@openwop/openwop-conformance 2.40.2 → 2.40.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.40.3] — 2026-09-26 — a cookie-borne lane can be revoke-witnessed, and a secret-named setting no longer corrupts the discovery digest
+
+- **`v2-revocation-honored` presents a cookie-lane credential as a cookie.** When the mint seam answers `presentation: { kind: "cookie", name }`, the probe sends `Cookie: <name>=<credential>` instead of a bearer token. The seams contract's `mintLaneCredential` response gains that optional member. Bearer stays the default when `presentation` is absent. The cookie branch is unexercised until a host serves it; openwop-app's `session` lane is the first expected.
+- **RFC 0215 gap G1 closes in the contract peer.** `@openwop/spec-artifacts`' `spec/v1/gaps.json` records MyndHyve's measurement (openwop#1595), and `spec/v2/core/webhooks.md`'s `Stable` banner cites RFC 0215 now that it is `Accepted`. No scenario change.
+- **A setting that names a secret is not scrubbed as one.** `evidenceSecretsFromEnv` sweeps every `OPENWOP_*` value whose NAME mentions a key/token/secret/password, and `scrubEvidence` then rewrites that value everywhere in the bundle. openwop-app's RFC 0201 setting `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` was swept, the "60" inside `discovery.sha256` was rewritten, the bundle failed `^[0-9a-f]{64}$`, and its deploy certify refused to ship. Values guessed from names are now swept only when credential-shaped (at least 8 characters and not a bare integer); a credential the emitter hands over explicitly is scrubbed whatever its shape. Sabotage: without the floor the new redaction leg fails.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.40.3` because `2.40.2` is tagged. Not tagged, not published.
+
 ## [2.40.2] — 2026-09-26 — production bundles stop carrying harness-issuer blocked rows, and a colocated companion is marked
 
 - **RFC 0216: `--as-colocated-companion`, and a companion witnesses only the harness-trust-anchor rows.** The flag marks a v3 bundle `host.deployment: "colocated-companion"`. It is refused without `--certify` and bundle version 3. `witnessDigest` takes the marker into the preimage when present (`{ rows, relaxations?, deployment }`), so a signed companion cannot shed it: `--verify` then refuses with `witness-digest`. New coherence scenario `v2-colocated-companion` (7 legs, one id each) drives `scripts/check-harness-trust-anchors.mjs` and `scripts/check-companion-pairing.mjs` on tmpdir fixtures signed by the suite's own `signBundleV3`. Five sabotages were each run red.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.2 @openwop/spec-artifacts@2.40.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.3 @openwop/spec-artifacts@2.40.3
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/lib/certification-bundle-verify.js

@@ -267,6 +267,25 @@ export function scrubEvidence(value, secrets) {
  * are excluded, and a caller may name values that MUST stay visible (`except`)
  * regardless of which variable carried them.
  */
+/**
+ * Whether an environment VALUE can be a credential at all (suite 2.40.3).
+ *
+ * The name filter above matches settings ABOUT secrets as well as secrets:
+ * openwop-app's `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` (RFC 0201's
+ * rotation overlap) was swept in, and `scrubEvidence` then rewrote every "60"
+ * in the bundle — including the one inside `discovery.sha256`, which stopped
+ * matching `^[0-9a-f]{64}$` and failed the host's own deploy certify. A short
+ * value occurs by chance inside digests, counts and timestamps, so scrubbing it
+ * corrupts the evidence without protecting anything: no credential is a bare
+ * integer or under 8 characters (NIST SP 800-63B's floor for a memorized
+ * secret). The floor applies only to values GUESSED from variable names; a
+ * credential the emitter hands over explicitly (`extra`) is always scrubbed,
+ * whatever its shape.
+ */
+export function credentialShaped(v) {
+    const t = v.trim();
+    return t.length >= 8 && !/^\d+$/.test(t);
+}
 export function evidenceSecretsFromEnv(env, extra = [], except = []) {
     const keep = new Set(except.filter((s) => s !== undefined && s.trim() !== ''));
     const out = new Set();
@@ -277,8 +296,11 @@ export function evidenceSecretsFromEnv(env, extra = [], except = []) {
             continue;
         if (/_ID$/.test(k))
             continue; // a key's identifier is published, not secret
-        if (v !== undefined && v.trim() !== '' && !keep.has(v))
-            out.add(v);
+        if (v === undefined || v.trim() === '' || keep.has(v))
+            continue;
+        if (!credentialShaped(v))
+            continue; // a setting that names a secret, not a secret
+        out.add(v);
     }
     for (const s of extra)
         if (s !== undefined && s.trim() !== '' && !keep.has(s))

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.2",
-  "stampSha256": "5b784776f9088d58f1fd29e14efa113715876aac5940b728f775a779c59a962a"
+  "version": "2.40.3",
+  "stampSha256": "a3da70b5c189e692914fd3516f841bfaff477a365503009b761bccc1842f43e2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.40.2",
+  "version": "2.40.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.40.2"
+    "@openwop/spec-artifacts": "2.40.3"
   }
 }

package/requirements.json

@@ -3,10 +3,10 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 636,
-    "tests": 2437,
-    "withStableId": 2437,
+    "tests": 2438,
+    "withStableId": 2438,
     "interpolatedTitles": 0,
-    "explicitIds": 2331
+    "explicitIds": 2332
   },
   "records": [
     {
@@ -7170,9 +7170,38 @@
       ]
     },
     {
-      "id": "openwop.it.certification-bundle-redaction.evidencesecretsfromenv-never-scrubs-a-key-identifier-id-variables-are-excluded-a",
+      "id": "openwop.it.certification-bundle-redaction.evidencesecretsfromenv-never-treats-a-setting-about-a-secret-as-one-a-bare-integ",
       "file": "certification-bundle-redaction.test.ts",
       "line": 157,
+      "title": "evidenceSecretsFromEnv never treats a setting ABOUT a secret as one: a bare integer or a value under 8 characters is not swept from the environment",
+      "explicitId": "openwop.it.certification-bundle-redaction.setting-about-a-secret-not-swept",
+      "citations": [
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a bare-integer setting whose NAME mentions a secret (a rotation overlap, a TTL) MUST NOT be swept as a credential"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a value under 8 characters is not credential-shaped and is not swept from the environment"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a credential-shaped value is still swept"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "a credential the emitter hands over explicitly is scrubbed whatever its shape"
+        },
+        {
+          "section": "RFC 0148 §C",
+          "requirement": "scrubbing MUST NOT corrupt a digest the bundle carries"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.certification-bundle-redaction.evidencesecretsfromenv-never-scrubs-a-key-identifier-id-variables-are-excluded-a",
+      "file": "certification-bundle-redaction.test.ts",
+      "line": 180,
       "title": "evidenceSecretsFromEnv never scrubs a key IDENTIFIER: *_ID variables are excluded and `except` values stay visible whichever variable carried them",
       "explicitId": "openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed",
       "citations": [
@@ -7189,7 +7218,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 177,
+      "line": 200,
       "title": "verifyBundleV2 REJECTS a bundle carrying the conformance canary anywhere, and accepts the scrubbed twin",
       "explicitId": "openwop.it.certification-bundle-redaction.verifybundlev2-rejects-a-bundle-carrying-the-conformance-canary-anywhere-and-acc",
       "citations": [
@@ -7202,7 +7231,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.the-canary-in-a-discovery-document-key-is-still-a-rejection-keys-are-evidence",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 192,
+      "line": 215,
       "title": "the canary in a discovery-document KEY is still a rejection (keys are evidence)",
       "explicitId": "openwop.it.certification-bundle-redaction.the-canary-in-a-discovery-document-key-is-still-a-rejection-keys-are-evidence",
       "citations": [
@@ -7215,7 +7244,7 @@
     {
       "id": "openwop.it.certification-bundle-redaction.the-target-configuration-digest-is-a-digest-the-api-key-is-not-a-substring-of-an",
       "file": "certification-bundle-redaction.test.ts",
-      "line": 198,
+      "line": 221,
       "title": "the target-configuration digest is a digest: the API key is not a substring of any string in the document",
       "explicitId": "openwop.it.certification-bundle-redaction.the-target-configuration-digest-is-a-digest-the-api-key-is-not-a-substring-of-an",
       "citations": [
@@ -32080,7 +32109,7 @@
     {
       "id": "openwop.it.v2-revocation-honored.a-revoked-next-request-credential-is-refused-on-the-next-request-with-credential",
       "file": "v2-revocation-honored.test.ts",
-      "line": 38,
+      "line": 40,
       "title": "a revoked next-request credential is refused on the next request with credential_revoked",
       "explicitId": "openwop.requirement.0170.revocation-honored",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.40.2",
-  "corpusTag": "v2.40.2",
+  "version": "2.40.3",
+  "corpusTag": "v2.40.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "c92bde1fb2ac949edfb50519651ac3755cfc88b8a2a8785eab0e15bcb6a8dbb9",
-    "api/v2/asyncapi.yaml": "87d5b9de8e3fa920a0ddecce7f51018f8f573b5ef14f954973a0776d3b9d9a0f",
-    "api/v2/openapi.yaml": "532467b699c179c355349c8bb483a801156a68b003d02aa9d7cf576f867c3097",
+    "api/seams-v2.yaml": "96b5b49ba8aab1595b547d568ece7c4fb9fae9d7bdde29aff7c39f20ef31b120",
+    "api/v2/asyncapi.yaml": "cc4d94df8eb1e168f30f8c12279bc65cf34c948a5ed95cc062288728fc605618",
+    "api/v2/openapi.yaml": "5029e637cd61c900b169cb3f79e61e48b3ee89a6c3c11f3262158bf2fa910125",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "a16e3a91b9121d7b6d58fd9f65a348f92a07636417406f56bc3173571e9d55ea",
+    "spec/v1/core-standard-manifest.json": "c8d01314ab747038fb9b3ef17552d336f61211591b4af07379e65f65a6e55454",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "3decfec271c30f796ba76586ca06ab31e6ea3b8bcae174c3af0b8bb1c19709b5",
+    "spec/v1/gaps.json": "41e5bbd50515eb08923a29a79dfeb41d045f2b28dec9b2af3473c18db148c7be",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -240,7 +240,7 @@
     "spec/v2/core/security-defaults.md": "500471a8db7af9b776ac40b4a9a278c9f3d45e1c1dead880114e7fadc7bee37d",
     "spec/v2/core/tool-catalog.md": "35f1a3fd509db0fc0490ddf400686fe94dc4b20c98064d5ebe776da516153e60",
     "spec/v2/core/versioning.md": "0aded71d090c8358c3ce17763c120cfc1cc42531a5eaa1b8a2a7016ed9594069",
-    "spec/v2/core/webhooks.md": "95880896e37e5b7096693a75203cf0ed70cefa09959230e17b45aa9193078eff",
+    "spec/v2/core/webhooks.md": "2a44b100c42dd841fe2b8f87179a981be6c0dd26608ce1b14e077318c4ac8201",
     "spec/v2/core/workflow-chain-packs.md": "ee45d3fede3bb6f0cc6abcf0d6c929c7cd213a0fbe862b738a998f929c4d1102",
     "spec/v2/corrections.json": "cc74ffde74384b0f261a4f625871d922e8661d654d647a8534e21036595cb280",
     "spec/v2/corrections.schema.json": "4ac595b9a6d7f66d53de03fe0edbe0dc58de46426932387bfdc0ceb3cf949a3e",
@@ -294,9 +294,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "f04bc2406dfc3af40a495d8750349409f053bb56f009359ebc62a8877251c90f",
+    "spec/v2/release.json": "4c84997343779f46a54f9c4caf3d02714abc563f618b25729ca4b52468a23d39",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "26f2a03c650413ac9c0d0b5facee47ee0eaebeb01d377c808fe6e737bb08687c"
+    "spec/v2/surface-baseline.json": "2f1da906609307ec885cb04c36d7e688cd3124933759c88dc9ae3fa0ee9ec88b"
   },
-  "corpusCommit": "70c93c0fcd5c595893c1cac7cf1020d5c5835ec2"
+  "corpusCommit": "5d3d440cac757fb2b6c08452f64785eaeda086d3"
 }

package/src/lib/certification-bundle-verify.ts

@@ -354,6 +354,26 @@ export function scrubEvidence<T>(value: T, secrets: readonly string[]): ScrubRes
  * are excluded, and a caller may name values that MUST stay visible (`except`)
  * regardless of which variable carried them.
  */
+/**
+ * Whether an environment VALUE can be a credential at all (suite 2.40.3).
+ *
+ * The name filter above matches settings ABOUT secrets as well as secrets:
+ * openwop-app's `OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60` (RFC 0201's
+ * rotation overlap) was swept in, and `scrubEvidence` then rewrote every "60"
+ * in the bundle — including the one inside `discovery.sha256`, which stopped
+ * matching `^[0-9a-f]{64}$` and failed the host's own deploy certify. A short
+ * value occurs by chance inside digests, counts and timestamps, so scrubbing it
+ * corrupts the evidence without protecting anything: no credential is a bare
+ * integer or under 8 characters (NIST SP 800-63B's floor for a memorized
+ * secret). The floor applies only to values GUESSED from variable names; a
+ * credential the emitter hands over explicitly (`extra`) is always scrubbed,
+ * whatever its shape.
+ */
+export function credentialShaped(v: string): boolean {
+  const t = v.trim();
+  return t.length >= 8 && !/^\d+$/.test(t);
+}
+
 export function evidenceSecretsFromEnv(
   env: NodeJS.ProcessEnv,
   extra: readonly (string | undefined)[] = [],
@@ -365,7 +385,9 @@ export function evidenceSecretsFromEnv(
     if (!k.startsWith('OPENWOP_')) continue;
     if (!/(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/.test(k)) continue;
     if (/_ID$/.test(k)) continue; // a key's identifier is published, not secret
-    if (v !== undefined && v.trim() !== '' && !keep.has(v)) out.add(v);
+    if (v === undefined || v.trim() === '' || keep.has(v)) continue;
+    if (!credentialShaped(v)) continue; // a setting that names a secret, not a secret
+    out.add(v);
   }
   for (const s of extra) if (s !== undefined && s.trim() !== '' && !keep.has(s)) out.add(s);
   out.add(CONFORMANCE_SECRET_CANARY);

package/src/scenarios/certification-bundle-redaction.test.ts

@@ -141,17 +141,40 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
 
   it('evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary', () => {
     const env = {
-      OPENWOP_API_KEY: 'k1',
-      OPENWOP_MESSAGING_BRIDGE_TOKEN: 't1',
-      OPENWOP_DB_PASSWORD: 'p1',
-      OPENWOP_CLIENT_SECRET: 's1',
+      OPENWOP_API_KEY: 'k1-api-key-value',
+      OPENWOP_MESSAGING_BRIDGE_TOKEN: 't1-bridge-token',
+      OPENWOP_DB_PASSWORD: 'p1-db-password',
+      OPENWOP_CLIENT_SECRET: 's1-client-secret',
       OPENWOP_BASE_URL: 'https://example.invalid', // not a secret
       OPENWOP_REQUIRE_BEHAVIOR: 'true',
       PATH: '/usr/bin',
       SOME_OTHER_TOKEN: 'not-ours',
     } as NodeJS.ProcessEnv;
     const secrets = evidenceSecretsFromEnv(env, [API_KEY, undefined, '']);
-    expect(secrets.sort(), req('openwop.it.certification-bundle-redaction.evidencesecretsfromenv-selects-openwop-key-token-secret-password-variables-the-h', 'RFC 0148 §C', 'evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary')).toEqual([API_KEY, 'k1', 'p1', 's1', 't1', CONFORMANCE_SECRET_CANARY].sort());
+    expect(secrets.sort(), req('openwop.it.certification-bundle-redaction.evidencesecretsfromenv-selects-openwop-key-token-secret-password-variables-the-h', 'RFC 0148 §C', 'evidenceSecretsFromEnv selects OPENWOP_* key/token/secret/password variables, the handed credential, and ALWAYS the canary')).toEqual([API_KEY, 'k1-api-key-value', 'p1-db-password', 's1-client-secret', 't1-bridge-token', CONFORMANCE_SECRET_CANARY].sort());
+  });
+
+  it('evidenceSecretsFromEnv never treats a setting ABOUT a secret as one: a bare integer or a value under 8 characters is not swept from the environment', () => {
+    // Suite 2.40.2: openwop-app set OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S=60,
+    // the name matched SECRET, and scrubEvidence rewrote the "60" inside
+    // discovery.sha256 — the bundle failed ^[0-9a-f]{64}$ and main could not deploy.
+    const digest = '4b8d99c002a061a0255e8224ee683162007febadd251b2d171b47c0849695315';
+    const env = {
+      OPENWOP_WEBHOOK_SECRET_ROTATION_OVERLAP_S: '60',
+      OPENWOP_TOKEN_TTL_SECONDS_KEY: '86400000',
+      OPENWOP_SHORT_KEY: 'abc1234',
+      OPENWOP_REAL_SECRET: 'whsec_c2VjcmV0LXZhbHVl',
+    } as NodeJS.ProcessEnv;
+    const secrets = evidenceSecretsFromEnv(env, ['k9']);
+    const R = 'openwop.it.certification-bundle-redaction.setting-about-a-secret-not-swept';
+    expect(secrets, req(R, 'RFC 0148 §C', 'a bare-integer setting whose NAME mentions a secret (a rotation overlap, a TTL) MUST NOT be swept as a credential')).not.toContain('60');
+    expect(secrets).not.toContain('86400000');
+    expect(secrets, req(R, 'RFC 0148 §C', 'a value under 8 characters is not credential-shaped and is not swept from the environment')).not.toContain('abc1234');
+    expect(secrets, req(R, 'RFC 0148 §C', 'a credential-shaped value is still swept')).toContain('whsec_c2VjcmV0LXZhbHVl');
+    expect(secrets, req(R, 'RFC 0148 §C', 'a credential the emitter hands over explicitly is scrubbed whatever its shape')).toContain('k9');
+    const { value } = scrubEvidence({ discovery: { sha256: digest } }, secrets);
+    expect(value.discovery.sha256, req(R, 'RFC 0148 §C', 'scrubbing MUST NOT corrupt a digest the bundle carries')).toBe(digest);
+    expect(value.discovery.sha256).toMatch(/^[0-9a-f]{64}$/);
   });
 
   it('evidenceSecretsFromEnv never scrubs a key IDENTIFIER: *_ID variables are excluded and `except` values stay visible whichever variable carried them', () => {
@@ -162,14 +185,14 @@ describe('RFC 0148 §C — certification-bundle-redaction: secret canaries never
       OPENWOP_BUNDLE_SIGNING_KEY: '-----BEGIN PRIVATE KEY-----\nsecret\n-----END PRIVATE KEY-----',
       OPENWOP_BUNDLE_SIGNING_KEY_ID: 'myndhyve-bundle-2026-09',
       OPENWOP_BUNDLE_VERIFIER_KEY_ID: 'steward-verifier-1',
-      OPENWOP_API_KEY: 'k1',
+      OPENWOP_API_KEY: 'k1-api-key-value',
       OPENWOP_ODDLY_NAMED_KEY: 'published-key-id-in-a-secret-shaped-variable',
     } as NodeJS.ProcessEnv;
     const secrets = evidenceSecretsFromEnv(env, [], ['published-key-id-in-a-secret-shaped-variable']);
     expect(secrets, req('openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed', 'RFC 0168 §E.2', 'the keyId a host publishes in discovery.document.signingKeys[] MUST survive evidence scrubbing — a *_ID variable is an identifier, not a secret')).not.toContain('myndhyve-bundle-2026-09');
     expect(secrets).not.toContain('steward-verifier-1');
     expect(secrets, req('openwop.it.certification-bundle-redaction.key-identifier-never-scrubbed', 'RFC 0168 §E.2', 'a value the emitter names as `except` (the keyId it is about to publish) is never scrubbed, whichever variable carried it')).not.toContain('published-key-id-in-a-secret-shaped-variable');
-    expect(secrets).toContain('k1');
+    expect(secrets).toContain('k1-api-key-value');
     expect(secrets.some((s) => s.includes('BEGIN PRIVATE KEY'))).toBe(true);
     expect(secrets).toContain(CONFORMANCE_SECRET_CANARY);
   });

package/src/scenarios/v2-revocation-honored.test.ts

@@ -11,7 +11,9 @@
  * drives `POST /conformance/seams/sample/auth/credential/{mint,revoke}` (the
  * v1-shaped address `/v1/host/sample/auth/credential/…` through `seamPath()`)
  * with `{ lane }` / `{ lane, credential }` and records `blocked` when the host
- * does not mount it. Windowed lanes (`exp-and-recheck`, `short-lived`, `rebind`)
+ * does not mount it. A mint answer carrying `presentation: { kind: "cookie", name }`
+ * (2.40.3) is presented as `Cookie: <name>=<credential>`, so a cookie-borne
+ * `session` lane is witnessed as its production credential travels; bearer otherwise. Windowed lanes (`exp-and-recheck`, `short-lived`, `rebind`)
  * have no wire-observable "next request" and record `inapplicable`.
  */
 
@@ -48,17 +50,22 @@ describe('v2 revocation-honored (RFC 0170 §B.3 — seam-gated)', () => {
       const minted = await http(() => driver.post(MINT, { lane }));
       if (minted === null) return softSkip('blocked', `${MINT} unreachable (fetch failed)`);
       if (minted.status === 404 || minted.status === 403) return seamAbsent(`${MINT} not mounted (${minted.status}) — the host advertises the seams profile but does not serve the RFC 0170 §B.3 credential mint/revoke seams (api/seams-v2.yaml mintLaneCredential / revokeLaneCredential; host-sample-test-seams.md)`);
-      const credential = (minted.json as { credential?: unknown } | undefined)?.credential;
+      const body = minted.json as { credential?: unknown; presentation?: { kind?: unknown; name?: unknown } } | undefined;
+      const credential = body?.credential;
+      // 2.40.3 — a cookie-borne lane (a `session` lane) is presented the way its
+      // production credential is, `Cookie: <name>=<credential>`. Bearer otherwise.
+      const cookieName = body?.presentation?.kind === 'cookie' && typeof body.presentation.name === 'string' ? body.presentation.name : null;
+      const present = (c: unknown): Record<string, string> => (cookieName ? { Cookie: `${cookieName}=${String(c)}` } : { Authorization: `Bearer ${String(c)}` });
       expect(typeof credential, req('openwop.requirement.0170.revocation-honored', DOC, `the mint seam MUST answer { credential } for lane ${lane}`)).toBe('string');
 
       // Positive control — the minted credential authenticates before revocation.
-      const before = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: { Authorization: `Bearer ${String(credential)}` } }));
+      const before = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: present(credential) }));
       expect(before !== null && before.status !== 401, req('openwop.requirement.0170.revocation-honored', DOC, `a freshly minted ${lane} credential MUST authenticate before revocation (got ${before?.status ?? 'no response'})`)).toBe(true);
 
       const revoked = await http(() => driver.post(REVOKE, { lane, credential }));
       expect(revoked !== null && revoked.status < 400, req('openwop.requirement.0170.revocation-honored', DOC, `the revoke seam MUST accept the credential it minted for lane ${lane} (got ${revoked?.status ?? 'no response'})`)).toBe(true);
 
-      const after = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: { Authorization: `Bearer ${String(credential)}` } }));
+      const after = await http(() => driver.get('/runs/openwop-conformance-tenant/revocationprobe0123456789', { authenticated: false, headers: present(credential) }));
       expect(after?.status, req('openwop.requirement.0170.revocation-honored', DOC, `lane ${lane} MUST refuse a revoked credential on the next request with 401`)).toBe(401);
       expect(readErrorCode(after?.json), req('openwop.requirement.0170.revocation-honored', DOC, `the refusal code MUST be credential_revoked (lane ${lane})`)).toBe('credential_revoked');
     }