[Conformance] ACS-Core over the wire: the reference Guardian accepts unsigned, replayed and stale envelopes, publishes no chain head, and answers system/ping, four minimum hooks and wrapped MCP with method-not-dispatched

Filed against #92. Every row below is a single reproduction against the reference Guardian, and every request and response pair is held as a capture file.

What you ran

Two harnesses ran, the control first and the adapter second.

1. The tree's own, as a positive control. bun test over the whole suite, then the README's "Drive one hook by hand" payloads, rm -rf / and ls -la, through the shipped hook at hosts/claude-code/acs-hook.ts.

2. An independent host adapter, acs_vector_adapter.py, which imports nothing from the tree and runs on the standard library alone. It builds envelopes from the published request-envelope and tool-call-request schemas. It signs them per Specification section 10: JCS of the envelope with the signature removed, HMAC-SHA256 under an HKDF session key, with the IKM recorded in the results file. It performs the handshake once per session, posts to the Guardian, and records every request and response pair.

What you expected

The conformance page, under "ACS-Core (mandatory baseline)", says a v0.1.0-conformant deployment MUST implement the handshake, the envelope, the six-hook minimum taxonomy, all five dispositions, SessionContext with the Guardian publishing the chain head on responses, replay protection, the baseline HMAC-SHA256 signature, decision honoring, system/ping, and wrapped MCP. The tree's README claims exactly one profile, acs-core, calls the claim "qualified", and carries a status table that already concedes several rows. This report measures each row on the wire. It also adds what the table does not list.

Per row, the sentence that set the expectation:

Section 10: "A signature over the section 10 canonical input is REQUIRED in ACS-Core ... A verifier MUST recompute this canonical form and MUST reject a signature that does not cover it (SIGNATURE_INVALID, 17.1)."
Section 10.3: "Guardians MUST reject requests whose timestamp is more than the negotiated skew window ... returning TIMESTAMP_OUT_OF_WINDOW (-32006), MUST reject duplicate request_id values within the session with REPLAY_DETECTED (-32005), and SHOULD reject duplicate nonce values."
Section 8.6: "For every step where the Guardian writes a ContextEntry ... the Guardian MUST include the resulting chain_hash in its response, and that chain_hash MUST be covered by the response signature."
Section 13: "Guardians MUST always return decision: "allow" for system/ping regardless of policy ... system/ping MUST NOT return an ACS-specific error."
Section 4: "Version mismatch terminates with UNSUPPORTED_VERSION (-32001)." conformance.md: "ClientHello includes profiles_supported; ServerHello includes profiles_accepted." Section 10.3: "skew_window_ms in ServerHello."
conformance.md hook taxonomy: "At minimum: sessionStart, userMessage or agentTrigger, toolCallRequest, toolCallResult, agentResponse, sessionEnd."
conformance.md: "Wrapped MCP: protocols/MCP/*."
README "Verify": "bun test: the whole suite; exactly one test skips."

What happened

Positive control

So the tree does what its README says it does, byte for byte, and the adapter reproduces it without the tree's code. Everything below is measured against that baseline. Across the 350 envelopes the Guardian logged for the whole session, its stderr carried zero schema-failure lines: every response it sent was schema-valid.

Probes (Guardian obligations, one reproduction each)

Wire files are captured one per probe under the run directory; each holds the exact request body and the exact response.

Corpus, vectors-acs-core with tools mapped to Bash

Run as written, with the corpus tools records.lookup and records.read and the argument id, every one of the 16 wire members came back deny with the reason code evaluation_failed and a message saying that mapping.yaml reads that tool's policy target from an argument the call did not send. See D10.

Defect table

Severity is against the ACS-Core MUST list. "One-line fix" names the function and the change; each is small because the surrounding machinery already exists (the chain is computed, the session store is keyed by session, validateEnvelope is total, errorResponse takes a code).

Observations that are not defects against the text:

OBS-1, a foreign endpoint at the Guardian URL. The README default port 8787 was held by an unrelated local HTTP service, so the Guardian exited EADDRINUSE. That is correct. The shim, pointed at 8787, returned permissionDecision allow and exit 0. Its audit entry classified the failure kind as transport, in the capture 03d-audit-foreign-endpoint-on-8787.jsonl.

Section 6.4 is satisfied, since the proceed is audited. One line is worth adding to the host README: a parsed-but-non-envelope body is classified as transport, so the audit log cannot separate a Guardian that is down from something else answering on that port. 8787 is a common default for local proxies.

OBS-2. P7 and P13 are MAY and SHOULD and are listed for completeness only.

OBS-3, the corpus's own gap. Nine corpus members carry Intent, an approval, or an approver response beside the request. steps/toolCallRequest has no field for any of them, so a Guardian that receives only the wire cannot be measured on R-007/R-011/R-012/R-013 by a host adapter; those rows in the FAIL bucket are a statement about the wire format as much as about this Guardian. That is recorded here so the count is not read as nine independent Guardian defects.

Where behaviour and the tree's own table agree, and where they do not

The README's ACS-Core status table already concedes replay, signature, ping, wrapped MCP, the four hooks and the chain head. This run confirms each concession on the wire and adds three the table does not carry: the handshake accepts any version (D6), system/ping is answered with an ACS-specific error where the specification says it MUST NOT be (D5), and the test suite's own verify step is not reproducible from the README (D9). D1 to D8 are one tree; D2, D3, D5 and D7 are each an afternoon because the state they need already exists.

Current Priority Scope

Feeds the runnable Guardian reference implementation (D1 to D8, D10) and feeds conformance evidence (the adapter, the probe set and the corpus run are reusable against any Guardian). D9 is documentation.