Testing

No runtime mock, demo seeder, or rehearsal API is published. Do not use Bearer examples or historical alpha/beta/gamma paths. A mock.* value in a cryptographic fixture is fixed historical test data, not a subscribable event.

Recommended offline checks:

1. reproduce the seven-line canonical request and empty-body digest;
2. mutate one signed byte and require verification failure;
3. reject stale timestamps and nonce reuse;
4. handle every flat error, especially uncertain idempotency;
5. verify and deduplicate the five webhook event types;
6. reconcile tracked signing requests from canonical detail state.

The OpenAPI and ledger gates are static and open no application listener, database, Redis, or external endpoint. The P6 role gate additionally boots both graphs against disposable PostgreSQL 16 and Redis 7: worker /health must return 200, worker /v1 and management paths must return 404, and a real Partner API route must remain protected. No external mock repository or deployed environment was used. When an approved acceptance environment becomes available, use synthetic data only and obtain credentials through the human control plane; never invent a positive entitlement or insert scopes directly.