@zackbart/connecta 0.35.0 → 0.36.0

package/documentation/architecture.md

@@ -426,7 +426,7 @@ client. A raw Worker stream established the runtime behavior; a custom auth
 provider returning a synthetic streaming 401 exercised Connecta's real admission
 wrapper. Each case had its own Connecta instance with one request permit and no
 queue. Health checks and subsequent MCP requests confirmed the same isolate ID.
-The [recorded observations](https://github.com/zackbart/connecta/blob/a0ac904513fac735582b4bc9c817a48300134328/scripts/probes/worker-disconnect-2026-09-25.json)
+The [recorded observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-2026-09-25.json)
 contain all twelve cases, including served flags and client-end timing.
 
 | Response and flag                                     | Raw stream abort / cancel | Connecta source abort / cancel | Admission after response; next request |
@@ -486,23 +486,23 @@ MCP requests still rejected a competing request with 503 before the deadline;
 the first MCP request after the deadline returned all eight tools with 200 in
 the original isolate. Admission then reported zero active requests. Without the
 flag, the source still recorded no abort or cancellation, so recovery did not
-rely on runtime cleanup. The [recovery observations](https://github.com/zackbart/connecta/blob/32d8e94/scripts/probes/worker-disconnect-recovered-2026-09-25.json)
+rely on runtime cleanup. The [recovery observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-recovered-2026-09-25.json)
 also retain two inconclusive queue-handoff cases: concurrent client connections
 reached different isolates and could not establish an abandoned queued waiter.
-A [second trial using HTTP/2](https://github.com/zackbart/connecta/blob/b174812/scripts/probes/worker-disconnect-h2-2026-09-25.json)
+A [second trial using HTTP/2](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-h2-2026-09-25.json)
 repeated the twelve passing core cases and verified queued cancellation with
 request signals enabled. Even on one HTTP/2 connection, the no-signal queue case
 crossed isolates and remained inconclusive. The Node and workerd regression
 suites cover expired waiters, orphaned handoffs, and identity-safe late release
 deterministically.
 
-To repeat from a repository checkout, run
-`node scripts/probes/worker-disconnect.mjs` with an authenticated Wrangler.
-The script is not in the npm package. It deploys a disposable Worker containing
-only synthetic data, verifies the served configuration, saves observations under `eval/results/`,
-and deletes the Worker in `finally`. It uses no `waitUntil`, which would change
-the lifetime being measured. The production runtime build number was not
-exposed by the deployment; these findings are tied to the date and flags above.
+The [historical probe source](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect.mjs)
+and observations are retained in Git history, outside the current checkout and
+npm package. The probe deployed a disposable Worker containing only synthetic
+data, verified the served configuration, saved observations, and deleted the
+Worker in `finally`. It used no `waitUntil`, which would change the lifetime
+being measured. The production runtime build number was not exposed by the
+deployment; these findings are tied to the date and flags above.
 
 ### Production Access bypass for agent endpoints
 
@@ -1324,14 +1324,15 @@ A composition moves only by explicit review of its source pins/documents;
 `--record` and `--file` cannot replace it. `providers:check` compares the actual
 public documents independently; it never fetches a synthetic combined URL.
 
-The generic REST connector (`src/providers/_shared/rest/`) serves
+The indexed hatch (`src/http/hatch.ts`) serves
 `<vendor>_api_search`, `_api_details`, `_api_read`, and `_api_write` over an
 `OperationIndex` that `pnpm run providers:spec` compiles offline from the
-provider's pin (`evidence/openapi.json`; `openapi.source.json` until its step 1)
-into `openapi.generated.ts`. A `vendored: true` pin compiles the reviewed
-conversion in `evidence/openapi.document.json` instead of fetching, and the
-generated header records that document's digest beside the pin's, so the
-offline freshness check sees a changed conversion.
+provider's pin (`evidence/openapi.json`)
+into `openapi.generated.ts`. A `vendored: true` pin compiles offline from
+the reviewed conversion in `evidence/openapi.document.json`, or derives a
+deterministic Discovery conversion from its pinned original as described below.
+The generated header records the converted document's digest beside the pin's,
+so offline freshness sees a changed conversion.
 Each call is matched to an operation and checked against its parameters before
 transport. Resolved path parameters are validated before authentication or dispatch,
 including pinned enums and numeric bounds. Number path values must decode to canonical finite ASCII decimals without
@@ -1340,16 +1341,24 @@ canonical ASCII decimal safe integers: `0`, positive decimals without leading
 zeros, or negative decimals without leading zeros. `-0`, leading `+`, whitespace,
 exponents, decimal points and non-ASCII digits are refused. Negative integers
 remain valid when the pin has no minimum excluding them. String-valued ids keep
-their declared string contract; `_api_read` admits GET and the vendor's reviewed read-only POSTs in
-its handler, since classification is per tool name. Vendors configure only a
-transport, failure mapper, scope, framing, cursor extraction, a reviewed
-value-safety table (required; see below), argument-dependent refusals, and an
-idempotency header, plus optional hooks: `path` (fill default ids before
-matching), `admit` (an awaited check in `callRest` every tool passes, such as
-Cloudflare's account and zone pin), `result` (unwrap a vendor envelope;
-redaction runs after it and before cursors and `select`), a reviewed
-request-header allowlist, text bodies, and index `slashParams` that admit an
-encoded `/` in a final key segment (`test/rest-connector.test.ts`).
+their declared string contract. `_api_read` admits only operations with explicit
+reviewed read verdicts, including GET/HEAD and read-only POSTs where declared;
+classification is per tool name. Providers declare a confined kit connection,
+a value-safety table (required;
+see below), and any framing, scope, paging or refusal hooks through the hatch
+binding. The connection owns authentication, transport, failure mapping and
+result safety. An index's `slashParams` can admit an encoded `/` in a reviewed
+final key segment. Current hatch admission, paging, privacy and one-send
+outcomes are exercised by the required `eval:outcomes` tasks against stateful
+vendors and HTTP MCP deployments. `test/provider-hostile-response.node.test.ts`
+commits real HTTP writes before returning HTML, malformed JSON or an oversized
+acknowledgement, then reconciles vendor state with exactly one physical send.
+`test/provider-privacy-journey.node.test.ts` checks credential echoes over HTTP.
+Focused provider suites retain MIME/draft restrictions, revision conflicts,
+CCB routing, Planning Center product exclusions and deployment pins. Native
+HTTP framing, cursor and request-lifetime fault probes remain in the HTTP suites;
+catalog copies and decoder/adapter parity matrices are retired under #1072.
+No legacy REST tool adapter remains.
 Large documents opt into generator options that drop restated operation ids
 and plain path parameters and cap one operation's details (`opBudget`).
 `numericBounds: true` preserves documented numeric minimum/maximum constraints
@@ -1364,8 +1373,7 @@ levels, 256 paths or 200 characters per path; overflow or an unresolved
 reference omits that operation's whole response-field contract. Explicitly open
 roots (including root-array items) also leave fields absent. Empty,
 schemaless and non-JSON responses declare no fields. Request shrinking and
-endpoint contract digests do not depend on this metadata. Legacy REST tools
-retain their catalog and discovery behavior until each provider's step 2.
+endpoint contract digests do not depend on this metadata.
 Fields remain optional additive metadata, so a previously compiled
 index without the source bytes remains usable without inventing a response
 contract. Vercel's step-2 pin review restores response metadata from the reviewed public
@@ -1406,7 +1414,7 @@ UTF-16 code units; full reconstruction must match its recorded exact length.
 These physical decode checks do not change request validation, schema traversal,
 search, refusal, result or discovery budgets. Generation and offline roundtrip
 tests must preserve every pinned logical contract; storage changes never accept
-new upstream evidence or golden bytes. The compaction suites cover exact strings,
+new upstream evidence. The compaction suites cover exact strings,
 native Web Crypto identity, malformed references, lazy decoding, mutation
 semantics and every maintained provider.
 
@@ -1455,8 +1463,8 @@ every vendor ships one reviewed table through one mechanism
    otherwise. `providers:spec` derives the binding fields from the pinned
    schema, and the harness fails until the condition lists each one. Argument-dependent refusals (Stripe expansions,
    Vercel `decrypt`) stay in the vendor's `refuse` hook.
-3. **Redaction on every success body**, in `callRest` after `result` and
-   before cursors and `select`, so named tools, HEAD data, and uploads pass
+3. **Redaction on every success body**, in the kit connection after `result`
+   and before cursors and `fields`, so named tools, HEAD data, and uploads pass
    through it too: the operation's reviewed paths, then the key-name
    heuristic as defense in depth. The heuristic is the union of the former
    vendor engines: a credential word anywhere in a non-metadata name removes
@@ -1653,232 +1661,50 @@ There are no hosted review maps, pins, drift comparisons or review UI fields.
 Catalog refresh activity still compares successive accepted catalog fingerprints
 and reports only added, removed and changed counts in the caller's partition.
 
-#### Characterization goldens
-
-Every maintained provider with an `api()` surface has goldens under
-`test/goldens/<provider>/`: the oracle a provider migration must match byte
-for byte. `catalog.json` holds the connector metadata, the rendered guide,
-and each tool's name, description, schemas, and annotations. `calls.json`
-holds at least one fixture call per tool, then an echo call: the exact
-requests sent (method, URL, sorted headers, body), grouped into causal
-steps, and the agent-visible outcome. `failures.json` drives one read and
-one write through 400, 401, 403, 404, 409, 422, 429 (with `retry-after`)
-and 500 responses, a 401 whose message echoes every sent secret, a refused
-connection, and a transport timeout (a `TimeoutError` after the request
-left). `setup.json`, for a provider whose spec completes an OAuth consent,
-holds the consent's steps. Calls run through `Registry` and
-`InvocationService` with a real credential vault, so the outcome is what
-`call_tool` returns before MCP rendering.
-
-`test/goldens/<provider>/spec.ts` says only how to build the provider and
-which calls to make, including an `echo` call whose vendor reply carries the
-text the harness passes. `test/goldens/harness.ts` owns everything else:
-
-- The fake network records each request as `new Request(input, init)`
-  builds it, so `init.headers` replaces a Request's headers as Fetch does,
-  and a body gets its implied `content-type`. Form bodies are recorded as
-  fields when they re-encode to the exact bytes sent; FormData as its parts,
-  with the runtime's boundary as `<boundary>`. A JSON body is recorded as
-  `json` alone only when it is exactly that value's compact serialization;
-  any other spacing, key order, or escape also keeps the exact `text`.
-- A step loop drives each scenario under fake timers. It drains microtasks,
-  fires timers due now synchronously, and waits for request construction and
-  counted real work to finish. Newly waiting requests form one step, sorted
-  by method, URL, headers, and exact body. The loop releases **one answer at
-  a time**, running to quiescence after each. Previously recorded requests
-  keep release priority over new requests. Fixture updates capture canonical
-  cohort release order and reverse cohort release order, each with its own
-  fresh module graph, clock, network and cache namespace. Queue replies are
-  assigned in canonical request order in both runs; only answer delivery
-  changes. Steps remain readable admission cohorts, not simultaneous answers.
-  Workerd checks compare the canonical observation. In stored fixtures,
-  identical observations collapse to one
-  row; differing reverse observations appear in `variants`, each with
-  `order: "reverse"`, complete `steps`, optional `waitedMs`, and `result`.
-  Setup uses the same rule, with `{ steps, variants }` only when orders differ.
-  This bounded two-order model deliberately does not enumerate all interleavings.
-- Every request records integer `after`: the number of answers delivered
-  when the provider called fetch, before harness jitter or body inspection.
-  It identifies a prefix of that run's release sequence; it includes auxiliary
-  requests and resets for setup and invocation. The canonical run releases
-  each cohort forwards, the reverse run backwards, with older cohorts first.
-  For concurrent A and B, C awaiting only B and C awaiting both have canonical
-  `after: 2`, but reverse `after: 1` and `after: 2` respectively. The differing
-  variant preserves that dependency. One integer per request keeps frontiers
-  linear, including a 300-page sequential call. A write sent before login and
-  a write duplicated concurrently or sequentially also differ.
-- Distinct queued replies for indistinguishable concurrent requests are a
-  fixture authoring error: the harness rejects them with a diagnostic. Use
-  identical replies or a request discriminator the provider controls. The
-  arrival order of identical requests cannot assign distinct responses.
-- `test/goldens/setup.ts` installs source dispatchers before a golden test
-  file imports any provider, connector or Effect module. `vi.resetModules()`
-  and dynamic imports refresh those graphs for each capture and release order.
-  The dispatchers retain their identity across captures: saved and prebound
-  functions, and functions captured by Effect, still consult the current
-  capture. Their defining prototypes are wrapped too. Native implementations
-  remain private to the source controller; outside captures the dispatchers
-  delegate unchanged, preserving Vitest's real clocks and runner timeouts.
-- The supported asynchronous model is explicit: fake fetch answers; fake
-  timeout, interval and immediate timers, including `AbortSignal.timeout`; Web Crypto's promise-returning
-  subtle methods; Request/Response/Blob body reads (`arrayBuffer`, `blob`,
-  `bytes`, `formData`, `json`, `text`, where present); default stream-reader
-  `read`/`cancel` and stream `cancel`/`pipeTo`; and promises/`queueMicrotask` chains rooted in those sources or
-  synchronous work. Effect's scheduler and sleeps use the same microtasks
-  and fake timers. A synchronous TextDecoderStream pipeline is supported.
-  Timer delays must coerce to finite nonnegative integer milliseconds within
-  the signed 32-bit timer range; other delays poison the capture. This keeps
-  Date and nanosecond clocks integral. New host asynchronous sources must be
-  registered and counted before use.
-  Native CompressionStream/DecompressionStream, `scheduler.wait`, and
-  native socket/worker/event-source constructors are rejected explicitly,
-  including when their errors are swallowed by a provider. CompressionStream
-  async iteration bypasses the reader-method spy and cannot establish
-  quiescence. No golden may silently bless that path.
-- A no-stimulus audit follows declared quiescence: request, counted-work,
-  timer, or call-settlement progress before an answer or clock tick fails
-  with an unsupported-source diagnostic. Waiting without a request, counted
-  work, or fake timer also fails. The audit is a secondary assertion: source
-  control starts at module load, and supported host promises and microtasks
-  are counted from entry through completion. Quiescence requires zero active
-  counted work, zero queued controlled microtasks, and no due timers; future
-  virtual timers are explicit harness stimuli. Unregistered native producers
-  are unavailable or throw, including saved constructors and swallowed errors.
-  `process.nextTick`, `process.uptime`, `Atomics.waitAsync`, native messaging
-  constructors, and performance timeline methods are unsupported. The
-  test-only `golden-source-boundary` transform rejects Node host-module imports
-  in provider graphs and rejects lazy module loading during scenario work,
-  before either can capture native references or schedule uncounted I/O. Only
-  the harness's fresh-graph loading phase admits test fixture imports.
-  Invalid captures cancel and drain their concurrent fake requests.
-- Settle, rejected-capture cleanup, and final teardown pump controlled timers,
-  microtasks, and fake requests within the original 10,000-host-turn windows.
-  Only outstanding captured Web Crypto operations can extend a window: after
-  exhausting it, await a snapshot of those native operations to settle, then
-  resume with a fresh bounded window. Each phase allows at most 100 native
-  extensions and reports an explicit error on exhaustion. Web Crypto always
-  settles independently of the harness's fake network, timers, and producers.
-  Body reads and stream reads are counted for quiescence but cannot extend a
-  window: their producers may require a fake response, future virtual time,
-  or never complete. No producer attribution or stream constructor tracking
-  is needed. Pending native crypto never advances virtual deadlines or merges
-  request cohorts. Clock advancement remains limited to 1,000 ticks.
-  Unsupported producer dependencies reject within the turn bound; teardown
-  always clears timers and releases capture ownership, including after failed
-  construction and overlapping capture rejection. The next capture must work.
-  Each capture has an async-context epoch that closes before ownership is
-  released, even when its native extension cap is exhausted. Controlled-source dispatchers reject closed
-  continuations before touching another capture's state. Fake request entry,
-  admission, response delivery, and serialization check their owning epoch,
-  including after asynchronous body inspection. Late work cannot record into
-  or receive a response from a later capture, which never waits for it.
-  Closing also attaches rejection handlers to outstanding counted promises,
-  consuming abandoned native body-read rejections without awaiting them.
-  Source regressions explicitly assert either completion or bounded rejection
-  followed by recovery. Crypto-delay probes at 11,000 and 100,000 host turns
-  must complete with unchanged observations; producer-fed bodies need not.
-- The network answers in zero virtual time. Before advancing to the next
-  timer, the loop requires eight quiet real event-loop turns and an audit.
-  A row records nonzero `waitedMs`, the virtual time spent on provider
-  timers. Elapsed-time readings count only those timers. A timer of 0 ms
-  set outside a timer callback is due at once and stays in the current
-  cohort. Unjoined timers at completion fail. Since `AbortSignal.timeout`
-  cannot be cancelled, remaining signal deadlines fire during teardown, outside
-  `waitedMs`; any resulting request or result mutation fails. Every successful
-  drive and scenario boundary has zero outstanding controlled work and timers.
-- Auxiliary routes answer token exchanges and other requests that are not
-  the tool's own, and are recorded by name with headers and body. A JWT in a
-  header or field is recorded as its decoded header and claims, with
-  `<signature>` for the per-run signature.
-- `setup` runs before each scenario; its requests must be identical in
-  every scenario and are recorded once.
-- Determinism: a fresh fake clock per scenario (timers, `Date`, and
-  `performance`, and Node `process.hrtime`/`hrtime.bigint`, starting at
-  2026-01-02T03:04:05Z), counted
-  `crypto.randomUUID`, and fixed `crypto.getRandomValues` and `Math.random`,
-  all restarted per scenario. `create(scenario)` receives a slug unique in
-  the process: the scenario name plus a per-capture suffix the goldens never
-  show. Load-time hrtime dispatchers also control Effect wall and monotonic
-  nanoseconds on the virtual clock. Default-date Intl formatting also reads
-  the virtual wall clock.
-  A process-wide cache (Google's delegated tokens) never carries
-  over from an earlier scenario or capture.
-- Secrets: every credential field and secret becomes `<secret:field>`, with
-  HTTP Basic shown decoded. Before that placeholdering, the harness fails
-  the capture if any secret reaches a caller-visible result (INV-5). The
-  guard decodes the result itself: JSON escapes, percent escapes in either
-  hex case, and base64 or base64url at any alignment, up to three layers
-  deep. It also finds any start of a secret that reaches 12 characters past
-  its public framing, so a truncated echo is a leak. Framing is a PEM armor
-  line and the DER structure that opens every key of its type (tags,
-  lengths, version, algorithm identifier), which guides and example keys
-  print. A later fragment, a shorter one in any encoding, or a secret with
-  its case changed is not detected. A base64 run is decoded only from 11
-  characters (8 bytes), shorter than the base64 of any start the guard
-  looks for.
-- The echo call carries every secret not listed in `unsent` in each
-  encoding redaction covers: raw, percent-encoded with upper- and lowercase
-  hex, base64, unpadded base64url, and `\uXXXX` escapes with upper- and
-  lowercase hex, plus the base64 of each `basic` pair. Every sent secret
-  contains `/`, `+`, and `=`, so its percent and base64url forms differ from
-  its raw and base64 forms. The `401 echo` case echoes the raw secrets only
-  unless the spec sets `errorEcho: "all"`: a provider that caps a vendor
-  message before redaction sees it would leak the start of a longer form its
-  cut goes through. The Google Workspace specs set it, since Google redacts a
-  message whole before cutting it to 500 characters. Their `401 echo` carries
-  `errorEchoForms`: every form above, the `Bearer` and `token` framings, and
-  an HTTP Basic pair holding the token as header, base64 and base64url.
-
-Object keys keep the order the provider produced. A migration changes the
-provider, never the spec or harness.
-
-`test/goldens.test.ts` compares every provider on Node and workerd. It fails
-if a provider folder is neither covered nor listed as remote-MCP-only, a tool
-has no call, or a golden file is missing or extra. Ordinary checks never write.
-Node compares forward and reverse observations byte for byte; workerd compares
-canonical observations. Each order starts a fresh module graph. Workers projection
-removes variants only at harness observation positions, never from vendor fields
-or schemas. Fixture updates retain both orders.
-There are no characterization tiers, path classifiers, or planning-only runs.
-
-`test/goldens-harness.test.ts` keeps the source and mutation guards on Node:
-replaced Authorization headers, changed auxiliary/login bytes, writes sent
-early or twice, and missing secret-encoding redaction must alter a capture or
-fail it. Mutation probes capture the affected call rather than repeating an
-entire provider catalog. Redaction negative controls use Forms, GitHub, Breeze
-and Tithe.ly to cover OAuth/Bearer, app-token, query-key and provider-kit lanes;
-the ordinary goldens still check every provider's complete secret echoes.
-The native-extension budget is checked directly at its 100-extension boundary,
-and a gated closed-epoch continuation must fail before entering the next
-capture's network. Genuine crypto completion, rejection, late dispatch and
-producer-fed stream probes retain their native settlement coverage without
-repeating a million-turn synthetic delay. Ordinary runs use one source-probe schedule. Nightly Node runs set
-`CONNECTA_GOLDENS_DETERMINISM=1` for an identical repeat, provider jitter seeds
-1 and 2, and the complete source-probe jitter matrix. Small native-source probes also run on
-workerd: `scheduler.wait`, CompressionStream, saved timers/microtasks and
-Effect scheduling, prebound crypto/clocks, module freshness, runner clocks,
-and Blob/TextDecoderStream promise settlement. Runtime-specific cases carry
-Vitest's `workers` tag; broad cases carry `node`, which the Workers project
-skips. Other mixed transport/auth/runtime suites use the same tags to retain
-native fetch, request/response streams, deadlines, signals, crypto and SDK
-settlement without duplicating their policy matrices. `vitest.config.ts`
-selects these files with globs that tolerate test-file deletion. Portable
-filenames alone do not enroll a new file in workerd.
-
-Repository verification policy, CI requirements, and exact commands live in
-[AGENTS.md](https://github.com/zackbart/connecta/blob/main/AGENTS.md#verification).
-
-JWT fixture specs import fixed, public throwaway RSA PEM keys, with an
-import/sign/verify self-test. This avoids expensive key generation on every
-fresh module evaluation without changing characterized JWT claims or bytes.
-The harness never caches evaluated module graphs. Global controls prohibit
-`it.concurrent`; parallelism must use isolated files/workers. Transformed code
-may be cached.
-
-`pnpm run goldens:update [provider...]` rewrites the named goldens (all
-when none are named) on Node; it is not part of `check`. A PR
-that changes agent-facing output on purpose regenerates the affected goldens
-and says why in its description; any other golden diff is a regression.
+#### Behavioral evidence (contributor)
+
+The characterization snapshot engine, provider JSON snapshots, source scheduler
+and its self-tests are retired under
+[#1072](https://github.com/zackbart/connecta/issues/1072). Provider changes no
+longer require golden enrollment, snapshot updates, byte equivalence or nightly
+capture determinism. Production invariants remain unchanged.
+
+Use the existing stateful fixture vendors and published-edge deployment adapters:
+
+- `pnpm run eval:outcomes` drives representative joins, retained paging, endpoint
+  refusal, auth handoff, value safety and refund recovery. Graders inspect
+  independent downstream state and the physical mutation ledger, and reject
+  wrong targets, duplicate writes, missing completion and interrupted trials.
+- `pnpm run eval:smoke` boots the Node template, Node eval deployments and native
+  Workers deployments, including the actual QuickBooks provider, then exercises
+  MCP and the operator page.
+- `test/provider-privacy-journey.node.test.ts` sends credentials through real
+  HTTP MCP and a maintained API provider. Unknown vendor fields and keys carry
+  raw, escaped, percent-encoded, base64 and Basic echoes through direct calls,
+  QuickJS programs, failure and recovery. The independent decoder in
+  `test/helpers/secret-echoes.ts` checks the wire responses for secret fragments;
+  it does not normalize them to placeholders or compare saved output.
+- `test/provider-failure-sweep.test.ts` checks retained catalog examples for
+  dispatched failure, classification, auxiliary and composite write outcomes.
+  New providers use the required deployment outcomes above. Existing
+  `test/sent-secrets.test.ts`, `test/sent-secret-output-boundary.test.ts`,
+  `test/request-secret-redaction.test.ts` and `test/catalog-secret-redaction.test.ts`
+  cover secrecy before projection, truncation, caching, paging and diagnostics.
+- `test/write-evidence.node.test.ts`, `test/remote-mcp-attempts.node.test.ts` and
+  `test/oauth-credential-attempts.node.test.ts` inspect physical socket sends.
+  Native transport parity, OAuth and write-provenance suites retain their
+  workerd coverage. The shared throwaway RSA key in `test/fixtures/rsa.ts` is
+  used by write-provenance and unknown-write-advice fixtures.
+- The request, catalog, auxiliary-call, renewal and Promise-boundary lifetime
+  suites, plus `test/auth-admission-binding.test.ts`, exercise cancellation,
+  held native work and garbage collection. These test actual request ownership;
+  the retired capture scheduler's source guards were only harness constraints.
+
+Add a compact fault journey only for a meaningful outcome those suites cannot
+observe. Reuse their fixtures and adapters; do not reintroduce a snapshot
+format, module loader or virtual scheduler. Workerd enrollment is for native
+fetch, streams, Web Crypto, lifetime and request-byte behavior, as listed in
+`vitest.config.ts`; pure logic runs on Node.
 
 ## Optional deployment modules
 
@@ -2152,8 +1978,7 @@ never-settling evaluation/host calls, late rejection, execute-once ownership and
 original acquisition errors in workerd. `test/quickjs-pool.node.test.ts` covers
 readiness release, stale/malformed IPC, late host failures, backoff and bounded
 kill. Real Worker and QuickJS guest contracts, the HTTP Worker budget/queued
-request fixture and native-output suites supply runtime parity evidence;
-provider goldens do not execute a sandbox.
+request fixture and native-output suites supply runtime parity evidence.
 
 ### Native SQL storage (contributor)
 
@@ -2283,9 +2108,12 @@ An accepted write's blocked retry retains its original HTTP status; a slot
 occupied by an auxiliary read instead names the separate write step needed.
 Structured resend advice reaches output only when the core permits it. Generic
 unknown writes retain the core's diagnostic wait; Q8 removes it. The mapping
-adds no Promise entry or lifetime owner. The rule tables in `http-kit.test.ts`,
-Stripe's sixteen-branch comparison and `kit-core-verdicts.test.ts` establish
-these internal contracts. Maintained API providers use the kit through their
+adds no Promise entry or lifetime owner. `provider-failure-sweep.test.ts`,
+`guarded-attempts.node.test.ts`, `call-services.test.ts` and the native
+transport suites exercise these contracts through invocation, physical sockets
+and request closure. `http-kit.test.ts` retains focused numeric/text fact,
+request-equivalence and bulk-capacity fault probes. The migration-era
+kit/core verdict comparison is retired under #1072. Maintained API providers use the kit through their
 explicit provider subpaths; it stays off the root import graph and published
 declarations expose Promises.
 
@@ -2364,12 +2192,11 @@ inventories, and stale fallback cannot authorize post-entry auth recovery.
 ### Contributor provider kit
 
 Provider declarations use `src/http/vendor.ts` for HttpApi operations and
-`src/http/tools.ts` for list, get, read, write and action builders.
+`src/http/tools.ts` for list, get, read and write builders.
 `src/http/provider.ts` composes them with `defineProvider`; it returns the
 ordinary Promise-based Connector factory. The kit stays outside the root
-graph and its Effect types are internal. Tithe.ly is the first provider on
-it (B.5): `api.ts` declares the vendor, `tools.ts` the tools, and its goldens
-are unchanged.
+graph and its Effect types are internal. In each provider, `api.ts` declares
+the vendor and `tools.ts` the tools.
 
 Decision 0011's standard surface (Tithe.ly's step 2) adds four kit pieces.
 A `list` without the legacy `key` returns `{ items, page }`, with
@@ -2460,7 +2287,7 @@ A refused method outside a read/write tool's input schema is inspected through
 Gmail's 49 non-GET refusals do not add a method field or a write hatch, and Forms'
 refused DELETE remains outside its write enum. GitHub's refused raw PUT merge
 is likewise outside its write enum; its named guarded alternative is unaffected.
-These 51 schema refusals happen
+Such schema refusals happen
 before authentication or I/O; details exposes the same reviewed reason as search.
 Every schema-reachable refused operation still fails with that reason before
 authentication or dispatch. This is policy inspection, never execution admission.
@@ -2611,8 +2438,7 @@ storage loses them with the store. Key-load outages or corrupt stored keys
 produce retryable `unavailable`, naming the cursor signing key without its
 value. See [cursor-key recovery](./deploying.md#recover-a-cursor-signing-key):
 after repairing/deleting a corrupt key, restart every process/isolate to clear
-cached keys. Pre-upgrade cursors require a new first page. Offline goldens
-preseed a fixed key only in their harness.
+cached keys. Pre-upgrade cursors require a new first page.
 
 The helper derives connection metadata and probe messages from
 validated options and still accepts complete legacy usage guides for compatibility.
@@ -2624,8 +2450,7 @@ CCB uses shared System Auth grants and personal Identity Auth grants. Tool
 arguments cannot select a grant's owner. On Node, every maintained-provider
 request uses the owned sender `listen()` installs, reads included. Without it,
 maintained-provider writes and reviewed POST reads are refused before sending;
-suites exercising those requests configure the sender themselves, as the goldens
-harness does. Anything a connection
+focused suites exercising those requests configure the sender themselves. Anything a connection
 caches across calls, such as its typed HttpApi client, is built with no
 services, because Effect constructors close over the context they run in and a
 cached value would otherwise keep its first caller's request alive (INV-7).
@@ -2669,8 +2494,20 @@ All six Google Workspace products use the shared standard-surface support.
 archived exact-byte official Discovery documents into deterministic OpenAPI.
 The primary vendored pin retains the official URL, revision and source digest;
 its `discovery` relation names the sibling source pin and normalizer format.
-Generation and offline freshness reproduce the conversion, and the generated
-module records its independent document digest. Full source method inventory
+The sole retained document is `evidence/discovery.document.json`; no converted
+`openapi.document.json` is retained for these pins. Generation and offline
+freshness validate the original bytes against `discovery.json` and the primary
+pin, then derive the conversion in memory, including reviewed summary overrides.
+Its digest uses two-space JSON indentation and a terminal newline; the generated
+module records that independent document digest, preserving freshness checks
+for changes to the normalizer or summaries. This supersedes Decision 0011's
+retained-conversion requirement for deterministic Discovery evidence. Frozen
+measurements read those same provider-owned originals but validate the existing
+`test/fixtures/google-discovery/manifest.json` digests independently: a provider
+pin update must fail the historical measurement rather than silently rebase it.
+That reviewed pin-change PR must re-measure and update the product's manifest
+entry and the Forms #1009 drift-check digests when applicable, or retire the
+measurement. Full source method inventory
 and canonical source-to-relative-path mappings survive normalization. Gmail's
 source `userId` becomes deployment-owned `me`; runtime paths are relative to
 the existing connection root. Reserved Slides ids remain one encoded segment.
@@ -2692,13 +2529,13 @@ independent batch-kind, revision and resource guards. Google indexes explicitly
 set `pathMatching: "uri-template"` on `OperationIndex` to handle encoded literal
 collisions and parameter action suffixes. Other indexes retain exact literal
 segments and their existing refusal ordering. The matching mode also binds
-discovery cursors. An indexed `googleClient` requires each named request's declared
-template and refuses a substituted id resolving to another operation before
-grant evaluation. Products opt in with `googleClient(connection, title,
-{ standard: true, index })`; their requests carry `template`.
+discovery cursors. `googleClient(connection, index)` requires each named request's
+declared `template` and refuses a substituted id resolving to another operation
+before grant evaluation. Every maintained Google product uses this indexed
+client; there is no unindexed settlement mode.
 Both the client and `googleHatchBinding(connection, { index, review })` require
 the explicit URI-template mode at construction. The hatch requires the binding's
-exact index identity. Standard clients and Google bindings reject a missing
+exact index identity. Clients and Google bindings reject a missing
 index with an explicit construction error. The provider-standard suite checks
 actual hatch construction through every Google product fixture, requiring its
 Google binding with the same connection and index. The Google binding
@@ -2739,12 +2576,12 @@ provider, not a claim that the Forms migration has shipped.
 
 `googleErrors(product, { standard: true })` declares the product's 404 meaning
 and uses common status fallbacks; revision-conflict meanings require a
-separate declaration. Standard-mode `googleClient` preserves failure phase
+separate declaration. `googleClient` preserves failure phase
 metadata for partial-create recovery while leaving settlement and wording to
 the kit. Its incomplete-body wording covers JSON and binary reads without
-claiming that binary success was expected to be JSON. Legacy mode retains
-its catalog and failure bytes. No shared-core auxiliary-write outcome change
-is part of this opt-in support.
+claiming that binary success was expected to be JSON. `googleGrant` still uses
+the nonstandard `googleErrors(product)` mapping for delegated-token rejection;
+that grant contract is separate from resource-request settlement.
 
 Drive's two-request reads also declare fixed steps: `get_file_content` uses
 `metadata` and `content`, and non-root `list_folder_items` uses `folder` and
@@ -2755,10 +2592,8 @@ Gmail declares separate initial and body-download steps for `get_message`,
 each of up to 25 summary reads, and `get_thread` names each stored body in
 Gmail's 100-message conversation limit. Serving these reads as writes keeps
 every request available once.
-The layer's request adapter keeps the legacy wording of a served write whose
-answer proves nothing (no answer, a 5xx, a redirect, or an unreadable 2xx) and
-reports how far a failed request got. The core still decides every write's
-outcome. Gmail's auxiliary draft and reply lookups pass both `effect: "read"`
+The request adapter reports how far a failed request got; the kit maps the
+failure and the core decides every write's outcome. Gmail's auxiliary draft and reply lookups pass both `effect: "read"`
 and a construction-declared step: the guarded client's early reservation uses
 that named slot, while the ledger marks the request auxiliary. A failed lookup
 keeps its read verdict and cannot make an unsent draft write unknown.
@@ -2801,10 +2636,8 @@ Every defect from a run probe or its hooks uses the generic withheld notice,
 even without a kit dispatch, because a private transport leaves no kit visibility
 evidence. An open operation probe retains its original defect.
 
-The REST bridge in `src/providers/_shared/rest/kit.ts` retains pinned index
-validation and legacy hatch schemas while the kit owns tool leases, fixed write
-capacity, transport, failures and result safety. It verifies schema equality
-before restoring legacy catalog key order. `indexedVendor` derives operation
+`src/providers/_shared/rest/kit.ts` owns the shared REST call shapes, pinned
+schema conversion and indexed vendor declarations. `indexedVendor` derives operation
 metadata from the index and builds the full manifest lazily; the typed client
 contains only named operations and probes. Bulk indexed declarations preserve
 the OpenAPI brace paths verbatim and carry explicit parameter Schemas. They
@@ -2828,7 +2661,7 @@ transport idempotency key. These hints describe behavior; write routing and
 endpoint restrictions still apply. For example, a tool that only creates a new
 note can declare `destructive:false` without promising idempotency.
 
-`restKitTools` may declare a `writeSteps` map whose values are `"once"`.
+Kit tools and the indexed hatch may declare a `writeSteps` map whose values are `"once"`.
 Construction freezes the map; every named step sends at most once and an
 undeclared step is refused before dispatch. Omitting it retains the single
 implicit write step. Auxiliary ownership reads in a write call retain that
@@ -3089,10 +2922,10 @@ same version to resolve a single copy. Connecta's own lockfile and packed
 install are checked for one copy (`test/package-surface.node.test.ts` and
 `scripts/check-package.mjs`).
 
-The stable `4.0.0` release was re-evaluated on 2026-10-01 with
-[`scripts/probes/effect-v4-evaluation.mjs`](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation.mjs).
-Run `pnpm run build`, then `node scripts/probes/effect-v4-evaluation.mjs output.json`.
-The [raw observations](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation-2026-10-01.json)
+The stable `4.0.0` release was re-evaluated on 2026-10-01 with this
+[historical probe source](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/effect-v4-evaluation.mjs),
+retained in Git history rather than the current checkout.
+The [raw observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/effect-v4-evaluation-2026-10-01.json)
 are synthetic Node requests and neutral esbuild bundles, not live-client or
 workerd lifetime verification. Bundle figures add representative prototypes
 alongside the current code; they do not claim savings from removing old code.
@@ -3101,7 +2934,7 @@ Two native input schemas with validation and JSON Schema rendering add 62,148
 bytes gzip to the root, taking it from 303,083 to 365,231 against a 339,526
 cap. Effect can reject excess properties when both decoding and rendering use
 `onExcessProperty: "error"`; its default strips them. The generated schemas
-still differ from the exact meta-tool goldens, including record rendering and
+still differ from the published meta-tool schemas, including record rendering and
 composed numeric bounds. A Schema replacement would need to preserve that
 contract and memoized rendering. Both MCP SDK packages still depend on Zod,
 so changing our inputs alone does not remove Zod from an installation.
@@ -3466,7 +3299,7 @@ compiling and configuring the real thing.
   (`keyProtectsLogicalCall`). Every resource request dispatched under the
   logical call, from any ledger, is recorded on it once per dispatch with
   its method and the genuine key it carried (`ProviderRequest.key`, set by
-  `callRest` only for a key fetch sends as given). The advice stands only when
+  the kit's guarded transport only for a key fetch sends as given). The advice stands only when
   exactly one boundary was entered, the invocation's object owns it as for
   `knownForLogicalCall`, that boundary tracks every request, and exactly one
   dispatched request was a write, carrying the named key; a request counts as
@@ -3511,10 +3344,10 @@ compiling and configuring the real thing.
   reconciliation even with an idempotency key; direct transport calls
   without a served verdict can still prove repeatability, but only with a
   genuine key sent to a vendor that honors it (Stripe today, through
-  `idempotencyHeader`): the REST write tool refuses an `idempotencyKey` that fetch
+  `hatch.idempotency`): the REST write tool refuses an `idempotencyKey` that fetch
   would send empty after trimming or would not send at all (CR, LF, NUL, any
   other control character but tab, DEL, or a code point past Latin-1), as
-  `invalid_args` before recovery is recorded, and `callRest` marks a request
+  `invalid_args` before recovery is recorded, and the guarded transport marks a request
   repeatable only for a key fetch sends as given.
   `providerCallFailure` (`src/write-outcome.ts`) is the one finalizer for a
   direct write's failure: the `api()` handler boundary, a guarded transport
@@ -3542,7 +3375,7 @@ compiling and configuring the real thing.
   overrides with HTTP 503 for every tool and a connection reset after send
   for each provider/verdict representative. HTTP 401 recovery uses those
   representatives plus the distinct composite, auxiliary, owner-lookup and
-  POST-as-read paths; every provider's full golden failure matrix still runs.
+  POST-as-read paths.
   Shared sender and real-socket evidence below own status/reset permutations.
   Local metadata
   tools prove zero sends; composite calls prove each distinct request leaves
@@ -3831,7 +3664,7 @@ and workerd. `remote-mcp-native-bundle.node.test.ts` additionally loads an actua
 minified production bundle to verify call/cache registration, request Context,
 native storage, saved-original delegates, custom replacements and closed-owner
 refusal. Existing wire, physical-attempt, cache and OAuth lifetime suites remain
-the compatibility evidence; provider golden observations remain unchanged.
+the compatibility evidence.
 
 ### Native upward MCP orchestration (contributor)