The pure case executor over a loaded corpus: dispatches each case against the package's PUBLIC module surface — the runner adds no protocol capability of its own — and compares the result to the case's expectation.

Expectations are CODE-LEVEL and shape-agnostic: an invalid case names the expected error code ("ceiling:<key>" renders the parameterized family), and every failure — bare atom or %Error{} — projects to the same code string before comparison. A valid case names per-surface projection fields; byte-bearing projections compare by base64url fallback (the expected value decodes to the actual bytes).

The federation.decode surface includes the carrier/state codecs (the settled ruling: federation_state_unmappable is emitted by the codecs, not by envelope decode). The extension.resolve surface runs Negotiation's extension region walk over minimal artifact values — that walk is where every extension-class code is emitted on the live substrate. The runner executes corpus cases and reports outcomes; it never authorizes anything. The runner executes corpus cases and reports outcomes; it never authorizes anything.