v2-oidc-id-token-audience (gated on an oidc lane and
     // acceptance DOES establish, once it holds, is that the refusal below is caused by the
     // audience and by nothing else: same issuer, same key, same token shape.
     if (probe.status === 401) {
-      return softSkip('blocked', `a same-audience ID token from ${h.url} was refused (401 ${readErrorCode(probe.json) ?? ''}) — either the host does not trust the harness issuer as its oidc lane trust root, or OPENWOP_TEST_OIDC_AUDIENCE does not name the audience it is configured with; with no accepted token the foreign-audience refusal would prove nothing`);
+      return softSkip('blocked', `a same-audience ID token from ${h.url} was refused (401 ${readErrorCode(probe.json) ?? ''}) although the oidc lane lists that issuer — either the host's trust configuration does not match its advertisement, or OPENWOP_TEST_OIDC_AUDIENCE does not name the audience it is configured with; with no accepted token the foreign-audience refusal would prove nothing`);
     }
 
     const foreign = h.issuer.mint({ sub: `conformance-${randomBytes(6).toString('hex')}`, aud: `other-client-${randomBytes(6).toString('hex')}`, nonce: randomBytes(8).toString('hex'), auth_time: Math.floor(Date.now() / 1000) });