# Standard Contract black-box certification

This provider-neutral suite targets the contract-root `baseUrl` used by any Standard Delivery Provider. It has no provider-specific routes or DTOs. Secrets and callback URLs are supplied through environment variables named by a private configuration file and are never copied to reports.

Run safe checks:

```bash
python3 certification/certify.py --config /secure/certification.json --report /secure/report.json
```

Mutation checks require both `execution.allowMutations=true` and `--allow-mutations`. They cover create, identical/concurrent/conflicting callback replay, omitted-callback retention, two callback-scoped brand fixtures, status/tracking, every update field, and optional controlled cancellation.

Expose two probe processes through controlled HTTPS callback URLs A and B. The local listener must remain behind HTTPS ingress:

```bash
python3 certification/webhook_probe.py --port 9080 --label brand-a --secret-env STANDARD_CONTRACT_WEBHOOK_SECRET --responses 503,200 --output /secure/webhook-a.jsonl
```

After lifecycle, location, ETA, duplicate, stale/out-of-order, and retry fixtures run:

```bash
python3 certification/evaluate_webhook_evidence.py --evidence /secure/webhook-a.jsonl --evidence /secure/webhook-b.jsonl --report /secure/webhook-report.json
```

The suite never changes production routing. Provider-controlled lifecycle advancement, rate-limit, timeout, restart, return, and cancellation fixtures that are unavailable remain `NOT VERIFIED`.