@openwop/openwop-conformance 2.40.1 → 2.40.3

package/src/cli.ts

@@ -83,6 +83,8 @@ interface ParsedArgs {
   readonly verifyPath: string | undefined;
   /** `--host-key <pem>` — the key `--verify` checks the host signature under. Absent ⇒ the verdict is INCOMPLETE, not clean. */
   readonly verifyHostKeyPath: string | undefined;
+  /** RFC 0216 §B — `--as-colocated-companion`. */
+  readonly colocatedCompanion: boolean;
   readonly verifierKeyId: string | undefined;
   /**
    * S43 (2026-08-18) — cap on concurrently running scenario FILES, forwarded to
@@ -112,6 +114,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
   let signingKeyPath: string | undefined, signingKeyId: string | undefined, verifierKeyPath: string | undefined, verifierKeyId: string | undefined;
   let targetMajor: 1 | 2 | undefined;
   let maxWorkers: number | undefined = parseMaxWorkers(process.env.OPENWOP_MAX_WORKERS, 'OPENWOP_MAX_WORKERS');
+  let colocatedCompanion = false;
 
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i] ?? '';
@@ -202,6 +205,12 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
       case '--host-key':
         verifyHostKeyPath = nextValue();
         break;
+      // RFC 0216 §B — marks the bundle as cut from a colocated companion (the
+      // served host's image beside the suite, trusting a suite-held anchor).
+      // The marker is inside witnessSha256, so a signed companion cannot shed it.
+      case '--as-colocated-companion':
+        colocatedCompanion = true;
+        break;
       case '--require-behavior':
         process.env['OPENWOP_REQUIRE_BEHAVIOR'] = 'true';
         break;
@@ -240,6 +249,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
     maxWorkers,
     verifyPath,
     verifyHostKeyPath,
+    colocatedCompanion,
   };
 }
 
@@ -288,6 +298,10 @@ Certification (RFC 0089):
                         §C) records per-requirement DISPOSITIONS instead of pass/fail/skip
                         file lists, so "we could not check" stops being indistinguishable
                         from "checked and it holds". See the note it prints.
+  --as-colocated-companion  v3 (RFC 0216): mark the bundle as cut from a colocated companion — the
+                        served host's image run beside the suite so it can trust a suite-held
+                        trust anchor. Signed (inside witnessSha256). A companion is acceptance
+                        evidence only for spec/v2/harness-trust-anchors.json rows.
   --max-workers <n>     Cap concurrently running scenario files (vitest --maxWorkers).
                         Default: one worker per CPU. Use a small number against a
                         rate-limited production origin so 429s don't read as failures.
@@ -709,7 +723,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       bundleVersion: '3',
       generatedAt: new Date().toISOString(),
       suite: { name: '@openwop/openwop-conformance', version, targetMajor: target.major, specArtifactsVersion: lock?.version ?? 'repo-layout', ...(lock ? { stampSha256: lock.stampSha256 } : {}) },
-      host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}) },
+      host: { name: host.name, version: host.version, ...(host.vendor ? { vendor: host.vendor } : {}), build, signingKeyId: keyId, ...(relaxations && relaxations.length ? { relaxations } : {}), ...(args.colocatedCompanion ? { deployment: 'colocated-companion' as const } : {}) },
       // `document` is what makes `claimedProfiles[].certified` checkable by
       // someone other than this process (RFC 0148 §B(1)); v2 carried it and v3
       // dropped it. `sha256` is a digest of `canonicalJSON(document)`, so the
@@ -717,7 +731,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
       claimedProfiles: claimed3,
       results: { totals: totals3, requirements: rows3 },
-      witnessSha256: witnessDigest(rows3, relaxations),
+      witnessSha256: witnessDigest(rows3, relaxations, args.colocatedCompanion ? 'colocated-companion' : undefined),
       assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
       ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
       // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -908,6 +922,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
 
 async function main(): Promise<never> {
   const args = parseArgs(process.argv.slice(2));
+  if (args.colocatedCompanion && (!args.certify || args.bundleVersion !== '3')) {
+    process.stderr.write('openwop-conformance: --as-colocated-companion marks a v3 certification bundle; it needs --certify with bundle version 3 (RFC 0216 §B)\n');
+    process.exit(2);
+  }
   // Refused before anything runs: a pinned-port certification that is not
   // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
   const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);

package/src/lib/certification-bundle-v3.ts

@@ -41,12 +41,14 @@ export interface BundleV3Profile {
   readonly certified: boolean;
 }
 export interface BundleV3Relaxation { readonly obligation: string; readonly durability: 'session' | 'deployment' | 'persisted'; readonly reason: string }
+/** RFC 0216 §B — absent means the bundle measures the served host. */
+export type BundleV3Deployment = 'colocated-companion';
 export interface BundleV3Signature { readonly alg: 'ed25519'; readonly keyId: string; readonly sig: string; readonly over: readonly string[]; readonly verifierKeyId?: string }
 export interface BundleV3 {
   bundleVersion: '3';
   generatedAt: string;
   suite: { name: '@openwop/openwop-conformance'; version: string; targetMajor: 1 | 2; specArtifactsVersion: string; stampSha256?: string };
-  host: { name: string; version: string; vendor?: string; build: { kind: 'image-digest' | 'commit' | 'artifact-sha256'; id: string }; signingKeyId?: string; relaxations?: BundleV3Relaxation[] };
+  host: { name: string; version: string; vendor?: string; build: { kind: 'image-digest' | 'commit' | 'artifact-sha256'; id: string }; signingKeyId?: string; relaxations?: BundleV3Relaxation[]; deployment?: BundleV3Deployment };
   /**
    * `document` is the captured `/.well-known/openwop` payload, OPTIONAL.
    *
@@ -106,12 +108,20 @@ export { canonicalJSON } from './jcs.js';
  * from the same bundle anywhere else (Czech sorts `ch` after `h`). Every
  * committed bundle's ids are `[a-z0-9.-]`, where the two orders coincide, so no
  * stored digest changes (v2-bundle-witness-preimage.test.ts pins that).
+ *
+ * RFC 0216 §B.7 — a colocated companion's `host.deployment` joins the preimage
+ * the same way, ONLY WHEN PRESENT (`{ rows, relaxations?, deployment }`), so a
+ * signed companion cannot shed the marker and pass as a served-host bundle, and
+ * every bundle without it digests exactly as before.
  */
-export function witnessDigest(rows: readonly BundleV3Requirement[], relaxations?: readonly BundleV3Relaxation[]): string {
+export function witnessDigest(rows: readonly BundleV3Requirement[], relaxations?: readonly BundleV3Relaxation[], deployment?: BundleV3Deployment): string {
   const canonicalRows = [...rows].sort((a, b) => codeUnitCompare(a.id, b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
     // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
     ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-  const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+  const relaxed = relaxations !== undefined && relaxations.length > 0;
+  const preimage = relaxed || deployment !== undefined
+    ? { rows: canonicalRows, ...(relaxed ? { relaxations } : {}), ...(deployment !== undefined ? { deployment } : {}) }
+    : canonicalRows;
   return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 
@@ -219,8 +229,8 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   const count = (d: BundleV3Result): number => rows.filter((r) => r.result === d).length;
   const expected = { executedPass: count('executed-pass'), executedFail: count('executed-fail'), skipped: count('skipped'), inapplicable: count('inapplicable'), blocked: count('blocked') };
   for (const k of Object.keys(expected) as (keyof typeof expected)[]) if (bundle.results?.totals?.[k] !== expected[k]) rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-  const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations));
-  if (digest !== undefined && bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
+  const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations, bundle.host?.deployment));
+  if (digest !== undefined && bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows, declared relaxations and deployment marker (${digest.slice(0, 12)})` });
   const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
   if (bundle.assertionCount !== assertions) rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });
   const nonPass = rows.filter((r) => r.result !== 'executed-pass');

package/src/lib/certification-bundle-verify.ts

@@ -354,6 +354,26 @@ export function scrubEvidence<T>(value: T, secrets: readonly string[]): ScrubRes
  * are excluded, and a caller may name values that MUST stay visible (`except`)
  * regardless of which variable carried them.
  */
+/**
+ * Whether an environment VALUE can be a credential at all (suite 2.40.3).
+ *
+ * The name filter above matches settings ABOUT secrets as well as secrets:
+ * openwop-app's `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` (RFC 0201's
+ * rotation overlap) was swept in, and `scrubEvidence` then rewrote every "60"
+ * in the bundle — including the one inside `discovery.sha256`, which stopped
+ * matching `^[0-9a-f]{64}$` and failed the host's own deploy certify. A short
+ * value occurs by chance inside digests, counts and timestamps, so scrubbing it
+ * corrupts the evidence without protecting anything: no credential is a bare
+ * integer or under 8 characters (NIST SP 800-63B's floor for a memorized
+ * secret). The floor applies only to values GUESSED from variable names; a
+ * credential the emitter hands over explicitly (`extra`) is always scrubbed,
+ * whatever its shape.
+ */
+export function credentialShaped(v: string): boolean {
+  const t = v.trim();
+  return t.length >= 8 && !/^\d+$/.test(t);
+}
+
 export function evidenceSecretsFromEnv(
   env: NodeJS.ProcessEnv,
   extra: readonly (string | undefined)[] = [],
@@ -365,7 +385,9 @@ export function evidenceSecretsFromEnv(
     if (!k.startsWith('OPENWOP_')) continue;
     if (!/(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/.test(k)) continue;
     if (/_ID$/.test(k)) continue; // a key's identifier is published, not secret
-    if (v !== undefined && v.trim() !== '' && !keep.has(v)) out.add(v);
+    if (v === undefined || v.trim() === '' || keep.has(v)) continue;
+    if (!credentialShaped(v)) continue; // a setting that names a secret, not a secret
+    out.add(v);
   }
   for (const s of extra) if (s !== undefined && s.trim() !== '' && !keep.has(s)) out.add(s);
   out.add(CONFORMANCE_SECRET_CANARY);

package/src/lib/harness-issuer.ts

@@ -0,0 +1,101 @@
+/**
+ * The suite's harness OIDC issuer, as an INSTRUMENT a host claims.
+ *
+ * Two major-2 scenarios need a token the host would accept, and the suite can
+ * mint one only with a key it holds: `v2-oidc-id-token-audience` (RFC 0200 §D)
+ * and `v2-lane-exp-only-bound` (RFC 0210 §B). The suite holds the key of exactly
+ * one issuer, the one it stands up at `OPENWOP_TEST_OIDC_ISSUER_URL`.
+ *
+ * ── Why the gate reads the host's lane, not only the environment ────────────
+ * Until 2.40.2 both files recorded `blocked` whenever the harness was not the
+ * host's trust root. A PRODUCTION host MUST NOT trust a test issuer — a deployed
+ * service that accepts tokens signed by a key living on a test runner has an
+ * authentication bypass — so every honest production bundle advertising an
+ * `oidc` or `exp-only` lane carried `blocked` rows, and RFC 0168 §E.1 makes one
+ * `blocked` row deny certification bundle-wide. Measured on openwop-app
+ * (ADR 0745 corpus defect 1); MyndHyve is in the same position.
+ *
+ * RFC 0168 §C.1 already rules on this shape for the other suite instrument a
+ * host has to be configured for, the seams profile: "a scenario that finds the
+ * exact advert absent records `inapplicable` — never `blocked`, which is
+ * reserved for an advertised profile whose seam does not answer". The harness
+ * issuer is claimed the same way, by the host's own advertisement: a lane's
+ * `issuers[]` (`spec/v2/facets/auth.schema.json`) names the trust roots that
+ * lane accepts. So:
+ *
+ *   - the lane's `issuers[]` does not name the harness URL (or no harness URL is
+ *     configured) → `inapplicable`, and the reason names the issuers the host
+ *     DOES trust — a fact about the host, not about the suite;
+ *   - the lane names it → the host has claimed the instrument; a harness that
+ *     cannot be served, or a control token the host then refuses, is `blocked`
+ *     or a failure exactly as before.
+ *
+ * The cost, stated rather than hidden: a production bundle no longer witnesses
+ * these rows at all, just as it witnesses no seam-gated row. The witness comes
+ * from a cut whose lane advertises the harness issuer — the reference host, or
+ * a colocated boot of the same release image.
+ *
+ * ── Reachability ─────────────────────────────────────────────────────────────
+ * The PORT is `issuerListenPort()` (2.39.4: `OPENWOP_TEST_OIDC_ISSUER_PORT`,
+ * else the URL's port). The BIND is `receiverBinding()`, as for the webhook
+ * receiver and the OAuth doubles: loopback, or `0.0.0.0` when
+ * `OPENWOP_CONFORMANCE_HARNESS_HOST` says the host is in a container or on
+ * another box. Until 2.40.2 the issuer always bound `127.0.0.1`, so a host in a
+ * Linux container reaching it through `host-gateway` found nothing listening on
+ * the interface it arrived at (openwop-app ADR 0745 defect 2). The URL is what
+ * the host was configured with and is what `iss` and discovery carry; only the
+ * listening socket moves.
+ */
+
+import { createServer, type Server } from 'node:http';
+import { receiverBinding } from './webhook-receiver.js';
+import { issuerListenPort, type SyntheticOIDCIssuer } from './oidc-issuer.js';
+
+const norm = (u: string): string => u.trim().replace(/\/+$/, '');
+
+export type HarnessClaim =
+  | { readonly ok: true; readonly url: string }
+  | { readonly ok: false; readonly kind: 'inapplicable'; readonly reason: string };
+
+/**
+ * Has the host claimed the harness issuer on `lane`? Pure: decided from the
+ * advertised lane record and the configured harness URL.
+ */
+export function harnessClaimed(lane: Readonly<Record<string, unknown>>, harnessUrl: string | undefined): HarnessClaim {
+  const name = String(lane['lane']);
+  const issuers = Array.isArray(lane['issuers']) ? (lane['issuers'] as unknown[]).filter((x): x is string => typeof x === 'string') : [];
+  const listed = issuers.length > 0 ? issuers.join(', ') : 'none';
+  const url = harnessUrl?.trim();
+  if (!url) {
+    return { ok: false, kind: 'inapplicable', reason: `lane ${name} trusts ${listed}, and no harness issuer is configured (OPENWOP_TEST_OIDC_ISSUER_URL unset): the suite holds a signing key for none of the host's trust roots, so no token it mints could be accepted. A host claims the harness by listing it in the lane's issuers[] (RFC 0168 §C.1's reading for suite instruments)` };
+  }
+  if (!issuers.some((i) => norm(i) === norm(url))) {
+    return { ok: false, kind: 'inapplicable', reason: `lane ${name} trusts ${listed}, which does not include the harness issuer ${url}: this host has not claimed the suite's issuer as a trust root (a production host must not), so the suite holds no key the host accepts. RFC 0168 §C.1's reading for suite instruments — witnessed on a cut whose lane lists the harness` };
+  }
+  return { ok: true, url: norm(url) };
+}
+
+/** Serve `issuer`'s discovery + JWKS for the host to fetch. Resolves to the listening server. */
+export async function serveHarnessIssuer(issuer: SyntheticOIDCIssuer, url: string): Promise<Server> {
+  const port = issuerListenPort(url);
+  const { bind } = receiverBinding();
+  const srv = createServer((r, res) => {
+    if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(issuer.jwksJson); return; }
+    if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(issuer.discoveryJson); return; }
+    res.writeHead(404); res.end();
+  });
+  // Two scenario files serve the one issuer URL, and vitest runs files in
+  // parallel: wait for the holder to close rather than fail (each instance has
+  // its own kid, so a host that cached the other file's JWKS re-fetches).
+  const deadline = Date.now() + 25_000;
+  for (;;) {
+    const e = await new Promise<NodeJS.ErrnoException | null>((ok) => {
+      const onErr = (err: NodeJS.ErrnoException): void => ok(err);
+      srv.once('error', onErr);
+      srv.listen(port, bind, () => { srv.off('error', onErr); ok(null); });
+    });
+    if (e === null) return srv;
+    if (e.code !== 'EADDRINUSE' || Date.now() > deadline) throw e;
+    await new Promise((ok) => setTimeout(ok, 250));
+  }
+}

package/src/scenarios/certification-bundle-redaction.test.ts

@@ -141,17 +141,40 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
 
   it('evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary', () => {
     const env = {
-      OPENWOP_API_KEY: 'k1',
-      OPENWOP_MESSAGING_BRIDGE_TOKEN: 't1',
-      OPENWOP_DB_PASSWORD: 'p1',
-      OPENWOP_CLIENT_SECRET: 's1',
+      OPENWOP_API_KEY: 'k1-api-key-value',
+      OPENWOP_MESSAGING_BRIDGE_TOKEN: 't1-bridge-token',
+      OPENWOP_DB_PASSWORD: 'p1-db-password',
+      OPENWOP_CLIENT_SECRET: 's1-client-secret',
       OPENWOP_BASE_URL: 'https://example.invalid', // not a secret
       OPENWOP_REQUIRE_BEHAVIOR: 'true',
       PATH: '/usr/bin',
       SOME_OTHER_TOKEN: 'not-ours',
     } as NodeJS.ProcessEnv;
     const secrets = evidenceSecretsFromEnv(env, [API_KEY, undefined, '']);
-    expect(secrets.sort(), req('openwop.it.certification-bundle-redaction.evidencesecretsfromenv-selects-openwop-key-token-secret-password-variables-the-h', 'RFC 0148 §C', 'evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary')).toEqual([API_KEY, 'k1', 'p1', 's1', 't1', CONFORMANCE_SECRET_CANARY].sort());
+    expect(secrets.sort(), req('openwop.it.certification-bundle-redaction.evidencesecretsfromenv-selects-openwop-key-token-secret-password-variables-the-h', 'RFC 0148 §C', 'evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary')).toEqual([API_KEY, 'k1-api-key-value', 'p1-db-password', 's1-client-secret', 't1-bridge-token', CONFORMANCE_SECRET_CANARY].sort());
+  });
+
+  it('evidenceSecretsFromEnv never treats a setting ABOUT a secret as one: a bare integer or a value under 8 characters is not swept from the environment', () => {
+    // Suite 2.40.2: openwop-app set OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60,
+    // the name matched SECRET, and scrubEvidence rewrote the "60" inside
+    // discovery.sha256 — the bundle failed ^[0-9a-f]{64}$ and main could not deploy.
+    const digest = '4b8d99c002a061a0255e8224ee683162007febadd251b2d171b47c0849695315';
+    const env = {
+      OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S: '60',
+      OPENWOP_TOKEN_TTL_SECONDS_KEY: '86400000',
+      OPENWOP_SHORT_KEY: 'abc1234',
+      OPENWOP_REAL_SECRET: 'whsec_c2VjcmV0LXZhbHVl',
+    } as NodeJS.ProcessEnv;
+    const secrets = evidenceSecretsFromEnv(env, ['k9']);
+    const R = 'openwop.it.certification-bundle-redaction.setting-about-a-secret-not-swept';
+    expect(secrets, req(R, 'RFC 0148 §C', 'a bare-integer setting whose NAME mentions a secret (a rotation overlap, a TTL) MUST NOT be swept as a credential')).not.toContain('60');
+    expect(secrets).not.toContain('86400000');
+    expect(secrets, req(R, 'RFC 0148 §C', 'a value under 8 characters is not credential-shaped and is not swept from the environment')).not.toContain('abc1234');
+    expect(secrets, req(R, 'RFC 0148 §C', 'a credential-shaped value is still swept')).toContain('whsec_c2VjcmV0LXZhbHVl');
+    expect(secrets, req(R, 'RFC 0148 §C', 'a credential the emitter hands over explicitly is scrubbed whatever its shape')).toContain('k9');
+    const { value } = scrubEvidence({ discovery: { sha256: digest } }, secrets);
+    expect(value.discovery.sha256, req(R, 'RFC 0148 §C', 'scrubbing MUST NOT corrupt a digest the bundle carries')).toBe(digest);
+    expect(value.discovery.sha256).toMatch(/^[0-9a-f]{64}$/);
   });
 
   it('evidenceSecretsFromEnv never scrubs a key IDENTIFIER: *_ID variables are excluded and `except` values stay visible whichever variable carried them', () => {
@@ -162,14 +185,14 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
       OPENWOP_BUNDLE_SIGNING_KEY: '-----BEGIN PRIVATE KEY-----\nsecret\n-----END PRIVATE KEY-----',
       OPENWOP_BUNDLE_SIGNING_KEY_ID: 'myndhyve-bundle-2026-09',
       OPENWOP_BUNDLE_VERIFIER_KEY_ID: 'steward-verifier-1',
-      OPENWOP_API_KEY: 'k1',
+      OPENWOP_API_KEY: 'k1-api-key-value',
       OPENWOP_ODDLY_NAMED_KEY: 'published-key-id-in-a-secret-shaped-variable',
     } as NodeJS.ProcessEnv;
     const secrets = evidenceSecretsFromEnv(env, [], ['published-key-id-in-a-secret-shaped-variable']);
     expect(secrets, req('openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed', 'RFC 0168 §E.2', 'the keyId a host publishes in discovery.document.signingKeys[] MUST survive evidence scrubbing — a *_ID variable is an identifier, not a secret')).not.toContain('myndhyve-bundle-2026-09');
     expect(secrets).not.toContain('steward-verifier-1');
     expect(secrets, req('openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed', 'RFC 0168 §E.2', 'a value the emitter names as `except` (the keyId it is about to publish) is never scrubbed, whichever variable carried it')).not.toContain('published-key-id-in-a-secret-shaped-variable');
-    expect(secrets).toContain('k1');
+    expect(secrets).toContain('k1-api-key-value');
     expect(secrets.some((s) => s.includes('BEGIN PRIVATE KEY'))).toBe(true);
     expect(secrets).toContain(CONFORMANCE_SECRET_CANARY);
   });

package/src/scenarios/v2-lane-exp-only-bound.test.ts

@@ -23,9 +23,14 @@
  * test.
  *
  * **Gate:** an advertised `auth.lanes[]` member with `revocation: "exp-only"`
- * (`inapplicable`, naming that, otherwise) AND `OPENWOP_TEST_OIDC_ISSUER_URL` naming a
- * synthetic issuer the operator has configured that lane to trust (`blocked` otherwise —
- * without a token the host would ever accept, "it refused a string" witnesses nothing).
+ * (`inapplicable`, naming that, otherwise) whose `issuers[]` lists
+ * `OPENWOP_TEST_OIDC_ISSUER_URL`, the synthetic issuer the suite holds the key for. A lane
+ * that does not list it records `inapplicable` naming the issuers it does trust: the
+ * harness is a suite instrument the host claims by advertising it (RFC 0168 §C.1's reading
+ * for the seams profile; lib/harness-issuer.ts), and a production host must never trust a
+ * test issuer. Corrected in 2.40.1; this was `blocked`, which denied certification to
+ * every honest production bundle. A claimed harness that cannot be served is `blocked` —
+ * without a token the host would ever accept, "it refused a string" witnesses nothing.
  * A window under 120 s is `blocked`: the control token needs room inside it.
  *
  * **Each refusal leg is skewed so it isolates ONE bound.** A token minted at `now` with
@@ -54,13 +59,14 @@
 
 import { afterAll, describe, it, expect } from 'vitest';
 import { randomBytes } from 'node:crypto';
-import { createServer, type Server } from 'node:http';
+import type { Server } from 'node:http';
 import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { v2Discovery, familyAdvertised } from '../lib/v2.js';
-import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { harnessClaimed, serveHarnessIssuer } from '../lib/harness-issuer.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
   'the suite stands up the synthetic OIDC issuer and the host fetches its JWKS; no request returns to the suite\'s own API, so no host-reachable callback is needed';
@@ -113,23 +119,20 @@ async function gate(): Promise<Gate | { readonly kind: 'inapplicable' | 'blocked
   if (window < 2 * MARGIN) {
     return { kind: 'blocked', reason: `lane ${String(lane['lane'])} advertises a ${window}s window; the control token needs ${MARGIN}s of room inside it and the sabotage tokens ${MARGIN}s outside, so a window under ${2 * MARGIN}s cannot be probed without the two cases overlapping` };
   }
-  const url = process.env['OPENWOP_TEST_OIDC_ISSUER_URL']?.trim();
-  if (!url) {
-    return { kind: 'blocked', reason: 'OPENWOP_TEST_OIDC_ISSUER_URL is not set — without an issuer the host is configured to trust, every minted token is refused for the wrong reason and the control leg (which is what makes the refusals non-vacuous) cannot run' };
-  }
+  // The harness is an instrument the host claims by listing it in THIS lane's issuers[]
+  // (RFC 0168 §C.1's reading; lib/harness-issuer.ts). A production host lists its real
+  // IdP and must never list a test issuer, so it records `inapplicable` naming the issuers
+  // it does trust. Before 2.40.1 this was `blocked`, which denied certification to every
+  // honest production bundle advertising an exp-only lane.
+  const claim = harnessClaimed(lane, process.env['OPENWOP_TEST_OIDC_ISSUER_URL']);
+  if (!claim.ok) return { kind: claim.kind, reason: claim.reason };
+  const url = claim.url;
   const audience = process.env['OPENWOP_TEST_OIDC_AUDIENCE']?.trim() ?? 'openwop-conformance';
   if (issuer === null) {
     const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-    const srv = createServer((r, res) => {
-      if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
-      if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
-      res.writeHead(404); res.end();
-    });
-    await new Promise<void>((resolve, reject) => {
-      srv.once('error', reject);
-      srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
-    });
-    server = srv;
+    try { server = await serveHarnessIssuer(made, url); } catch (e) {
+      return { kind: 'blocked', reason: `lane ${String(lane['lane'])} lists the harness issuer, but it could not be served for ${url}: ${(e as Error).message}` };
+    }
     issuer = made;
   }
   return { issuer, url, window, lane: String(lane['lane']) };

package/src/scenarios/v2-oidc-id-token-audience.test.ts

@@ -10,10 +10,14 @@
  * ID-token case explicitly as admissible under the audience MUST `identity.md` §2.1
  * already carries, and refuses everything else.
  *
- * **Gate:** an advertised `oidc` lane AND `OPENWOP_TEST_OIDC_ISSUER_URL` naming a
- * synthetic issuer the host trusts as that lane's trust root. Without the harness issuer
- * the suite cannot mint a token the host would ever accept, so the leg is `blocked` — an
- * assertion that a random string is refused would witness nothing.
+ * **Gate:** an advertised `oidc` lane whose `issuers[]` lists `OPENWOP_TEST_OIDC_ISSUER_URL`,
+ * the synthetic issuer the suite holds the key for. A lane that does not list it (every
+ * production host, which must not trust a test issuer) records `inapplicable`, naming the
+ * issuers it does trust — the harness is a suite instrument the host claims by advertising
+ * it, RFC 0168 §C.1's reading for the seams profile (lib/harness-issuer.ts; corrected in
+ * 2.40.1, when this was `blocked` and denied certification to every production bundle).
+ * A claimed harness that cannot be served, or whose same-audience control is refused, is
+ * `blocked`: an assertion that a random string is refused would witness nothing.
  *
  * `HOST_CALLBACK_NOT_REQUIRED`: the suite stands the issuer up itself and the host reaches
  * it for JWKS; nothing calls back into the suite's own API.
@@ -29,13 +33,14 @@
 
 import { afterAll, describe, it, expect } from 'vitest';
 import { randomBytes } from 'node:crypto';
-import { createServer, type Server } from 'node:http';
+import type { Server } from 'node:http';
 import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 import { prmGate } from '../lib/protected-resource.js';
+import { harnessClaimed, serveHarnessIssuer } from '../lib/harness-issuer.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
   'the suite stands up the synthetic OIDC issuer and the host fetches its JWKS; no request returns to the suite\'s own API, so no host-reachable callback is needed';
@@ -50,22 +55,11 @@ afterAll(async () => {
   issuer = null;
 });
 
-/** Stand the issuer up on the URL the operator told the host to trust. */
-async function harness(audience: string): Promise<{ url: string; issuer: SyntheticOIDCIssuer } | null> {
-  const url = process.env['OPENWOP_TEST_OIDC_ISSUER_URL']?.trim();
-  if (!url) return null;
+/** Stand the issuer up on the URL the host's oidc lane lists (the claim is checked by the caller). */
+async function harness(url: string, audience: string): Promise<{ url: string; issuer: SyntheticOIDCIssuer } | string> {
   if (issuer !== null) return { url, issuer };
   const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-  const srv = createServer((r, res) => {
-    if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
-    if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
-    res.writeHead(404); res.end();
-  });
-  await new Promise<void>((resolve, reject) => {
-    srv.once('error', reject);
-    srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
-  });
-  server = srv;
+  try { server = await serveHarnessIssuer(made, url); } catch (e) { return `the harness issuer could not be served for ${url}: ${(e as Error).message}`; }
   issuer = made;
   return { url, issuer: made };
 }
@@ -76,9 +70,16 @@ describe('RFC 0200 §D — v2-oidc-id-token-audience (gated on an oidc lane and
     if (!g.ok) return softSkip(g.kind, g.reason);
     const oidc = g.lanes.find((l) => l.lane === 'oidc');
     if (oidc === undefined) return softSkip('inapplicable', 'no oidc lane advertised — §D names the ID-token case ON that lane and binds no other');
+    // The harness is an instrument the host claims by listing it in the lane's issuers[]
+    // (RFC 0168 §C.1's reading; lib/harness-issuer.ts). A production host lists its real
+    // IdP and must never list a test issuer, so that host records `inapplicable` with the
+    // issuers it does trust, not `blocked` — before 2.40.1 this was `blocked` and denied
+    // certification to every honest production bundle with an oidc lane.
+    const claim = harnessClaimed(oidc as unknown as Record<string, unknown>, process.env['OPENWOP_TEST_OIDC_ISSUER_URL']);
+    if (!claim.ok) return softSkip(claim.kind, claim.reason);
     const audience = process.env['OPENWOP_TEST_OIDC_AUDIENCE']?.trim() ?? 'openwop-conformance';
-    const h = await harness(audience);
-    if (h === null) return softSkip('blocked', 'OPENWOP_TEST_OIDC_ISSUER_URL is not set — without an issuer the host trusts, no minted token could ever be accepted and the admissible half of §D cannot run');
+    const h = await harness(claim.url, audience);
+    if (typeof h === 'string') return softSkip('blocked', `the oidc lane lists the harness issuer, but ${h}`);
 
     // An ID token, not an access token: `nonce` and `auth_time` are what make it one.
     const good = h.issuer.mint({ sub: `conformance-${randomBytes(6).toString('hex')}`, nonce: randomBytes(8).toString('hex'), auth_time: Math.floor(Date.now() / 1000) });
@@ -90,7 +91,7 @@ describe('RFC 0200 §D — v2-oidc-id-token-audience (gated on an oidc lane and
     // acceptance DOES establish, once it holds, is that the refusal below is caused by the
     // audience and by nothing else: same issuer, same key, same token shape.
     if (probe.status === 401) {
-      return softSkip('blocked', `a same-audience ID token from ${h.url} was refused (401 ${readErrorCode(probe.json) ?? ''}) — either the host does not trust the harness issuer as its oidc lane trust root, or OPENWOP_TEST_OIDC_AUDIENCE does not name the audience it is configured with; with no accepted token the foreign-audience refusal would prove nothing`);
+      return softSkip('blocked', `a same-audience ID token from ${h.url} was refused (401 ${readErrorCode(probe.json) ?? ''}) although the oidc lane lists that issuer — either the host's trust configuration does not match its advertisement, or OPENWOP_TEST_OIDC_AUDIENCE does not name the audience it is configured with; with no accepted token the foreign-audience refusal would prove nothing`);
     }
 
     const foreign = h.issuer.mint({ sub: `conformance-${randomBytes(6).toString('hex')}`, aud: `other-client-${randomBytes(6).toString('hex')}`, nonce: randomBytes(8).toString('hex'), auth_time: Math.floor(Date.now() / 1000) });

package/src/scenarios/v2-revocation-honored.test.ts

@@ -11,7 +11,9 @@
  * drives `POST /conformance/seams/sample/auth/credential/{mint,revoke}` (the
  * v1-shaped address `/v1/host/sample/auth/credential/…` through `seamPath()`)
  * with `{ lane }` / `{ lane, credential }` and records `blocked` when the host
- * does not mount it. Windowed lanes (`exp-and-recheck`, `short-lived`, `rebind`)
+ * does not mount it. A mint answer carrying `presentation: { kind: "cookie", name }`
+ * (2.40.3) is presented as `Cookie: <name>=<credential>`, so a cookie-borne
+ * `session` lane is witnessed as its production credential travels; bearer otherwise. Windowed lanes (`exp-and-recheck`, `short-lived`, `rebind`)
  * have no wire-observable "next request" and record `inapplicable`.
  */
 
@@ -48,17 +50,22 @@ describe('v2 revocation-honored (RFC 0170 §B.3 — seam-gated)', () => {
       const minted = await http(() => driver.post(MINT, { lane }));
       if (minted === null) return softSkip('blocked', `${MINT} unreachable (fetch failed)`);
       if (minted.status === 404 || minted.status === 403) return seamAbsent(`${MINT} not mounted (${minted.status}) — the host advertises the seams profile but does not serve the RFC 0170 §B.3 credential mint/revoke seams (api/seams-v2.yaml mintLaneCredential / revokeLaneCredential; host-sample-test-seams.md)`);
-      const credential = (minted.json as { credential?: unknown } | undefined)?.credential;
+      const body = minted.json as { credential?: unknown; presentation?: { kind?: unknown; name?: unknown } } | undefined;
+      const credential = body?.credential;
+      // 2.40.3 — a cookie-borne lane (a `session` lane) is presented the way its
+      // production credential is, `Cookie: <name>=<credential>`. Bearer otherwise.
+      const cookieName = body?.presentation?.kind === 'cookie' && typeof body.presentation.name === 'string' ? body.presentation.name : null;
+      const present = (c: unknown): Record<string, string> => (cookieName ? { Cookie: `${cookieName}=${String(c)}` } : { Authorization: `Bearer ${String(c)}` });
       expect(typeof credential, req('openwop.requirement.0170.revocation-honored', DOC, `the mint seam MUST answer { credential } for lane ${lane}`)).toBe('string');
 
       // Positive control — the minted credential authenticates before revocation.
-      const before = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: { Authorization: `Bearer ${String(credential)}` } }));
+      const before = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: present(credential) }));
       expect(before !== null && before.status !== 401, req('openwop.requirement.0170.revocation-honored', DOC, `a freshly minted ${lane} credential MUST authenticate before revocation (got ${before?.status ?? 'no response'})`)).toBe(true);
 
       const revoked = await http(() => driver.post(REVOKE, { lane, credential }));
       expect(revoked !== null && revoked.status < 400, req('openwop.requirement.0170.revocation-honored', DOC, `the revoke seam MUST accept the credential it minted for lane ${lane} (got ${revoked?.status ?? 'no response'})`)).toBe(true);
 
-      const after = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: { Authorization: `Bearer ${String(credential)}` } }));
+      const after = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: present(credential) }));
       expect(after?.status, req('openwop.requirement.0170.revocation-honored', DOC, `lane ${lane} MUST refuse a revoked credential on the next request with 401`)).toBe(401);
       expect(readErrorCode(after?.json), req('openwop.requirement.0170.revocation-honored', DOC, `the refusal code MUST be credential_revoked (lane ${lane})`)).toBe('credential_revoked');
     }