@volter/twin-standard 1.0.158 → 1.0.159

package/src/conformance.ts

@@ -1,4 +1,4 @@
-import { hasOwnSurface } from './lanes.ts';
+import { hasOwnSurface, unitsIn } from './lanes.ts';
 // CONFORMANCE — the deterministic half of the Protocol 3 standard that executes the pack: the contract it serves, run the
 // way an application calls it, and every rule a pack's author follows that a machine can decide (docs/contributing/
 // architecture.md, "Conformance"). One command, the same for a contributor, the catalog's admission and its regular
@@ -11,18 +11,26 @@ import { hasOwnSurface } from './lanes.ts';
 // judges (the life's plausibility) is the proof section's. Each check names the defect it was written against: one
 // that escaped review once fails here when reintroduced.
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { connect } from 'node:net';
 import { tmpdir } from 'node:os';
 import { basename, dirname, extname, join, matchesGlob, relative, resolve, sep } from 'node:path';
 // A path relative to another with '/' between its parts on every platform (Windows' relative() joins with '\').
 const rel = (from: string, to: string): string => relative(from, to).split(sep).join('/');
-import type { TwinStream } from '@volter/world-core';
+import type { PackDescriptor, TwinStream } from '@volter/world-core';
+import { hostRules } from '@volter/world-core/host-routing';
+import { twinEnvStem } from '@volter/world-core/vendor-hosts';
+import type { DerivedManifest, ErrorSpec, RemoteExecuteResponse, StateSystemAdapters, TwinAuthStrategy } from '@volter/world-core/runtime';
 import { citations, sourceHeld, type SourceRecord } from './check-sources.ts';
 import { fileURLToPath } from 'node:url';
-import { servedHttpFetch } from './clients/harness.ts';
+import { parseEnv } from 'node:util';
+import { openWebSocket, readHttpResponse, servedHttpFetch, worldProxy } from './clients/harness.ts';
 import { servePack as serve, type ServedPack as Served } from './walk/serve-pack.ts';
+import { walkPackDirectory } from './walk/pack-directory.ts';
+import { formBody, sigv4Headers } from './walk/journey-kit.ts';
+import { consumerClientProof, consumerRecipe, runConsumerCommand, type ConsumerResult } from './consumer.ts';
+import { declaredResponseStatuses } from './spec-documents.ts';
 
 export type ConformanceResult = { id: string; asks: string; failures: string[]; note?: string };
 
@@ -39,12 +47,30 @@ type Manifest = {
 const pascal = (s: string): string => s.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((w) => w[0]!.toUpperCase() + w.slice(1)).join('');
 const readJson = (p: string): unknown => (existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : undefined);
 
-/** The pack's units: the pack and each lane in it (a directory with its own src/manifest.ts and no package.json). */
-function unitsIn(pack: string): string[] {
-  return [pack, ...readdirSync(pack).sort().map((n) => join(pack, n)).filter((d) => !existsSync(join(d, 'package.json')) && existsSync(join(d, 'src', 'manifest.ts')))];
+/** Exercise the door's declared organization and deployment, as the World renderer does. */
+function credentialDoorBody(door: NonNullable<PackDescriptor['credentialDoor']>): string {
+  return JSON.stringify({ ...door.body, ...(door.account ? { [door.account.field]: 'default' } : {}), ...(door.deployment ? { [door.deployment.field]: 'conformance' } : {}) });
 }
+
 const nameOf = (pack: string, unit: string): string => rel(resolve(pack, '..'), unit);
 
+/** A credential door's native successful object and nonempty string outputs, through the served HTTP owner. */
+async function credentialFields(server: Served, door: NonNullable<PackDescriptor['credentialDoor']>, host?: string): Promise<{ values: Record<string, unknown>; outputs: Record<string, string> }> {
+  await server.managedDatabaseUrl?.();
+  const port = server.inspectPort ?? server.port;
+  const answer = await readHttpResponse(servedHttpFetch(port), new Request(`http://${host ?? `127.0.0.1:${port}`}${door.path}`, {
+    method: 'POST', headers: { 'content-type': 'application/json', 'x-volter-world-activity': 'provisioning' }, body: credentialDoorBody(door),
+  }));
+  if (answer.bodyError) throw new Error(`credential door ${door.path}: ${answer.bodyError.message}`);
+  if (answer.status < 200 || answer.status >= 300) throw new Error(`credential door ${door.path} answered ${answer.status}`);
+  const { decodeResponse } = await import('./walk/shape.ts');
+  const values = decodeResponse(answer.text, undefined);
+  if (!values || typeof values !== 'object' || Array.isArray(values)) throw new Error(`credential door ${door.path} supplies no JSON object`);
+  const fields = values as Record<string, unknown>;
+  const outputs = Object.fromEntries(Object.entries(door.fill).flatMap(([name, field]) => typeof fields[field] === 'string' && fields[field] ? [[name, fields[field] as string]] : []));
+  return { values: fields, outputs };
+}
+
 /** The files conformance reads from a unit: its manifest, its spec's record, its vendor's life and its decision table
  *  (a lane's journeys are its own `journeys/` or else its vendor's). A release publishes each (published()), and a
  *  pack's standing counts it in the form only when every unit holds them (twin-world's scripts/pack-standing.ts, by
@@ -280,10 +306,11 @@ async function allowance(pack: string, runtime: Runtime): Promise<string[]> {
 }
 
 type Runtime = {
-  getPack: (vendor: string) => { stateSystem?: { perform?: unknown; refresh?: unknown } } | undefined;
+  getPack: (vendor: string) => { stateSystem?: StateSystemAdapters } | undefined;
   DEFAULT_RATE_BUDGET: NonNullable<Manifest['rateBudget']>;
+  worldNow: () => string;
+  vendorError: (manifest: DerivedManifest, error: ErrorSpec) => Response;
 };
-const within = <T>(ms: number, p: Promise<T>): Promise<T | 'timeout'> => Promise.race([p, new Promise<'timeout'>((r) => setTimeout(() => r('timeout'), ms))]);
 
 /** Served by its server.ts as a World runs it (its boot id set), the pack answers HTTP and the boot probe, and every socket
  *  its manifests declare takes an upgrade. Escaped twice: serveHttp never took the upgrade a pack's fetch carries, then
@@ -294,24 +321,23 @@ async function standalone(pack: string): Promise<string[]> {
   const sockets: Array<{ unit: string; path: string; host?: string }> = [];
   for (const unit of unitsIn(pack)) for (const s of (await manifestOf(unit)).sockets ?? []) sockets.push({ unit: nameOf(pack, unit), path: s.path, ...(s.host ? { host: s.host } : {}) });
   // served the way a World runs it: the boot id set, so the seam wraps the fetch with the World's boot probe
-  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env;
-  const before = env.VOLTER_WORLD_BOOT_ID;
-  env.VOLTER_WORLD_BOOT_ID = 'conformance';
-  let server: Served;
-  try { server = await serve(pack, {}); } finally { if (before === undefined) delete env.VOLTER_WORLD_BOOT_ID; else env.VOLTER_WORLD_BOOT_ID = before; }
+  const server = await serve(pack, {});
   try {
-    const http = await within(5000, fetch(`http://127.0.0.1:${(server.inspectPort ?? server.port)}/`).then((r) => r.status, (e: Error) => e.message));
-    if (http === 'timeout' || typeof http === 'string') out.push(`served as a World runs it, it answers no HTTP request (${http})`);
-    const boot = await within(5000, fetch(`http://127.0.0.1:${(server.inspectPort ?? server.port)}/__volter/world-boot`).then((r) => r.json() as Promise<{ boot?: string }>, (): { boot?: string } => ({})));
-    if (boot === 'timeout' || boot.boot !== 'conformance') out.push("served as a World runs it, it does not answer the World's boot probe (/__volter/world-boot)");
+    const http = servedHttpFetch(server.inspectPort ?? server.port);
+    const probe = (path: string) => readHttpResponse(http, new Request(`http://127.0.0.1:${server.inspectPort ?? server.port}${path}`, { signal: AbortSignal.timeout(5000) }));
+    try {
+      const answer = await probe('/');
+      if (answer.bodyError) out.push(`served as a World runs it, its HTTP response failed (${answer.bodyError.message})`);
+    } catch (error) { out.push(`served as a World runs it, it answers no HTTP request (${String(error)})`); }
+    try {
+      const boot = await probe('/__volter/world-boot');
+      if (boot.bodyError || (JSON.parse(boot.text) as { boot?: string }).boot !== 'conformance') throw new Error('missing boot identity');
+    } catch { out.push("served as a World runs it, it does not answer the World's boot probe (/__volter/world-boot)"); }
     for (const s of sockets) {
-      const upgraded = await new Promise<string | undefined>((done) => {
-        const ws = new WebSocket(`ws://127.0.0.1:${server.port}${s.path}`, { headers: s.host ? { host: s.host } : {} } as unknown as string[]);
-        const timer = setTimeout(() => { ws.close(); done('no upgrade in 5 s'); }, 5000);
-        ws.onopen = () => { clearTimeout(timer); ws.close(); done(undefined); };
-        ws.onerror = () => { clearTimeout(timer); done('the upgrade was refused'); };
-      });
-      if (upgraded) out.push(`${s.unit}: the socket at ${s.host ?? ''}${s.path}: ${upgraded}`);
+      const ws = new WebSocket(`ws://127.0.0.1:${server.port}${s.path}`, { headers: s.host ? { host: s.host } : {} } as unknown as string[]);
+      const upgraded = await openWebSocket(ws);
+      if (upgraded) ws.close();
+      else out.push(`${s.unit}: the socket at ${s.host ?? ''}${s.path}: no upgrade in 5 s or the upgrade was refused`);
     }
   } finally { await server.stop(); }
   return out;
@@ -321,7 +347,6 @@ type SweptOperation = {
   id: string; method: string; path: string; basePath?: string; pathParams?: string[];
   query?: Array<{ name: string; type?: string; required?: boolean }>; body?: Array<{ name: string; required?: boolean }>;
   bodyEncoding?: string; headers?: Record<string, string | null>; discriminator?: Record<string, string | null>;
-  responseMedia?: Record<string, string[]>; answers?: unknown;
 };
 
 /** The request an application's first call of an operation sends when it knows nothing yet: every path parameter, every
@@ -337,109 +362,292 @@ function sweepRequest(op: SweptOperation, basePath: string, host: string, creden
   const headers = new Headers(credential);
   for (const [name, value] of Object.entries(op.headers ?? {})) headers.set(name, value ?? fill(name));
   const method = op.method.toUpperCase();
-  let body: string | undefined;
+  let body: BodyInit | undefined;
   if (op.bodyEncoding === 'form') { headers.set('content-type', 'application/x-www-form-urlencoded'); body = ''; }
   else if (op.bodyEncoding === 'xml') { headers.set('content-type', 'application/xml'); body = ''; }
-  else if (op.bodyEncoding === 'json' || op.bodyEncoding === 'multipart') { headers.set('content-type', 'application/json'); body = '{}'; }
+  else if (op.bodyEncoding === 'json') { headers.set('content-type', 'application/json'); body = '{}'; }
+  else if (op.bodyEncoding === 'multipart') { const formed = formBody({ parts: [] }, {}); headers.set('content-type', formed.contentType); body = formed.bytes; }
   return new Request(url, { method, headers, ...(body !== undefined && !['GET', 'HEAD'].includes(method) ? { body } : {}) });
 }
 
+/** Obtain authorization through the existing customer recipe, with any declared issuer on the same World as the API. */
+async function consumerAuthorization(pack: string, scratch: string, root: string, server: Served, descriptor: PackDescriptor, outputs: Record<string, string>, claimsAuthorization: (hostname: string, pathname: string) => boolean, consumer?: ConsumerResult): Promise<{ headers: Record<string, string>; url: URL }> {
+  const vendor = (await manifestOf(pack)).vendor ?? basename(pack);
+  const issuer = descriptor.credentialIssuer;
+  const companion = issuer ? walkPackDirectory(dirname(pack), issuer, pack) : undefined;
+  if (issuer && !companion) throw new Error(`${vendor}: its declared credential issuer ${issuer} is not installed`);
+  const issuerDoor = companion ? ((await manifestOf(companion)) as { descriptor?: PackDescriptor }).descriptor?.credentialDoor : undefined;
+  if (companion && !issuerDoor) throw new Error(`${issuer}: its declared credential door is missing`);
+  const recipe = consumerRecipe(vendor, pack);
+  if (!consumer) throw new Error(`${vendor}: native authorization requires its prepared installed customer application`);
+  mkdirSync(scratch, { recursive: true });
+  const appDir = consumer.appDir;
+  for (const [path, contents] of Object.entries(recipe.files)) if (path !== 'package.json' && path !== '.gitignore' && readFileSync(join(appDir, path), 'utf8') !== contents) throw new Error(`${vendor}: its prepared customer file ${path} differs from its native first-use recipe`);
+  const proxies: Array<Awaited<ReturnType<typeof worldProxy>>> = [];
+  let servedIssuer: Served | undefined;
+  let granted: { headers: Record<string, string>; url: URL } | undefined;
+  const { forwardableHeaders } = await import('@volter/world-runtime');
+  try {
+    const env = { ...outputs };
+    if (companion && issuerDoor) {
+      servedIssuer = await serve(companion, { root });
+      Object.assign(env, (await credentialFields(servedIssuer, issuerDoor)).outputs);
+    }
+    const credentialNames = new Set([...Object.keys(descriptor.credentialDoor?.fill ?? {}), ...Object.keys(issuerDoor?.fill ?? {})]);
+    for (const name of Object.keys(parseEnv(recipe.files['.env.example']!))) if (credentialNames.has(name) && !env[name]) throw new Error(`${vendor}: its native credential doors supplied no ${name}`);
+    const selectedProxy = await worldProxy(server.inspectPort ?? server.port, (request, response) => {
+      const url = new URL(request.url);
+      if (response.status >= 200 && response.status < 300 && !url.pathname.startsWith('/_twin/') && claimsAuthorization(url.hostname, url.pathname)) {
+        const headers = forwardableHeaders(request.headers);
+        for (const name of [...headers.keys()]) if (/^(host|forwarded|x-forwarded-.*|x-volter-.*|x-twins-key|proxy-.*|via|content-.*|digest)$/i.test(name)) headers.delete(name);
+        granted = { headers: Object.fromEntries(headers), url };
+      }
+    });
+    proxies.push(selectedProxy);
+    const selected = [{ vendor, dir: pack, port: selectedProxy.port }];
+    if (issuer && companion && servedIssuer) {
+      const issuerProxy = await worldProxy(servedIssuer.inspectPort ?? servedIssuer.port);
+      proxies.push(issuerProxy);
+      selected.push({ vendor: issuer, dir: companion, port: issuerProxy.port });
+    }
+    const { compilePackFacts, renderPackFacts } = await import('./pack-facts.ts');
+    const facts = await compilePackFacts(selected.map(({ vendor, dir }) => ({ vendor, dir })));
+    if (facts.undeclared.length) throw new Error('Customer authorization requires declared pack descriptors');
+    const packFacts = join(scratch, 'pack-facts.json');
+    writeFileSync(packFacts, renderPackFacts(facts));
+    const instance = join(scratch, 'instance.json');
+    writeFileSync(instance, JSON.stringify({ packFacts: [packFacts] }));
+    const routes = Object.fromEntries(selected.flatMap(({ vendor, port }) => (facts.packs[vendor]?.hosts ?? []).map((rule) => [rule.key ?? vendor, `http://127.0.0.1:${port}`])));
+    const endpoints = Object.fromEntries(Object.entries(routes).map(([key, url]) => [`${twinEnvStem(key)}_TWIN_URL`, url]));
+    const require = createRequire(join(pack, 'package.json'));
+    const inject = require.resolve('@volter/world-core/inject');
+    const result = await runConsumerCommand(recipe.run, appDir, {
+      ...process.env, ...endpoints, ...env, VOLTER_WORLD_INSTANCE: instance,
+      TWIN_INJECT: Object.entries(routes).map(([name, url]) => `${name}=${url}`).join(','),
+      NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --require ${JSON.stringify(inject)}`.trim(),
+      VOLTER_TWIN_STRICT_EGRESS: '1',
+    }, AbortSignal.timeout(10_000));
+    if (result.exitCode !== 0) throw new Error(`${vendor}: its native first-use command exited ${result.exitCode}`);
+    if (!granted) throw new Error(`${vendor}: its native first-use command made no successful authorized request to the selected API`);
+    return granted;
+  } finally {
+    const cleanup = await Promise.allSettled([...proxies.map((proxy) => proxy.stop()), ...(servedIssuer ? [Promise.resolve().then(() => servedIssuer!.stop())] : [])]);
+    const failed = cleanup.find((result) => result.status === 'rejected');
+    if (failed?.status === 'rejected') throw failed.reason;
+  }
+}
+
 /** Every operation the pack serves, called over HTTP as an application calls it, against its server.ts served as a World
  *  runs it: once plainly and once with a scenario loaded (an empty one, as a World that scripts nothing loads it). Each
  *  answers within 10 s, never with a 500 the spec does not declare, never with a field of the twin's own (`_`
  *  bookkeeping, the kernel's `updatedAt`) and, answered successfully, in the shape the spec gives the operation; and every
- *  refresh list a fresh account can read (one with no parameter in its path) answers it successfully, so a World rooted
- *  at this twin reads its resources back. Escaped before: the scenario hang (a served pack given a scenario answered
+ *  refresh list a fresh account can read (one with no parameter in its path) succeeds or remains unread under the
+ *  native 403 contract while another read succeeds, or matches the pack's own removal at the World clock.
+ *  Escaped before: the scenario hang (a served pack given a scenario answered
  *  nothing), leaked kernel fields in answers no life step read, and refresh scopes on operations the pack answered with
  *  the gap. The life walks what a customer does; this calls what the pack declares it serves. */
-async function surfaceSwept(pack: string, scratch: string): Promise<{ failures: string[]; note: string }> {
+async function surfaceSwept(pack: string, scratch: string, runtime: Runtime, consumer?: ConsumerResult): Promise<{ failures: string[]; note: string }> {
   const out: string[] = [];
-  const descriptor = ((await manifestOf(pack)) as { descriptor?: { hosts?: Array<{ host?: string }>; credentialDoor?: { path: string; body: Record<string, unknown>; fill: Record<string, string> } } }).descriptor;
+  const descriptor = ((await manifestOf(pack)) as { descriptor?: PackDescriptor }).descriptor;
   const fetchOf = ((await import(join(pack, 'src', 'fetch.ts'))) as Record<string, unknown>)[fetchName(pack)] as (() => { owners?: () => Owners; ownersByUnit?: () => Record<string, Owners> }) | undefined;
   const root = fetchOf?.();
   const byUnit = root?.ownersByUnit?.() ?? { '': root?.owners?.() ?? {} };
-  const { shapeChecker } = await import('./walk/shape.ts');
-  const { leaked } = await import('./walk/behavior-journey.ts');
+  const { decodeResponse, responseProblems, shapeChecker, vendorFieldsOf } = await import('./walk/shape.ts');
   const shape = await shapeChecker(pack);
-  type Unit = { name: string; host: string; basePath: string; ops: SweptOperation[]; refreshLists: Array<{ resource: string; id: string }>; auth?: { header: string; scheme: string } };
+  type Unit = { name: string; lane: string; hosts: NonNullable<PackDescriptor['hosts']>; basePath: string; manifest: DerivedManifest; ops: SweptOperation[]; responseStatuses: Map<string, Set<string>>; refreshLists: Array<{ resource: string; id: string }>; refreshReads: string[]; auth?: { header: string; scheme: string }; strategy?: TwinAuthStrategy; removedAt?: (operation: string, now: number) => ErrorSpec | undefined };
   const units: Unit[] = [];
-  const vendorFields = new Set<string>();
+  const vendorFields = await vendorFieldsOf(pack);
   for (const unit of unitsIn(pack).filter(hasOwnSurface)) {
-    const surface = readJson(join(unit, 'src', 'generated', 'surface.gen.json')) as { format?: string; basePath?: string; operations?: SweptOperation[]; resources?: Array<{ fields: Array<{ name: string }> }> } | undefined;
-    for (const r of surface?.resources ?? []) for (const f of r.fields) vendorFields.add(f.name);
+    const surface = readJson(join(unit, 'src', 'generated', 'surface.gen.json')) as { format?: string; basePath?: string; operations?: SweptOperation[] } | undefined;
+    const m = (await manifestOf(unit)) as Manifest & { hosts?: PackDescriptor['hosts']; descriptor?: Omit<PackDescriptor, 'vendor'>; auth?: { header: string; scheme: string } };
     // a line protocol and a command table ride in no path of their own: the life's line steps and the examples read them
     if (!surface?.operations || ['command-reply', 'command-table'].includes(String(surface.format))) continue;
-    const m = (await manifestOf(unit)) as Manifest & { hosts?: Array<{ host?: string }>; auth?: { header: string; scheme: string } };
-    const host = m.hosts?.find((h) => h.host)?.host ?? descriptor?.hosts?.find((h) => h.host)?.host;
-    if (!host) { out.push(`${nameOf(pack, unit)}: no host is named (its manifest's hosts or the descriptor's) for an application to call it at`); continue; }
+    const hosts = m.hosts ?? m.descriptor?.hosts ?? descriptor?.hosts ?? [];
+    if (!hosts.length) { out.push(`${nameOf(pack, unit)}: no host is claimed (its manifest's hosts or the descriptor's) for an application to call it at`); continue; }
     const owners = byUnit[unit === pack ? '' : basename(unit)] ?? {};
     const refreshLists = Object.entries(m.resources ?? {}).flatMap(([resource, decl]) => (decl.refresh?.list ? [{ resource, id: decl.refresh.list }] : []));
-    units.push({ name: nameOf(pack, unit), host, basePath: surface.basePath ?? '', ops: surface.operations.filter((o) => owners[o.id] !== undefined && owners[o.id] !== 'gap'), refreshLists, ...(m.auth ? { auth: m.auth } : {}) });
+    const refreshReads = Object.values(m.resources ?? {}).flatMap((decl) => [decl.refresh?.list, decl.refresh?.get, decl.refresh?.detail].filter((id): id is string => !!id));
+    const declaredAuth = m.descriptor?.auth ?? descriptor?.auth;
+    const strategy = declaredAuth?.in === 'lanes' ? declaredAuth.lanes[unit === pack ? '' : basename(unit)] : declaredAuth;
+    const shared = join(unit, 'src/semantics/shared.ts');
+    const removedAt = existsSync(shared) ? ((await import(shared)) as { removedAt?: Unit['removedAt'] }).removedAt : undefined;
+    units.push({ name: nameOf(pack, unit), lane: unit === pack ? '' : basename(unit), hosts, basePath: surface.basePath ?? '', manifest: m as DerivedManifest, ops: surface.operations.filter((o) => owners[o.id] !== undefined && owners[o.id] !== 'gap'), responseStatuses: declaredResponseStatuses(join(unit, 'spec')), refreshLists, refreshReads, ...(m.auth ? { auth: m.auth } : {}), ...(strategy ? { strategy } : {}), ...(typeof removedAt === 'function' ? { removedAt } : {}) });
   }
   if (!units.length) return { failures: out, note: 'no unit serves an operation on a path of its own' };
-  const tally = { calls: 0, ok: 0, refused: 0 };
-  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env;
+  const tally = { calls: 0, ok: 0, refused: 0, unread: 0, removed: 0 };
+  const replayedHeaders = new Set<string>();
   const scenarioPath = join(scratch, 'surface-scenario.json');
   writeFileSync(scenarioPath, '{"handlers":[]}');
   for (const mode of ['plain', 'scenario'] as const) {
-    const before = env.VOLTER_WORLD_BOOT_ID;
-    env.VOLTER_WORLD_BOOT_ID = 'conformance';
-    let server: Served;
-    try { server = await serve(pack, { root: join(scratch, `surface-${mode}`), ...(mode === 'scenario' ? { scenarioPath } : {}) }); } finally { if (before === undefined) delete env.VOLTER_WORLD_BOOT_ID; else env.VOLTER_WORLD_BOOT_ID = before; }
+    const root = join(scratch, `surface-${mode}`);
+    const server = await serve(pack, { root, ...(mode === 'scenario' ? { scenarioPath } : {}) });
     const http = servedHttpFetch(server.inspectPort ?? server.port);
-    const send = async (request: Request): Promise<Response | 'timeout' | Error> => {
+    const send = async (request: Request): Promise<Awaited<ReturnType<typeof readHttpResponse>> | Error> => {
       await server.managedDatabaseUrl?.();
-      const abort = new AbortController();
-      try { return await within(10_000, http(request, { signal: abort.signal })); } catch (error) { return error as Error; } finally { abort.abort(); }
+      try { return await readHttpResponse(http, request); } catch (error) { return error instanceof Error ? error : new Error(String(error)); }
     };
     try {
+      const said = mode === 'scenario' ? ' with a scenario loaded' : '';
       // the account an application holds: the key the credential door issues, sent as the vendor reads its credential
       let issued: string | undefined;
+      let nativeHeaders: Record<string, string> | undefined;
+      let recipeAuthorized = false;
+      let nativeUrl: URL | undefined;
+      const outputs: Record<string, string> = {};
       if (descriptor?.credentialDoor) {
         const door = descriptor.credentialDoor;
-        const answer = await send(new Request(`https://${descriptor.hosts?.find((h) => h.host)?.host ?? units[0]!.host}${door.path}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(door.body) }));
-        const fields = answer instanceof Response ? ((await answer.json().catch(() => ({}))) as Record<string, unknown>) : {};
-        issued = Object.values(door.fill).map((f) => fields[f]).find((v): v is string => typeof v === 'string');
+        const fields = await credentialFields(server, door);
+        const values = fields.values;
+        Object.assign(outputs, fields.outputs);
+        issued = Object.values(door.fill).map((f) => values[f]).find((v): v is string => typeof v === 'string' && v.length > 0);
+        if (typeof values.authorization === 'string' && values.authorization) {
+          nativeHeaders = { authorization: values.authorization };
+          if (typeof values.url === 'string') {
+            try { nativeUrl = new URL(values.url); } catch { out.push(`${nameOf(pack, pack)}: credential door supplies an invalid native url`); continue; }
+            if (nativeUrl.protocol !== 'https:' || nativeUrl.username || nativeUrl.password) { out.push(`${nameOf(pack, pack)}: credential door supplies a native url without a vendor HTTPS origin`); continue; }
+          }
+        }
+      }
+      const headerUnits = units.filter((unit) => !unit.strategy);
+      const ambiguousHeaderCredential = !nativeHeaders && new Set(Object.values(outputs)).size > 1 && headerUnits.length > 0
+        && Object.keys(parseEnv(consumerRecipe((await manifestOf(pack)).vendor ?? basename(pack), pack).files['.env.example']!)).some((name) => outputs[name]);
+      if (descriptor && (descriptor.credentialIssuer || ambiguousHeaderCredential)) {
+        const headerClaims = headerUnits.map((unit) => hostRules(unit.hosts));
+        const otherClaims = units.filter((unit) => unit.strategy).map((unit) => hostRules(unit.hosts));
+        const claimsAuthorization = descriptor.credentialIssuer ? hostRules(descriptor.hosts ?? []).takes
+          : (host: string, path: string) => headerClaims.some((claims) => claims.takes(host, path)) && !otherClaims.some((claims) => claims.takes(host, path));
+        const granted = await consumerAuthorization(pack, join(scratch, `authorization-${mode}`), root, server, descriptor, outputs, claimsAuthorization, consumer);
+        nativeHeaders = granted.headers;
+        recipeAuthorized = true;
+        for (const name of Object.keys(nativeHeaders)) replayedHeaders.add(name);
+        nativeUrl = granted.url;
+        issued = undefined;
+      }
+      const endpoints = Object.values(outputs).flatMap((value) => {
+        try { const url = new URL(value); return url.protocol === 'https:' && !url.username && !url.password ? [url] : []; } catch { return []; }
+      });
+      const claimsNativeUrl = (u: Unit): boolean => {
+        return nativeUrl !== undefined && hostRules(u.hosts).takes(nativeUrl.hostname, nativeUrl.pathname);
+      };
+      if (nativeUrl && !units.some(claimsNativeUrl)) { out.push(`${units.map((u) => u.name).join(', ')}: credential door native url ${nativeUrl.origin} matches no selected unit's declared host rules${said}`); continue; }
+      const hostCandidates = (u: Unit): string[] => {
+        const claims = hostRules(u.hosts);
+        const remote = u.manifest.remoteHost;
+        const remoteHost = remote?.template.replace(/\{([^}]+)\}/g, (_match, name: string) => Object.values(remote.values?.[name] ?? {})[0] ?? 'conformance');
+        if (remoteHost && !claims.names(new URL(`https://${remoteHost}`).hostname)) throw new Error(`${u.name}: its remote host ${remoteHost} matches none of its declared host rules`);
+        return [...new Set([
+          ...(nativeUrl && claimsNativeUrl(u) ? [nativeUrl.host] : []),
+          ...endpoints.map((url) => url.host),
+          ...(remoteHost ? [remoteHost] : []),
+          ...u.hosts.flatMap((rule) => 'host' in rule && rule.exclude !== true ? [rule.host] : []),
+        ])];
+      };
+      const answers = new Map<Unit, Map<string, number>>(units.map((u) => [u, new Map<string, number>()]));
+      const removed = new Set<string>();
+      const callOperation = async (u: Unit, op: SweptOperation | undefined, request: Request): Promise<RemoteExecuteResponse | undefined> => {
+        const now = Date.parse(runtime.worldNow());
+        const signing = u.strategy?.in === 'signature' && u.strategy.algorithm === 'aws-sigv4' ? u.strategy : undefined;
+        if (signing) {
+          const keyPart = (suffix: string): string | undefined => {
+            const values = [...new Set(Object.entries(outputs).filter(([name]) => name === suffix || name.endsWith(`_${suffix}`)).map(([, value]) => value))];
+            return values.length === 1 && values[0] ? values[0] : undefined;
+          };
+          const accessKeyId = keyPart('ACCESS_KEY_ID');
+          const secretAccessKey = keyPart('SECRET_ACCESS_KEY');
+          if (!accessKeyId || !secretAccessKey) { out.push(`${u.name}: its SigV4 credential door supplies no unambiguous access-key-id and secret-access-key pair${said}`); return undefined; }
+          const url = new URL(request.url);
+          const headers = Object.fromEntries(request.headers);
+          const body = request.body === null ? undefined : await request.clone().text();
+          const scope = typeof signing.scope === 'function' ? signing.scope({ method: request.method, path: url.pathname + url.search, host: url.host, headers, ...(body === undefined ? {} : { body }) }) : signing.scope;
+          const signed = sigv4Headers({ accessKeyId, secretAccessKey, ...scope }, {}, request.method, request.url, headers, body, now);
+          request = new Request(request, { headers: { ...headers, ...signed } });
+        }
+        const where = `${u.name}: ${op?.id ?? 'GraphQL refresh'} (${request.method} ${new URL(request.url).pathname})`;
+        const graphqlBody = request.method === 'POST' && u.manifest.graphql?.paths.includes(new URL(request.url).pathname)
+          ? await request.clone().json().catch(() => undefined) : undefined;
+        const res = await send(request);
+        if (res instanceof Error) { out.push(`${where}: the connection failed${said} (${res.message})`); return undefined; }
+        if (op) answers.get(u)!.set(op.id, res.status);
+        if (mode === 'plain') { tally.calls++; if (res.status < 300) tally.ok++; else tally.refused++; }
+        if (res.bodyError) { out.push(`${where}: response body failed${said} (${res.bodyError.message})`); return undefined; }
+        const text = res.text;
+        const response = { status: res.status, headers: res.headers, body: text, bodyBytes: res.bodyBytes };
+        const removal = op ? u.removedAt?.(op.id, Math.floor(now / 1000)) : undefined;
+        if (removal) {
+          const expected = runtime.vendorError(u.manifest, removal);
+          if (res.status === expected.status && text === await expected.text()) removed.add(`${u.name}:${op!.id}`);
+          else out.push(`${where} does not match its declared native removal at ${new Date(now).toISOString()}${said}: expected ${removal.status} and its exact native body, received ${res.status}: ${text.slice(0, 160)}`);
+        }
+        const statuses = op ? u.responseStatuses.get(op.id) : undefined;
+        if (res.status === 500 && !statuses?.has('500') && !statuses?.has('5XX') && !statuses?.has('default')) out.push(`${where} answered 500${said}, which the spec does not declare: ${text.slice(0, 160)}`);
+        const type = res.headers['content-type'];
+        const judged = responseProblems(shape, vendorFields, { method: request.method, path: request.url, requestHeaders: Object.fromEntries(request.headers), graphqlBody,
+          status: res.status, mediaType: type, body: decodeResponse(text, type), text });
+        for (const key of judged.leaks) out.push(`${where} answers the twin's own field ${key}${said}`);
+        for (const detail of judged.shape) out.push(`${where}: ${detail}${said}`);
+        return response;
+      };
+      const refreshed = new Set<string>();
+      const nativeRefreshOwnsReads = recipeAuthorized && nativeHeaders !== undefined && units.some((unit) => unit.refreshReads.length > 0);
+      if (nativeRefreshOwnsReads) {
+        const vendor = (await manifestOf(pack)).vendor ?? basename(pack);
+        const refresh = runtime.getPack(vendor)?.stateSystem?.refresh;
+        if (!refresh) throw new Error(`${vendor}: its registered native refresh adapter is missing`);
+        try { await refresh(async (call) => {
+          const u = units.find((unit) => unit.lane === (call.lane ?? ''));
+          if (!u) throw new Error(`${vendor}: its native refresh names no selected unit`);
+          const url = hostCandidates(u).map((host) => new URL(call.path, `https://${host}`)).find((candidate) => hostRules(u.hosts).takes(candidate.hostname, candidate.pathname));
+          if (!url) throw new Error(`${u.name}: its native refresh request matches no declared host`);
+          const headers = { ...call.headers, ...(claimsNativeUrl(u) ? nativeHeaders : {}) };
+          const request = new Request(url, { method: call.method, headers, ...(call.body === undefined ? {} : { body: call.body as BodyInit }) });
+          const operation = shape?.operationOf(call.method, url.href, Object.fromEntries(request.headers));
+          const op = (operation?.lane ?? '') === u.lane ? u.ops.find((candidate) => candidate.id === operation?.op.id) : undefined;
+          const graphql = call.method.toUpperCase() === 'POST' && u.manifest.graphql?.paths.includes(url.pathname);
+          if (!op && !graphql) throw new Error(`${u.name}: its native refresh matches no served operation or declared GraphQL endpoint`);
+          if (op) refreshed.add(`${u.name}:${op.id}`);
+          const response = await callOperation(u, op, request);
+          if (!response) throw new Error(`${u.name}: its native refresh request failed`);
+          return response;
+        }, { root }); }
+        catch (error) {
+          const detail = error instanceof Error ? error.message : String(error);
+          const secrets = Object.values(nativeHeaders!).flatMap((value) => [value, value.split(/\s+/).slice(1).join(' ')]).filter(Boolean);
+          out.push(`${vendor}: its native refresh adapter failed${said}: ${secrets.reduce((message, secret) => message.replaceAll(secret, '[redacted]'), detail)}`);
+        }
       }
-      const said = mode === 'scenario' ? ' with a scenario loaded' : '';
       for (const u of units) {
-        // a unit whose manifest declares no `auth` checks its key in its own front: the key goes as most vendors read
-        // one, a bearer token, and a refusal of it is no finding of the refresh below
+        // A front that checks its own key receives the door's token as a bearer.
         const auth = u.auth ?? { header: 'authorization', scheme: 'Bearer' };
-        const credential: Record<string, string> = issued ? { [auth.header]: auth.scheme ? `${auth.scheme} ${issued}` : issued } : {};
-        const answered = new Map<string, number>();
+        const native = nativeHeaders !== undefined && (!nativeUrl || claimsNativeUrl(u));
+        const credential: Record<string, string> = native ? nativeHeaders! : issued ? { [auth.header]: auth.scheme ? `${auth.scheme} ${issued}` : issued } : {};
+        const signing = u.strategy?.in === 'signature' && u.strategy.algorithm === 'aws-sigv4' ? u.strategy : undefined;
+        if (!signing && u.auth && !native && !issued) { out.push(`${u.name}: its credential door supplies no nonempty credential for ${auth.header}${said}`); continue; }
+        const claims = hostRules(u.hosts);
+        let hosts: string[];
+        try { hosts = hostCandidates(u); } catch (error) { out.push(`${(error as Error).message}${said}`); continue; }
         for (const op of u.ops) {
-          const request = sweepRequest(op, u.basePath, u.host, credential);
-          const where = `${u.name}: ${op.id} (${request.method} ${new URL(request.url).pathname})`;
-          const res = await send(request);
-          if (res === 'timeout') { out.push(`${where} answered nothing in 10 s${said}`); continue; }
-          if (res instanceof Error) { out.push(`${where}: the connection failed${said} (${res.message})`); continue; }
-          answered.set(op.id, res.status);
-          if (mode === 'plain') { tally.calls++; if (res.status < 300) tally.ok++; else tally.refused++; }
-          const text = await res.text();
-          if (res.status === 500 && !op.responseMedia?.['500'] && !op.responseMedia?.['5XX']) { out.push(`${where} answered 500${said}, which the spec does not declare: ${text.slice(0, 160)}`); continue; }
-          if (mode === 'scenario') continue;
-          const type = res.headers.get('content-type') ?? '';
-          let body: unknown;
-          if (/json/.test(type)) { try { body = JSON.parse(text); } catch { body = undefined; } }
-          for (const key of leaked(body, vendorFields, '', !op.answers || res.status >= 300)) out.push(`${where} answers the twin's own field ${key}`);
-          if (res.status >= 200 && res.status < 300 && shape) {
-            const hit = shape.operationOf(request.method, request.url, Object.fromEntries(request.headers));
-            if (hit) for (const detail of shape.failures(hit.op, body, type, request.headers.get('accept') ?? undefined, res.status, { method: request.method, responseText: text })) out.push(`${where}: ${detail}`);
-          }
-        }
-        if (mode === 'plain') for (const r of u.refreshLists) {
-          const op = u.ops.find((o) => o.id === r.id);
-          if (!op || op.path.includes('{') || (op.basePath ?? '').includes('{')) continue;
-          const status = answered.get(r.id);
-          if (status !== undefined && (status === 401 || status === 403) && (!u.auth || !issued)) continue;
-          if (status !== undefined && (status < 200 || status >= 300)) out.push(`${u.name}: ${r.resource}'s refresh lists by ${r.id}, which answered a fresh account ${status}: a World rooted at this twin reads nothing back`);
+          if (refreshed.has(`${u.name}:${op.id}`)) continue;
+          const request = hosts.map((host) => sweepRequest(op, u.basePath, host, signing ? {} : credential)).find((candidate) => {
+            const url = new URL(candidate.url);
+            return claims.takes(url.hostname, url.pathname);
+          });
+          if (!request) { out.push(`${u.name}: ${op.id} has no concrete declared host or issued HTTPS endpoint matching its host rules${said}`); continue; }
+          await callOperation(u, op, request);
         }
       }
+      const readSomething = units.some((u) => u.refreshReads.some((id) => { const status = answers.get(u)?.get(id); return status !== undefined && status >= 200 && status < 300; }));
+      if (mode === 'plain' && !nativeRefreshOwnsReads) for (const u of units) for (const r of u.refreshLists) {
+        const op = u.ops.find((o) => o.id === r.id);
+        if (!op || op.path.includes('{') || (op.basePath ?? '').includes('{')) continue;
+        const status = answers.get(u)?.get(r.id);
+        if (removed.has(`${u.name}:${r.id}`)) { tally.removed++; continue; }
+        if (status === 403 && readSomething) { tally.unread++; continue; }
+        if (status !== undefined && (status < 200 || status >= 300)) out.push(`${u.name}: ${r.resource}'s refresh lists by ${r.id}, which answered a fresh account ${status}: a World rooted at this twin reads nothing back`);
+      }
     } finally { await server.stop(); }
   }
   // one defect repeated over a surface reads as one: the first 40 findings, and how many more
-  return { failures: out.length > 40 ? [...out.slice(0, 40), `… ${out.length - 40} more`] : out, note: `${tally.calls} served operations called, twice each: ${tally.ok} answered successfully, ${tally.refused} refused, unscripted` };
+  return { failures: out.length > 40 ? [...out.slice(0, 40), `… ${out.length - 40} more`] : out, note: `${tally.calls} served operations called, twice each: ${tally.ok} answered successfully, ${tally.refused} refused, unscripted; ${tally.unread} refresh resources unread (403), ${tally.removed} match declared native removals${replayedHeaders.size ? `; replayed application headers (values redacted): ${[...replayedHeaders].sort().join(', ')}` : ''}` };
 }
 
 /** A line protocol's connection over TCP, in the walk's stream shape. A line drew its replies when bytes arrived and then
@@ -479,31 +687,22 @@ async function lifeServed(pack: string): Promise<string[]> {
   if (!existsSync(lifePath)) return ['journeys/customer-life.json is missing'];
   const { inMemoryWorld, usePacks, walk } = await import('./walk/behavior-journey.ts');
   usePacks(dirname(pack), { dependenciesFrom: pack });
-  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env;
   const served = async (root: string, options: { scenarioPath?: string }) => {
-    const before = env.VOLTER_WORLD_BOOT_ID;
-    env.VOLTER_WORLD_BOOT_ID = 'conformance';
-    let server: Served;
-    try { server = await serve(pack, { root, ...options }); } finally { if (before === undefined) delete env.VOLTER_WORLD_BOOT_ID; else env.VOLTER_WORLD_BOOT_ID = before; }
+    const server = await serve(pack, { root, ...options });
     const port = server.inspectPort ?? server.port;
     const http = servedHttpFetch(port);
     return {
       // the vendor's URL as the application called it, sent to the served pack: its host carried in the Host header
-      fetch: Object.assign(async (request: Request): Promise<Response> => {
-        await server.managedDatabaseUrl?.();
-        const abort = new AbortController();
-        try {
-          const answer = await within(10_000, http(request, { signal: abort.signal }));
-          return answer === 'timeout' ? new Response(`no answer in 10 s from the served pack (${request.method} ${new URL(request.url).pathname})`, { status: 599 }) : answer;
-        } finally { abort.abort(); }
-      }, server.managedDatabaseUrl ? { managedDatabaseUrl: server.managedDatabaseUrl } : {}),
+      fetch: Object.assign(http, {
+        managedDatabaseUrl: server.managedDatabaseUrl,
+        managedDatabaseClock: server.managedDatabaseClock,
+        managedDatabaseConnection: server.managedDatabaseConnection,
+      }),
       // a socket opened as an application opens it: a WebSocket to the served port, the vendor's host in its Host header
       socket: (url: string, headers: Record<string, string>) => new WebSocket(`ws://127.0.0.1:${port}${url}`, { headers } as unknown as string[]),
       // TCP to the native wire: a separate listener beside HTTP, or the primary protocol port.
       stream: lineConnection(server.wirePort ?? server.port),
-      // bounded: Bun's server.stop(true) never settles once a WebSocket peer has closed under it (discord's life, Bun
-      // 1.3.11: the walk ended and the stop spun at full CPU for 45 minutes), so the check waits 5 s and goes on
-      stop: async () => { await within(5000, Promise.resolve(server.stop())); },
+      stop: () => server.stop(),
     };
   };
   const world = inMemoryWorld(`conform-${basename(pack)}`);
@@ -516,50 +715,36 @@ async function lifeServed(pack: string): Promise<string[]> {
 
 /** The pack driven by the vendor's own client (clients/<vendor>.ts): served as a World runs it, its credentials issued
  *  by its credential door, the cases run in Node as an application runs the vendor's SDK (clients/run.ts), each the
- *  vendor's documented behaviour. A vendor whose descriptor names npm clients and has no cases fails it, unless the
- *  descriptor's clientCasesNone says why none is owed. */
-async function clientCases(pack: string, scratch: string): Promise<{ failures: string[]; note?: string }> {
+ *  vendor's documented behaviour. Without a built-in module, the current installed workflow can supply that proof;
+ *  otherwise a vendor naming npm clients needs cases or clientCasesNone saying why none is owed. */
+async function clientCases(pack: string, scratch: string, consumer?: ConsumerResult): Promise<{ failures: string[]; note?: string }> {
   const vendor = (await manifestOf(pack)).vendor ?? basename(pack);
   const clients = join(dirname(fileURLToPath(import.meta.url)), 'clients');
   const extension = extname(fileURLToPath(import.meta.url));
   if (!existsSync(join(clients, `${vendor}${extension}`))) {
-    // a vendor whose descriptor names npm clients (adoption.sdks) is held to them: no case is no proof the SDK works,
-    // unless the descriptor says why none is owed (clientCasesNone: no official SDK, or none the demand's applications
-    // use); one an application calls with no SDK of the vendor's (a raw HTTP catalog) has no client to drive
     const descriptor = ((await manifestOf(pack)) as { descriptor?: { adoption?: { sdks?: string[] }; clientCasesNone?: string } }).descriptor;
     const sdks = descriptor?.adoption?.sdks ?? [];
     if (descriptor?.clientCasesNone) return { failures: [], note: `${vendor} owes no client case: ${descriptor.clientCasesNone}` };
-    return sdks.length
-      ? { failures: [`${vendor} names npm clients (${sdks.join(', ')}) and has no client cases: add packages/twin-standard/src/clients/${vendor}.ts, the SDK driving the pack as an application does, or the descriptor's clientCasesNone saying why none is owed`] }
-      : { failures: [], note: `${vendor} declares no SDK of its own` };
+    if (!sdks.length) return { failures: [], note: `${vendor} declares no SDK of its own` };
+    const proof = consumerClientProof(pack, vendor, sdks, consumer);
+    return { ...proof, failures: proof.failures.map((failure) => `${vendor} names npm clients (${sdks.join(', ')}) and has no built-in client cases: ${failure}`) };
   }
-  const descriptor = ((await manifestOf(pack)) as { descriptor?: { hosts?: Array<{ host?: string; suffix?: string }>; hostsNone?: string; credentialDoor?: { path: string; body: Record<string, unknown>; fill: Record<string, string> } } }).descriptor;
+  const descriptor = ((await manifestOf(pack)) as { descriptor?: PackDescriptor }).descriptor;
   // the first host that names one: a descriptor may lead with a suffix (a region's hosts under one domain), which no
   // request addresses; the case's client reaches whatever host its issued credentials name
   // a raw protocol's pack (hostsNone: SMTP, whose relay is whatever host the operator names) is reached by its TCP
   // connection alone; its client names a stand-in host the connection never resolves
-  const host = descriptor?.hosts?.find((h) => h.host)?.host ?? (descriptor?.hostsNone ? 'relay.world.test' : undefined);
+  const host = descriptor?.hosts?.flatMap((h) => 'host' in h && h.exclude !== true ? [h.host] : [])[0] ?? (descriptor?.hostsNone ? 'relay.world.test' : undefined);
   if (!host) return { failures: ['the descriptor names no host for its client to address'] };
   const scenarioPath = join(scratch, 'client-scenario.json');
   writeFileSync(scenarioPath, '{"handlers":[]}');
-  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env;
-  const before = env.VOLTER_WORLD_BOOT_ID;
-  env.VOLTER_WORLD_BOOT_ID = 'conformance';
-  let server: Served;
-  try { server = await serve(pack, { root: join(scratch, 'client-world'), scenarioPath }); } finally { if (before === undefined) delete env.VOLTER_WORLD_BOOT_ID; else env.VOLTER_WORLD_BOOT_ID = before; }
+  const server = await serve(pack, { root: join(scratch, 'client-world'), scenarioPath });
   try {
     // the World's credentials: what the pack's credential door issues, by the variable a World sets each in
     const issued: Record<string, string> = {};
     const door = descriptor?.credentialDoor;
     if (door) {
-      // a door that answers nothing is the pack's failure, never conform's hang (a pack served with a scenario that answered
-      // nothing once held this request open for good)
-      const abort = new AbortController();
-      const asked = await within(10_000, fetch(`http://127.0.0.1:${server.port}${door.path}`, { method: 'POST', headers: { host, 'content-type': 'application/json' }, body: JSON.stringify(door.body), signal: abort.signal }).then((r) => r.json().catch(() => ({}))));
-      abort.abort();
-      if (asked === 'timeout') return { failures: [`the credential door (POST ${door.path}) answered nothing in 10 s, served with a scenario loaded`] };
-      const answer = asked as Record<string, unknown>;
-      for (const [name, field] of Object.entries(door.fill)) if (answer[field] !== undefined) issued[name] = String(answer[field]);
+      Object.assign(issued, (await credentialFields(server, door, host)).outputs);
     }
     const job = join(scratch, 'client-job.json');
     // a release carries its facts (generated/pack-facts.json, `twin-standard facts`); a source checkout does not, so its
@@ -624,7 +809,7 @@ function records(pack: string): string[] {
 
 /** Every check over the pack at `dir`, in order. */
 /** `onCheck` hears each check's id as it starts, so a caller can show where a long run stands. */
-export async function conformance(dir: string, options: { onCheck?: (id: string) => void } = {}): Promise<ConformanceResult[]> {
+export async function conformance(dir: string, options: { onCheck?: (id: string) => void; consumer?: ConsumerResult } = {}): Promise<ConformanceResult[]> {
   const pack = resolve(dir);
   if (!existsSync(join(pack, 'package.json'))) throw new Error(`${dir} is no pack (no package.json): conformance takes a pack's directory`);
   // the kernel the pack itself resolves: one registry, one serve seam, the pack's own
@@ -647,11 +832,11 @@ export async function conformance(dir: string, options: { onCheck?: (id: string)
       await (async (): Promise<ConformanceResult> => {
         options.onCheck?.('client');
         const asks = "driven by the vendor's own client (its official SDK), served as a World runs it, the vendor's documented behaviour holds";
-        try { const r = await clientCases(pack, scratch); return { id: 'client', asks, failures: r.failures, ...(r.note ? { note: r.note } : {}) }; } catch (error) { return { id: 'client', asks, failures: [`the check could not run: ${(error as Error).message.split('\n')[0]}`] }; }
+        try { const r = await clientCases(pack, scratch, options.consumer); return { id: 'client', asks, failures: r.failures, ...(r.note ? { note: r.note } : {}) }; } catch (error) { return { id: 'client', asks, failures: [`the check could not run: ${(error as Error).message.split('\n')[0]}`] }; }
       })(),
       await run('life', 'the life walked over HTTP against the pack served as a World runs it, with its scenario: every check held', () => lifeServed(pack)),
       await run('standalone', 'served by its server.ts as a World runs it, the pack answers HTTP and the boot probe, and each declared socket upgrades', () => standalone(pack)),
-      await run('surface', 'every served operation called over HTTP as an application calls it, plainly and with a scenario loaded: answered within 10 s, no undeclared 500, no field of the twin\'s own, a success in the spec\'s shape, and every refresh list a fresh account reads answering', () => surfaceSwept(pack, scratch)),
+      await run('surface', 'every served operation called over HTTP as an application calls it, plainly and with a scenario loaded: answered within 10 s, no undeclared 500, no field of the twin\'s own, a success in the spec\'s shape, and every refresh list answering, remaining unread under the native 403 contract, or matching its declared removal at the World clock', () => surfaceSwept(pack, scratch, runtime, options.consumer)),
       await run('records', 'each demand row cites the line it was read at, the spec\'s record names a vendored file that is there, the life names its author, the package has its README', () => records(pack)),
       await run('form', 'every unit passes the form section of the grade (the gate): the layout, the handler and kernel contracts, the manifest as data, the rules an author\'s code holds', () => formOf(pack)),
     ];