diff --git a/tools/tck/README.md b/tools/tck/README.md
index 242d8009b..79d7dafae 100644
--- a/tools/tck/README.md
+++ b/tools/tck/README.md
@@ -345,6 +345,176 @@ the exclusion **and** narrows Surefire's includes to it:
 **Both halves are needed.** Dropping alone runs the module's unit tests alongside the suites;
 narrowing alone leaves the exclusion in force and runs nothing.
 
+## The canonical set cannot be reduced
+
+Extending the suite is safe by convention. Shrinking it is what a conformance suite has to prevent,
+because a run that asks all but two of the canonical questions and reports success is
+indistinguishable, in every artifact it produces, from one that asked every question there is.
+
+`CanonicalScenarioGuard` is an ordinary JUnit test that the suite selects, and it fails the build if
+this run is set up to execute less than the canonical set:
+
+- a feature file added to `gherkin/`, or shadowing a canonical one — the selected scenarios no
+  longer match what this artifact ships, which it reads from its own JAR rather than through the
+  classpath
+- `cucumber.filter.tags` or `cucumber.filter.name` — Cucumber applies these by skipping scenarios at
+  execution, so the run is filtered however the plan looks
+- selectors or glue overridden in your `junit-platform.properties`
+
+It checks the setup rather than counting afterwards: both the discovered plan and the run's filter
+configuration are settled before the first scenario, so the check needs no backend and takes no
+measurable time. Where its result appears in the run depends on the order the JUnit Platform executes
+the suite's two engines in, which is not specified. Extension scenarios are ignored: the check is
+defined over `gherkin/` alone.
+
+Narrowing a run legitimately is what `capabilities()` is for — those scenarios are reported as
+skipped with a reason, which a filtered scenario is not. To filter anyway while debugging, set
+`-Dtck.partial=true` (or `TCK_PARTIAL`). The guard then reports itself as
+**skipped** rather than passed, so the run states that its canonical set was not verified.
+
+What the guard does not establish is that the canonical files contain what they should — a
+replacement placing its scenarios on the same lines would satisfy it. That is covered better
+elsewhere: the results stream carries the `source` of every feature that executed, and
+`tck.specRevision` says which revision it should match.
+
+## Conformance reports
+
+Set `TCK_REPORT_DIR` and each suite writes two files: an envelope conforming to the
+[report schema][report-schema] in the specification, and the run's results as a
+[Cucumber Messages][messages] stream.
+
+```console
+$ TCK_REPORT_DIR=./reports mvn -Ptck -pl providers/flagd test
+$ ls reports/
+flagd-in-process.json  flagd-in-process.ndjson  flagd-rpc.json  flagd-rpc.ndjson
+```
+
+`-Dtck.report.dir=...` does the same thing and is often easier to pass through Maven. The
+environment variable is the portable spelling — every language's TCK reads it, so one cross-language
+CI job can set one thing.
+
+It is an environment variable rather than a method on `ProviderTckHarness` so that emitting a report
+is a property of the run and not of the code: CI sets it, a developer running the suite locally does
+not, and no adopter changes a line to publish one. Unset means no report, which is not an error.
+Several suites in one JVM each write their own pair, so flagd's two resolvers do not collide.
+
+### The results are not a format this project defines
+
+The `.ndjson` is a Cucumber Messages stream, produced by Cucumber's own `MessageFormatter` — the
+same class the built-in `message:<path>` plugin instantiates, so the bytes are what
+`--plugin message:...` would have written. It already carries everything a per-scenario report would
+have had to invent: the outcome of every scenario, its tags including any set on an individual
+`Examples` block, an exact Scenario Outline row identity, and the source of every feature that ran.
+
+The plugin exists rather than the built-in one because a `@ConfigurationParameter` value is a
+compile-time constant, so the built-in plugin's path cannot be derived from the directory the run
+asked for — and flagd's two suites would write to the same file.
+
+Reading it needs no special tooling, but it does need one thing understood: **a scenario's outcome
+is the most severe result among its steps**, hooks included. `testCaseFinished` carries no status of
+its own. That is what makes a capability-gated skip truthful, because the aborted `@Before` hook
+contributes a `SKIPPED` result that outranks every step it stopped from running.
+
+```console
+$ jq -c 'select(.testStepFinished) | .testStepFinished
+         | {c: .testCaseStartedId, s: .testStepResult.status}' reports/flagd-rpc.ndjson \
+    | jq -s 'group_by(.c) | map({s: (map(.s) | if any(. == "FAILED") then "FAILED"
+                                              elif any(. == "SKIPPED") then "SKIPPED"
+                                              else "PASSED" end)})
+             | group_by(.s) | map({(.[0].s): length}) | add'
+{
+  "PASSED": 28,
+  "SKIPPED": 1
+}
+```
+
+The [`cucumber-query`](https://github.com/cucumber/messages/tree/main/java) helpers do this properly
+and in several languages; the above is only to show that the fact is in the file.
+
+### What identifies a scenario
+
+`pickle.astNodeIds`. For a scenario compiled from a Scenario Outline it is
+`[scenario id, table row id]`, and the second entry resolves in the `gherkinDocument` message to the
+`Examples` row the scenario was built from. Feature and name are not enough — the type-mismatch
+matrix in `errors.feature` is eleven rows sharing one name — and this is exact rather than derived:
+
+```console
+$ jq -c 'select(.pickle) | .pickle
+         | select(.name == "Requesting the wrong type returns the code default")
+         | {id, row: .astNodeIds[1]}' reports/flagd-rpc.ndjson | head -3
+{"id":"6c8debd2-...","row":"ab8b4a4b-..."}
+{"id":"a7c76b0a-...","row":"63d6d6c8-..."}
+{"id":"fecd333d-...","row":"bbd7f5ee-..."}
+```
+
+An earlier version of this module reverse-engineered the same fact by re-parsing the feature source
+and matching a pickle's reported line number against the Examples tables. The stream states it
+outright, which is the whole argument for a standard format over one we maintain.
+
+### What the envelope is for
+
+A Messages stream cannot say what it was a test *of*. The envelope carries the five things no
+standard results format identifies:
+
+- **`provider`** — what the provider calls itself through its own metadata, not the suite name. The
+  suite name is chosen to read well in a failure message (`flagd-rpc`), which makes it the
+  *configuration*, and it is reported as such. One provider with two materially different modes
+  produces two reports that are not interchangeable. Derived from the suite class name
+  (`MyProviderInProcessTest` → `my-provider-in-process`) unless the suite overrides
+  `ProviderTckHarness.configuration()`, which flagd's two do — a class in a package already called
+  `.../flagd/tck/` is named `InProcessTest`, and `in-process` on a report does not say whose.
+- **`sdk`** — read from the classpath rather than declared, because the TCK depends on an SDK version
+  *range* so that adopting it can never force an upgrade. What a consumer actually ran against is
+  only knowable at runtime.
+- **`tck`** — which implementation asked the questions, and `specRevision`, the open-feature/spec
+  commit the packaged artifacts came from. Baked into the JAR at build time from this module's POM:
+  the artifacts travel in the JAR, the repository they came from does not. The executed Gherkin no
+  longer rests on that pin alone — the stream carries the `source` of every feature, so it can be
+  diffed against the revision — but the pin is what identifies the two artifacts the stream does not
+  carry, `flags/canonical-flags.json` and `openapi/control-api.yaml`.
+- **`backend`** — what the provider was pointed at, and `controlApi`, which of the two control
+  contracts drove it. Always present, both of them: the same scenarios passing over the HTTP control
+  API and passing through in-process manipulation of a provider that *does* have a backend are not
+  the same claim, and this is the only field that separates them, so an omission would be an
+  unfalsifiable claim rather than no claim at all. See [Identifying the
+  run](#identifying-the-run).
+- **`declaration`** — the capability set the provider claims. This is an **input** to reading the
+  results, not a summary of them, which is why it cannot be derived from the stream. The stream says
+  a scenario was skipped; only the declaration says whether that is because the provider declines the
+  capability it needed. Given the declaration and a scenario's tags — both present — the reason for
+  each skip follows, so it does not have to be transported per scenario.
+
+  **One skip does not follow from it, and that one is why the reason travels anyway.** A capability
+  this SDK cannot express is absent from every Java declaration, and absent for a reason that says
+  nothing about the provider — `@large-integers` is not there because `Client.getIntegerDetails` is
+  32 bits, not because anyone declined it. A reader who inferred *"the provider declined"* from that
+  absence would be reading a decision into something no Java provider was ever offered. The gate's
+  reason is carried on the hook result that produced the skip, and its wording is deliberately unlike
+  an undeclared capability's, so the two are distinguishable in the results themselves. See
+  [Declaring capabilities](#declaring-capabilities).
+
+`knownDeviations` is the one thing neither the stream nor the declaration can express: whether a
+withheld capability is a limitation or a bug. See [Known deviations](#known-deviations).
+
+`results.digest` covers the `.ndjson`, so a consumer that fetched the two separately can tell that
+what it has is what the envelope describes.
+
+### What the report is for
+
+This suite promises that a scenario skipped for an undeclared capability is reported as skipped with
+the reason and *never* as passed — and a promise is not a check. The stream records every scenario
+individually, so a consumer can verify the rule instead of trusting a runner's headline number. Go's
+runner counts capability-gated skips in its **passed** tally, which is exactly the failure mode this
+makes impossible to hide.
+
+Every scenario appears exactly once, whatever happened to it. A report that quietly omitted the
+scenarios it did not run would satisfy every rule above and still mislead, because a reader would
+have no way to know how many questions went unasked. `ConformanceReportPluginTest` runs a fixture
+suite through the real Cucumber engine and asserts both properties over the emitted stream.
+
+[report-schema]: https://github.com/open-feature/spec/blob/main/specification/assets/provider-tck/report/conformance-report.schema.json
+[messages]: https://github.com/cucumber/messages
+
 ## Extending it
 
 A provider with features of its own — flagd's `fractional` targeting, a vendor's proprietary mode —
diff --git a/tools/tck/pom.xml b/tools/tck/pom.xml
index 99e5987db..cc2a5e02d 100644
--- a/tools/tck/pom.xml
+++ b/tools/tck/pom.xml
@@ -25,6 +25,39 @@
         -->
         <tck.spec.checkout.skip>false</tck.spec.checkout.skip>
 
+        <!--
+            THE CONFORMANCE ARTIFACTS THIS BUILD CARRIES
+            ============================================
+            A conformance report has to say which questions were asked, not only what the answers
+            were, so it records the open-feature/spec commit the packaged Gherkin, flag set and
+            control API came from. It is filtered into
+            src/main/resources-filtered/.../tck-build.properties and packaged in the JAR,
+            because the repository it came from is not.
+
+            The executed Gherkin no longer rests on this pin alone: the results stream carries the
+            `source` of every feature that ran, so a consumer can diff what executed against what
+            this revision contains. The pin is what identifies the two artifacts the stream does not
+            carry — flags/canonical-flags.json and openapi/control-api.yaml.
+
+            This must equal the `spec` submodule's pinned commit, which is where the artifacts
+            actually come from — the copies under src/main/resources are produced from it at
+            generate-resources and are gitignored. Checkable in one command, from this directory:
+
+              git -C spec rev-parse HEAD
+
+            A property rather than a value read from git during the build because Maven has no way
+            to capture a command's output into a property without another plugin, and the submodule
+            pin already moves only by deliberate commit.
+
+            It is no longer only a convention that they agree: this value reaches the classpath
+            through tck-build.properties, and ConformanceReportPluginTest asserts that what
+            TckBuildInfo reads back equals CanonicalAssetDigestTest.PINNED_REVISION, which that
+            test has in turn checked against the packaged assets by digest. So the chain from the
+            gitlink to the revision a report publishes is closed, and a re-pin that forgets this
+            line fails the build rather than producing a report that names a revision which did not
+            produce its scenarios.
+        -->
+        <tck.spec.revision>ff68adb4c7617ad2d980988241e92603bc247926</tck.spec.revision>
         <assertj.version>3.27.7</assertj.version>
         <awaitility.version>4.3.0</awaitility.version>
         <jackson-databind.version>2.22.1</jackson-databind.version>
@@ -109,6 +142,55 @@
             <artifactId>cucumber-junit-platform-engine</artifactId>
         </dependency>
 
+        <!--
+            Cucumber core and the message types — already on the classpath as transitive
+            dependencies of cucumber-junit-platform-engine, and declared here because
+            ConformanceReportPlugin compiles against them directly.
+
+            The conformance report carries its results as a Cucumber Messages stream and produces
+            that stream with io.cucumber.core.plugin.MessageFormatter, which is the same class the
+            built-in `message:<path>` plugin instantiates. Cucumber's own formatter rather than one
+            of ours, so the results cannot drift from what the built-in message plugin writes; only
+            the output path differs, because a plugin configured through an annotation cannot have a
+            path derived from the run. Versions are managed by cucumber-bom in the parent POM.
+        -->
+        <dependency>
+            <groupId>io.cucumber</groupId>
+            <artifactId>cucumber-core</artifactId>
+            <!-- version managed by cucumber-bom in parent -->
+        </dependency>
+        <dependency>
+            <groupId>io.cucumber</groupId>
+            <artifactId>messages</artifactId>
+            <!-- version managed by cucumber-bom in parent -->
+        </dependency>
+
+        <!--
+            Gherkin — CanonicalScenarios compiles this artifact's own feature files to work out what
+            the canonical scenario set is, so that CanonicalScenarioGuard can tell whether a run
+            discovered all of it. Cucumber's own parser rather than a hand-rolled one, because
+            "which scenarios does this file contain" has to mean exactly what it means to the runner.
+            Already on the classpath transitively through cucumber-core; declared because we compile
+            against it. Version managed by cucumber-bom in the parent POM.
+        -->
+        <dependency>
+            <groupId>io.cucumber</groupId>
+            <artifactId>gherkin</artifactId>
+            <scope>compile</scope>
+        </dependency>
+
+        <!--
+            JUnit Jupiter API — CanonicalScenarioGuard is a Jupiter test that the suite selects, so
+            that a reduced canonical set fails the build the way any other failing test does. A
+            listener cannot do it: the JUnit Platform catches and logs whatever a TestExecutionListener
+            throws, which is precisely a silent pass.
+        -->
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-api</artifactId>
+            <scope>compile</scope>
+        </dependency>
+
         <!-- PicoContainer object factory — injects TckState into every step class -->
         <dependency>
             <groupId>io.cucumber</groupId>
@@ -217,6 +299,23 @@
     </dependencies>
 
     <build>
+        <!--
+            The conformance artifacts are copied verbatim; only the generated build-info properties
+            are filtered. Filtering the feature files would be a portability hazard rather than a
+            convenience: a scenario is a byte-for-byte shared definition across four languages, and
+            a stray ${...} in one would silently make this language's copy different.
+        -->
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+                <filtering>false</filtering>
+            </resource>
+            <resource>
+                <directory>src/main/resources-filtered</directory>
+                <filtering>true</filtering>
+            </resource>
+        </resources>
+
         <plugins>
             <!--
                 Phase 1 – move the spec submodule's WORKING TREE to the pinned commit.
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/CanonicalScenarioGuard.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/CanonicalScenarioGuard.java
new file mode 100644
index 000000000..494028e4e
--- /dev/null
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/CanonicalScenarioGuard.java
@@ -0,0 +1,292 @@
+package dev.openfeature.contrib.tools.tck;
+
+import io.cucumber.junit.platform.engine.Constants;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.concurrent.ConcurrentHashMap;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.BeforeEachCallback;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.extension.ExtensionContext;
+import org.junit.platform.engine.TestSource;
+import org.junit.platform.engine.support.descriptor.ClasspathResourceSource;
+import org.junit.platform.launcher.TestIdentifier;
+import org.junit.platform.launcher.TestPlan;
+
+/**
+ * Fails a suite that is set up to run less than the whole canonical scenario set.
+ *
+ * <p>Everything else in this module makes the canonical set easy to extend safely. Nothing makes it
+ * hard to shrink, and shrinking it is the failure that matters: a run that asks fifty-four of the
+ * fifty-six questions and reports success is indistinguishable, in every artifact it produces, from
+ * one that asked all fifty-six. The known ways to get there are a feature file dropped into
+ * {@code gherkin/}, a {@code cucumber.filter.tags} or {@code cucumber.filter.name} expression, and
+ * selectors or glue overridden in a consuming module's {@code junit-platform.properties}.
+ *
+ * <p>Selected by {@link ProviderTckTest} as an ordinary JUnit Jupiter test, so a reduced set
+ * fails the build the way any other failing test does. A {@link
+ * org.junit.platform.launcher.TestExecutionListener} cannot do that job: the JUnit Platform catches
+ * and logs whatever a listener throws, which is exactly the silent pass being guarded against.
+ *
+ * <p>Two kinds of evidence, both available before a single scenario has run:
+ *
+ * <ul>
+ *   <li><strong>the discovered test plan</strong>, captured by {@link TckSuiteListener}. Which
+ *       scenarios a suite selected is settled at discovery, so a canonical file that was shadowed,
+ *       replaced or added to is visible there.
+ *   <li><strong>the effective filter configuration</strong>, read through this test's own
+ *       {@link ExtensionContext}. Cucumber applies {@code cucumber.filter.tags} as a skip at
+ *       execution rather than as a discovery filter — a filtered scenario is in the plan and never
+ *       runs — so the plan cannot show it and the configured expression has to be read directly. The
+ *       Jupiter engine inside the suite resolves configuration from the same sources the Cucumber
+ *       engine does, whether the value came from a system property, a
+ *       {@code junit-platform.properties} or an annotation on the suite.
+ * </ul>
+ *
+ * <p>Checking the setup rather than counting afterwards is not a compromise made for convenience. A
+ * count is only complete once the last scenario has finished, and the only hook that runs there is a
+ * listener, which cannot fail anything. Both kinds of evidence are settled before the first scenario
+ * runs, so the check itself takes no measurable time and needs no Compose stack — though where its
+ * result appears in a run depends on the order the JUnit Platform happens to execute the two engines
+ * in, which is not specified.
+ *
+ * <p>Extension scenarios are ignored entirely. The check is defined over {@code gherkin/}, so an
+ * adopter's {@code extensions/} scenarios can neither stand in for a canonical scenario nor look
+ * like a spurious one.
+ *
+ * <p>Separable from the rest of the extension work by design: it guards a bypass rather than enabling
+ * anything, and dropping it leaves the extension point unaffected.
+ */
+@ExtendWith(CanonicalScenarioGuard.CaptureConfiguration.class)
+public final class CanonicalScenarioGuard {
+
+    /**
+     * System property that downgrades this check to a skip.
+     *
+     * <p>An escape hatch is necessary rather than a weakness. Running one scenario with
+     * {@code -Dcucumber.filter.tags=@events} is routine while debugging a provider, and a check that
+     * made that impossible would be switched off permanently instead of temporarily. It produces a
+     * skip rather than a pass, so the run says out loud that its canonical set was not verified.
+     */
+    public static final String PARTIAL_PROPERTY = "tck.partial";
+
+    /** Environment variable equivalent of {@link #PARTIAL_PROPERTY}. */
+    public static final String PARTIAL_ENV = "TCK_PARTIAL";
+
+    /** Cucumber configuration keys that stop a discovered scenario from running. */
+    private static final String[] FILTER_KEYS = {
+        Constants.FILTER_TAGS_PROPERTY_NAME, Constants.FILTER_NAME_PROPERTY_NAME
+    };
+
+    /**
+     * What each TCK suite in a discovered plan selected under {@code gherkin/}.
+     *
+     * <p>Keyed by suite class name and accumulated rather than replaced. A suite discovers its
+     * children through a launcher of its own, so this is called more than once per build with plans
+     * of differing scope, and a plan containing no TCK suite says nothing about the ones already
+     * recorded.
+     */
+    private static final Map<String, Set<CanonicalScenarios.Ref>> DISCOVERED = new ConcurrentHashMap<>();
+
+    private static final String CANONICAL_PREFIX = ProviderTck.FEATURES + "/";
+
+    /**
+     * Records what the suites in a discovered plan will run.
+     *
+     * @param plan the plan about to be executed
+     */
+    static void observe(TestPlan plan) {
+        for (TestIdentifier root : plan.getRoots()) {
+            collectSuites(plan, root);
+        }
+    }
+
+    /** Forgets what has been observed, so a test can drive the guard over a plan of its own. */
+    static void forget() {
+        DISCOVERED.clear();
+    }
+
+    /**
+     * Returns what each suite in the observed plans selected under {@code gherkin/}.
+     *
+     * @return canonical scenarios by suite class name
+     */
+    static Map<String, Set<CanonicalScenarios.Ref>> discovered() {
+        return Collections.unmodifiableMap(new LinkedHashMap<>(DISCOVERED));
+    }
+
+    /** Asserts that this run will execute the whole canonical scenario set. */
+    @Test
+    @DisplayName("the canonical scenario set was not reduced")
+    void theCanonicalScenarioSetWasNotReduced() {
+        if (partialRunAllowed()) {
+            Assumptions.abort("Skipped: " + PARTIAL_PROPERTY + " is set, so the canonical scenario set was not "
+                    + "verified. This run is not a conformance run.");
+        }
+
+        String problems = check(CanonicalScenarios.shipped(), discovered(), CaptureConfiguration.filters());
+        if (problems != null) {
+            throw new AssertionError(problems);
+        }
+    }
+
+    /**
+     * Reports every way this run falls short of the canonical set.
+     *
+     * @param canonical the canonical scenario set, as the TCK ships it
+     * @param discovered what each suite selected under {@code gherkin/}
+     * @param filters configured Cucumber filters, by configuration key
+     * @return a report of every problem found, or {@code null} when there is none
+     */
+    static String check(
+            Set<CanonicalScenarios.Ref> canonical,
+            Map<String, Set<CanonicalScenarios.Ref>> discovered,
+            Map<String, String> filters) {
+        List<String> problems = new ArrayList<>();
+
+        for (Map.Entry<String, String> filter : filters.entrySet()) {
+            problems.add(filter.getKey() + " is set to '" + filter.getValue()
+                    + "'. Cucumber applies it by skipping scenarios that would otherwise have run, so a "
+                    + "conformance run cannot be filtered. Decline capabilities your provider does not have "
+                    + "through capabilities() instead — those scenarios are reported as skipped with a reason, "
+                    + "which a filtered one is not. To filter anyway while debugging, set -D" + PARTIAL_PROPERTY
+                    + "=true and accept that the run is not a conformance run.");
+        }
+
+        if (discovered.isEmpty()) {
+            problems.add("No TCK suite was found in the JUnit test plan, so it cannot be shown that the canonical "
+                    + "scenarios will run. This normally means TckSuiteListener was not auto-registered — the same "
+                    + "condition that makes harness discovery fall back to ServiceLoader. Enable JUnit Platform "
+                    + "listener auto-registration, or set -D" + PARTIAL_PROPERTY + "=true to accept a run whose "
+                    + "canonical set is unverified.");
+        }
+
+        for (Map.Entry<String, Set<CanonicalScenarios.Ref>> suite : discovered.entrySet()) {
+            Set<CanonicalScenarios.Ref> missing = new TreeSet<>(canonical);
+            missing.removeAll(suite.getValue());
+            if (!missing.isEmpty()) {
+                problems.add(suite.getKey() + " left out " + missing.size() + " of " + canonical.size()
+                        + " canonical scenarios: " + missing
+                        + ". A conformance run executes the canonical set in full. Look for a selector or glue "
+                        + "override in junit-platform.properties, a cucumber.features property, or a feature file "
+                        + "of your own in " + CANONICAL_PREFIX + " shadowing a canonical one. Scenarios your "
+                        + "provider cannot support are declined through capabilities(), which reports them as "
+                        + "skipped rather than removing them.");
+            }
+
+            Set<CanonicalScenarios.Ref> unexpected = new TreeSet<>(suite.getValue());
+            unexpected.removeAll(canonical);
+            if (!unexpected.isEmpty()) {
+                problems.add(suite.getKey() + " selected " + unexpected.size() + " scenario(s) under "
+                        + CANONICAL_PREFIX + " that this TCK does not ship: " + unexpected
+                        + ". That directory is the canonical set, and adding to it changes what conformance means. "
+                        + "Put your own scenarios in " + ProviderTck.EXTENSIONS + "/ instead, where they run in the "
+                        + "same suite and the same backend lifecycle.");
+            }
+        }
+
+        return problems.isEmpty() ? null : String.join(System.lineSeparator() + System.lineSeparator(), problems);
+    }
+
+    /**
+     * Returns the Cucumber filters this run is configured with.
+     *
+     * @param context the executing test's context, which resolves configuration the way the Cucumber
+     *     engine beside it does
+     * @return configured filters by configuration key, empty when the run is unfiltered
+     */
+    static Map<String, String> filtersIn(ExtensionContext context) {
+        Map<String, String> configured = new LinkedHashMap<>();
+        for (String key : FILTER_KEYS) {
+            context.getConfigurationParameter(key)
+                    .map(String::trim)
+                    .filter(value -> !value.isEmpty())
+                    .ifPresent(value -> configured.put(key, value));
+        }
+        return configured;
+    }
+
+    /** Returns whether the run has declared itself partial. */
+    private static boolean partialRunAllowed() {
+        return isTrue(System.getProperty(PARTIAL_PROPERTY)) || isTrue(System.getenv(PARTIAL_ENV));
+    }
+
+    private static boolean isTrue(String value) {
+        return value != null && ("".equals(value.trim()) || Boolean.parseBoolean(value.trim()));
+    }
+
+    private static void collectSuites(TestPlan plan, TestIdentifier identifier) {
+        Optional<Class<? extends ProviderTckHarness>> suite = TckSuiteListener.harnessClassOf(identifier);
+        if (suite.isPresent()) {
+            Set<CanonicalScenarios.Ref> canonical = new LinkedHashSet<>();
+            collectCanonical(plan, identifier, canonical);
+            DISCOVERED.put(suite.get().getName(), Collections.unmodifiableSet(canonical));
+            return;
+        }
+        for (TestIdentifier child : plan.getChildren(identifier)) {
+            collectSuites(plan, child);
+        }
+    }
+
+    private static void collectCanonical(TestPlan plan, TestIdentifier identifier, Set<CanonicalScenarios.Ref> into) {
+        if (identifier.isTest()) {
+            canonicalRefOf(identifier).ifPresent(into::add);
+        }
+        for (TestIdentifier child : plan.getChildren(identifier)) {
+            collectCanonical(plan, child, into);
+        }
+    }
+
+    /**
+     * Returns the canonical scenario a test identifier stands for, if it is one.
+     *
+     * <p>A Cucumber scenario discovered from a classpath resource carries a
+     * {@link ClasspathResourceSource} naming the feature resource and the scenario's line — for a
+     * Scenario Outline, the line of the {@code Examples} row it was compiled from, which is what makes
+     * each row count separately.
+     */
+    private static Optional<CanonicalScenarios.Ref> canonicalRefOf(TestIdentifier identifier) {
+        Optional<TestSource> source = identifier.getSource();
+        if (!source.isPresent() || !(source.get() instanceof ClasspathResourceSource)) {
+            return Optional.empty();
+        }
+        ClasspathResourceSource resource = (ClasspathResourceSource) source.get();
+        String name = resource.getClasspathResourceName();
+        if (!name.startsWith(CANONICAL_PREFIX)) {
+            return Optional.empty();
+        }
+        return resource.getPosition()
+                .map(position -> new CanonicalScenarios.Ref(name, position.getLine(), identifier.getDisplayName()));
+    }
+
+    /**
+     * Hands the guard the configuration of the engine it is running in.
+     *
+     * <p>Jupiter resolves configuration parameters for an extension, not for a test method, so the
+     * context is captured here rather than injected. Inside a suite it carries the suite's own
+     * {@code @ConfigurationParameter} values as well as the system properties and
+     * {@code junit-platform.properties} the Cucumber engine beside it reads.
+     */
+    static final class CaptureConfiguration implements BeforeEachCallback {
+
+        private static volatile Map<String, String> filters = Collections.emptyMap();
+
+        @Override
+        public void beforeEach(ExtensionContext context) {
+            filters = Collections.unmodifiableMap(filtersIn(context));
+        }
+
+        static Map<String, String> filters() {
+            return filters;
+        }
+    }
+}
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/CanonicalScenarios.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/CanonicalScenarios.java
new file mode 100644
index 000000000..d417f045f
--- /dev/null
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/CanonicalScenarios.java
@@ -0,0 +1,260 @@
+package dev.openfeature.contrib.tools.tck;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import io.cucumber.gherkin.GherkinParser;
+import io.cucumber.messages.types.Envelope;
+import io.cucumber.messages.types.Examples;
+import io.cucumber.messages.types.Feature;
+import io.cucumber.messages.types.FeatureChild;
+import io.cucumber.messages.types.GherkinDocument;
+import io.cucumber.messages.types.Rule;
+import io.cucumber.messages.types.RuleChild;
+import io.cucumber.messages.types.Scenario;
+import io.cucumber.messages.types.TableRow;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.UncheckedIOException;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.nio.file.DirectoryStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.security.CodeSource;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.stream.Stream;
+
+/**
+ * The canonical scenario set, as this artifact ships it.
+ *
+ * <p>Read from <em>this artifact's own code source</em> — the JAR or {@code target/classes} that
+ * {@link ProviderTck} was loaded from — rather than through the classloader. That is the point of the
+ * class: a feature file placed in {@code gherkin/} on another classpath root shadows the canonical
+ * one of the same name, and a check that read the shadowed copy back through
+ * {@code getResource("gherkin/errors.feature")} would be checking the replacement against itself.
+ * The code source is the only view of {@code gherkin/} that an adopter's classpath cannot alter.
+ *
+ * <p>A scenario is identified by its resource name and its line, which is what a Cucumber
+ * {@code ClasspathResourceSource} in the JUnit test plan carries. For a Scenario Outline that line is
+ * the {@code Examples} row, so each row counts individually — which is necessary, because eleven rows
+ * of the type-mismatch matrix share one name.
+ *
+ * <p>What this does <strong>not</strong> establish is that the canonical files contain what they
+ * should. A replacement file that happened to place its scenarios on the same lines would satisfy the
+ * comparison. Content is covered elsewhere and better: the results stream carries the {@code source}
+ * of every feature that executed, and the report's {@code tck.specRevision} says which revision it
+ * should match.
+ */
+final class CanonicalScenarios {
+
+    private static final String FEATURE_SUFFIX = ".feature";
+
+    private static volatile Set<Ref> shipped;
+
+    private CanonicalScenarios() {}
+
+    /**
+     * Returns every scenario the canonical feature files in this artifact compile to.
+     *
+     * @return the canonical scenario set, never empty
+     * @throws IllegalStateException if this artifact's own feature files cannot be read
+     */
+    static Set<Ref> shipped() {
+        Set<Ref> cached = shipped;
+        if (cached == null) {
+            synchronized (CanonicalScenarios.class) {
+                if (shipped == null) {
+                    shipped = Collections.unmodifiableSet(read());
+                }
+                cached = shipped;
+            }
+        }
+        return cached;
+    }
+
+    /** Reads and compiles the canonical feature files out of the code source this class came from. */
+    @SuppressFBWarnings(
+            value = "PATH_TRAVERSAL_IN",
+            justification = "The path is this class's own code source, reported by the JVM. Nothing outside the "
+                    + "running artifact can influence it, and reading it from anywhere else would defeat the point "
+                    + "of the class")
+    private static Set<Ref> read() {
+        CodeSource codeSource = ProviderTck.class.getProtectionDomain().getCodeSource();
+        URL location = codeSource == null ? null : codeSource.getLocation();
+        if (location == null) {
+            throw new IllegalStateException("The tck code source is not visible to this JVM, so the "
+                    + "canonical scenario set cannot be established. Set -D" + CanonicalScenarioGuard.PARTIAL_PROPERTY
+                    + "=true to run without the canonical-set check, understanding that the run is then not a "
+                    + "conformance run.");
+        }
+
+        Path path;
+        try {
+            path = Paths.get(location.toURI());
+        } catch (URISyntaxException | IllegalArgumentException e) {
+            throw new IllegalStateException(
+                    "The tck code source " + location + " is not a file, so the "
+                            + "canonical scenario set cannot be established.",
+                    e);
+        }
+
+        Set<Ref> refs = new LinkedHashSet<>();
+        try {
+            if (Files.isDirectory(path)) {
+                fromDirectory(path, refs);
+            } else {
+                fromJar(path, refs);
+            }
+        } catch (IOException e) {
+            throw new UncheckedIOException("Could not read the canonical feature files from " + path, e);
+        }
+
+        if (refs.isEmpty()) {
+            throw new IllegalStateException("No canonical scenarios found in " + ProviderTck.FEATURES + "/ of the "
+                    + "tck artifact at " + path + ". The artifact is not intact.");
+        }
+        return refs;
+    }
+
+    private static void fromDirectory(Path root, Set<Ref> refs) throws IOException {
+        Path features = root.resolve(ProviderTck.FEATURES);
+        if (!Files.isDirectory(features)) {
+            return;
+        }
+        try (DirectoryStream<Path> entries = Files.newDirectoryStream(features, "*" + FEATURE_SUFFIX)) {
+            for (Path entry : entries) {
+                String name = ProviderTck.FEATURES + "/" + entry.getFileName();
+                collect(name, Files.readAllBytes(entry), refs);
+            }
+        }
+    }
+
+    private static void fromJar(Path jar, Set<Ref> refs) throws IOException {
+        try (JarFile file = new JarFile(jar.toFile())) {
+            Enumeration<JarEntry> entries = file.entries();
+            while (entries.hasMoreElements()) {
+                JarEntry entry = entries.nextElement();
+                String name = entry.getName();
+                if (!entry.isDirectory()
+                        && name.startsWith(ProviderTck.FEATURES + "/")
+                        && name.endsWith(FEATURE_SUFFIX)) {
+                    try (InputStream in = file.getInputStream(entry)) {
+                        collect(name, readAll(in), refs);
+                    }
+                }
+            }
+        }
+    }
+
+    private static byte[] readAll(InputStream in) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        byte[] buffer = new byte[8192];
+        int read;
+        while ((read = in.read(buffer)) != -1) {
+            out.write(buffer, 0, read);
+        }
+        return out.toByteArray();
+    }
+
+    /**
+     * Compiles one feature file to the scenarios Cucumber would run from it.
+     *
+     * <p>The Gherkin document is walked rather than the pickles it produces, because a pickle carries
+     * no line number — and the line is what the JUnit test plan identifies a scenario by. The walk is
+     * the same rule Gherkin's own compiler applies: a Scenario Outline yields one scenario per
+     * {@code Examples} body row, anything else yields one at its own line.
+     */
+    private static void collect(String resource, byte[] content, Set<Ref> refs) {
+        GherkinParser parser = GherkinParser.builder()
+                .includeSource(false)
+                .includePickles(false)
+                .includeGherkinDocument(true)
+                .build();
+
+        try (Stream<Envelope> envelopes = parser.parse(resource, content)) {
+            envelopes.forEach(envelope -> envelope.getGherkinDocument()
+                    .flatMap(GherkinDocument::getFeature)
+                    .ifPresent(feature -> collectFeature(resource, feature, refs)));
+        }
+    }
+
+    private static void collectFeature(String resource, Feature feature, Set<Ref> refs) {
+        for (FeatureChild child : feature.getChildren()) {
+            child.getScenario().ifPresent(scenario -> collectScenario(resource, scenario, refs));
+            child.getRule().ifPresent(rule -> collectRule(resource, rule, refs));
+        }
+    }
+
+    private static void collectRule(String resource, Rule rule, Set<Ref> refs) {
+        for (RuleChild child : rule.getChildren()) {
+            child.getScenario().ifPresent(scenario -> collectScenario(resource, scenario, refs));
+        }
+    }
+
+    private static void collectScenario(String resource, Scenario scenario, Set<Ref> refs) {
+        List<Examples> examples = scenario.getExamples();
+        if (examples.isEmpty()) {
+            refs.add(new Ref(resource, scenario.getLocation().getLine(), scenario.getName()));
+            return;
+        }
+        for (Examples block : examples) {
+            for (TableRow row : block.getTableBody()) {
+                refs.add(new Ref(resource, row.getLocation().getLine(), scenario.getName()));
+            }
+        }
+    }
+
+    /**
+     * One scenario, identified the way the JUnit test plan identifies it.
+     *
+     * <p>The name is carried for the failure message only; two scenarios are the same scenario when
+     * they are at the same line of the same classpath resource.
+     */
+    static final class Ref implements Comparable<Ref> {
+
+        private final String resource;
+        private final long line;
+        private final String name;
+
+        Ref(String resource, long line, String name) {
+            this.resource = resource;
+            this.line = line;
+            this.name = name;
+        }
+
+        @Override
+        public boolean equals(Object other) {
+            if (this == other) {
+                return true;
+            }
+            if (!(other instanceof Ref)) {
+                return false;
+            }
+            Ref that = (Ref) other;
+            return line == that.line && resource.equals(that.resource);
+        }
+
+        @Override
+        public int hashCode() {
+            return 31 * resource.hashCode() + Long.hashCode(line);
+        }
+
+        @Override
+        public int compareTo(Ref other) {
+            int byResource = resource.compareTo(other.resource);
+            return byResource != 0 ? byResource : Long.compare(line, other.line);
+        }
+
+        @Override
+        public String toString() {
+            return resource + ":" + line + (name == null || name.isEmpty() ? "" : " (" + name + ")");
+        }
+    }
+}
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ConformanceReport.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ConformanceReport.java
new file mode 100644
index 000000000..05c62d46d
--- /dev/null
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ConformanceReport.java
@@ -0,0 +1,255 @@
+package dev.openfeature.contrib.tools.tck;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import java.util.List;
+
+/**
+ * The envelope of one conformance run: what was tested, what the provider claims, and where the
+ * results are.
+ *
+ * <p>This document deliberately carries <strong>no</strong> per-scenario outcomes. The results
+ * themselves are a standard format — a Cucumber Messages stream, referenced by {@link Results} —
+ * because per-scenario outcomes, tags, Scenario Outline row identity and the executed feature source
+ * are all already specified there. Defining them a second time here would create a format to
+ * maintain and version and two places for the same fact to disagree.
+ *
+ * <p>The field names and nesting are fixed by the report schema in the OpenFeature specification
+ * repository. This class is a transcription of that schema rather than a shape that would be
+ * convenient in Java, because the point of the format is that every language's TCK emits the same
+ * document.
+ *
+ * <p>Fields left {@code null} are omitted from the JSON. The schema sets
+ * {@code additionalProperties: false} throughout, so an unexpected field is a validation failure
+ * rather than something a consumer ignores.
+ *
+ * @see <a href="https://github.com/open-feature/spec/issues/424">open-feature/spec#424</a>
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class ConformanceReport {
+
+    /**
+     * The major version of the report schema this document conforms to.
+     *
+     * <p>An integer as a string, so a consumer can reject a report it does not understand rather
+     * than guessing at it.
+     */
+    public static final String SCHEMA_VERSION = "1";
+
+    /** The schema version this document claims. */
+    public final String schemaVersion;
+
+    /** What was tested. */
+    public final Provider provider;
+
+    /** Which OpenFeature SDK the provider was exercised through. */
+    public final Sdk sdk;
+
+    /** What asked the questions, and which questions. */
+    public final Tck tck;
+
+    /**
+     * What the provider was pointed at.
+     *
+     * <p>Always present: {@code backend} is in the schema's top-level {@code required} array,
+     * including for a provider with no backend — that is what {@code controlApi}'s
+     * {@code in-process} member is for.
+     */
+    public final Backend backend;
+
+    /** The capability set this provider claims. */
+    public final Declaration declaration;
+
+    /** Where the executed results live, and in what format. */
+    public final Results results;
+
+    /** Deviations the provider acknowledges, or {@code null} to say nothing. */
+    public final List<KnownDeviation> knownDeviations;
+
+    ConformanceReport(
+            Provider provider,
+            Sdk sdk,
+            Tck tck,
+            Backend backend,
+            Declaration declaration,
+            Results results,
+            List<KnownDeviation> knownDeviations) {
+        this.schemaVersion = SCHEMA_VERSION;
+        this.provider = provider;
+        this.sdk = sdk;
+        this.tck = tck;
+        this.backend = backend;
+        this.declaration = declaration;
+        this.results = results;
+        this.knownDeviations = knownDeviations;
+    }
+
+    /** Identifies the provider under test. */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Provider {
+
+        /**
+         * What the provider calls itself, through its own metadata.
+         *
+         * <p>Not the name of the suite. A suite name is chosen to read well in a failure message —
+         * {@code flagd-rpc} — which makes it the {@link #configuration}, not the identity.
+         */
+        public final String name;
+
+        /** The language the provider is written in, always {@code java} here. */
+        public final String language;
+
+        /**
+         * Which configuration of the provider was tested.
+         *
+         * <p>A provider with more than one materially different mode produces one report per mode,
+         * and they are not interchangeable: flagd's RPC and in-process resolvers differ in whether
+         * they emit {@code PROVIDER_STALE}, so a report keyed on the provider name alone would have
+         * to pick one and misrepresent the other.
+         */
+        public final String configuration;
+
+        Provider(String name, String language, String configuration) {
+            this.name = name;
+            this.language = language;
+            this.configuration = configuration;
+        }
+    }
+
+    /** Identifies the OpenFeature SDK the run went through. */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Sdk {
+
+        /** Maven coordinates of the SDK, without a version. */
+        public final String name;
+
+        /** The resolved SDK version. */
+        public final String version;
+
+        Sdk(String name, String version) {
+            this.name = name;
+            this.version = version;
+        }
+    }
+
+    /** Identifies the TCK implementation and the conformance artifacts it executed. */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Tck {
+
+        /** Which TCK implementation produced this report. */
+        public final String implementation;
+
+        /** The version of that implementation. */
+        public final String version;
+
+        /**
+         * The open-feature/spec commit the executed artifacts came from.
+         *
+         * <p>The executed Gherkin no longer has to be taken on trust: the results stream carries the
+         * {@code source} of every feature it ran, so a consumer can diff what executed against what
+         * this revision contains. The revision still identifies the two artifacts the stream does
+         * <em>not</em> carry — the canonical flag set and the control API definition.
+         */
+        public final String specRevision;
+
+        Tck(String implementation, String version, String specRevision) {
+            this.implementation = implementation;
+            this.version = version;
+            this.specRevision = specRevision;
+        }
+    }
+
+    /** Describes what the provider was pointed at. */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Backend {
+
+        /** A short human-readable description of the stack under test. */
+        public final String description;
+
+        /**
+         * How the backend was driven, {@code http} or {@code in-process}.
+         *
+         * <p>{@code in-process} is the narrow allowance made for providers with no backend; a report
+         * claiming it for a provider that has one should be treated with suspicion.
+         *
+         * <p>Always written, because there is no third case an absent value would cover: every
+         * {@link BackendControl} is either driving a real backend over the control API or
+         * manipulating an in-process one, so an omission would be an unfalsifiable claim rather than
+         * no claim at all. {@link ControlApi} is closed for the same reason the schema's enum is, and
+         * serialises to the two values it names.
+         */
+        public final ControlApi controlApi;
+
+        Backend(String description, ControlApi controlApi) {
+            this.description = description;
+            this.controlApi = controlApi;
+        }
+    }
+
+    /** The capability set this provider claims, as the Gherkin tags that gate them. */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Declaration {
+
+        /**
+         * Capabilities the provider declares, including the leading at-sign.
+         *
+         * <p>An <strong>input</strong> to reading the results rather than a summary of them, which is
+         * why it cannot be derived from the results payload and has to be stated here. A skipped
+         * scenario in the stream says the question was not put to this provider; only the declaration
+         * says whether that is because the provider declines the capability. Given the declaration
+         * and a scenario's tags — both of which the stream carries — the reason for a skip follows
+         * without being transported per scenario.
+         */
+        public final List<String> declared;
+
+        Declaration(List<String> declared) {
+            this.declared = declared;
+        }
+    }
+
+    /** Where the executed results live, and in what format. */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Results {
+
+        /** The ndjson protocol at {@code https://github.com/cucumber/messages}. */
+        public static final String CUCUMBER_MESSAGES = "cucumber-messages";
+
+        /** The results format, always {@link #CUCUMBER_MESSAGES} here. */
+        public final String format;
+
+        /**
+         * The Cucumber Messages release the stream was produced against.
+         *
+         * <p>Messages is versioned and the TCK implementations pin different releases -- this one
+         * takes whatever cucumber-jvm bundles -- so a consumer holding two reports cannot assume one
+         * schema validates both.
+         *
+         * <p>Guessing is worse than not validating. A later schema accepts messages this producer
+         * could not have emitted, and an earlier one rejects messages that are perfectly valid, so a
+         * check against the wrong version reports a result that has nothing to do with the stream.
+         *
+         * <p>Read back out of the stream's own {@code meta.protocolVersion} rather than from a
+         * constant or the artifact version, so the envelope and the stream cannot disagree about
+         * which release produced it.
+         */
+        public final String formatVersion;
+
+        /**
+         * Where to fetch the results: a path relative to this document.
+         *
+         * <p>Referenced rather than inlined because a Messages stream carries the feature sources and
+         * so is far larger than this envelope, and because a consumer deciding whether it cares about
+         * a report should not have to fetch the whole run to find out.
+         */
+        public final String location;
+
+        /** Digest over the results payload as {@code sha256:<hex>}. */
+        public final String digest;
+
+        Results(String format, String formatVersion, String location, String digest) {
+            this.format = format;
+            this.formatVersion = formatVersion;
+            this.location = location;
+            this.digest = digest;
+        }
+    }
+}
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ConformanceReportPlugin.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ConformanceReportPlugin.java
new file mode 100644
index 000000000..b669b5122
--- /dev/null
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ConformanceReportPlugin.java
@@ -0,0 +1,300 @@
+package dev.openfeature.contrib.tools.tck;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import io.cucumber.core.plugin.MessageFormatter;
+import io.cucumber.messages.types.Envelope;
+import io.cucumber.plugin.ConcurrentEventListener;
+import io.cucumber.plugin.event.EventPublisher;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Supplier;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Writes a machine-readable conformance report for the suite that just ran.
+ *
+ * <p>Registered automatically by {@link ProviderTckTest}, so an adopter changes nothing to
+ * get one. It is opt-in per <em>run</em>: set {@value #REPORT_DIR_ENV} (or the
+ * {@value #REPORT_DIR_PROPERTY} system property) and each suite writes two files,
+ * {@code <dir>/<configuration>.json} and {@code <dir>/<configuration>.ndjson}. Emitting a report is
+ * a property of the run rather than of the code — CI asks for one, a developer running the suite
+ * locally does not — and unset means no report, which is not an error. Several suites in one JVM each
+ * write their own pair of files, so flagd's two resolvers do not collide.
+ *
+ * <p><strong>The results are not a format this project defines.</strong> The {@code .ndjson} file is
+ * a <a href="https://github.com/cucumber/messages">Cucumber Messages</a> stream, produced by
+ * Cucumber's own {@link MessageFormatter} — the same class the built-in {@code message:<path>} plugin
+ * instantiates, so the bytes are what {@code --plugin message:...} would have written. It already
+ * carries everything a per-scenario report would have had to invent: the outcome of every scenario,
+ * its tags including any on an individual {@code Examples} block, an exact Scenario Outline row
+ * identity through pickle AST node ids, and the {@code source} of every feature that executed.
+ *
+ * <p>The {@code .json} file is the envelope, and it exists because a Messages stream cannot say what
+ * it was a test <em>of</em>. No standard format identifies the provider, the SDK it was driven
+ * through, the TCK build, or — most importantly — the capability set the provider declared. That
+ * declaration is an input to reading the results rather than a summary of them: the stream says a
+ * scenario was skipped, and only the declaration says whether that is because the provider declines
+ * the capability it needed.
+ *
+ * <p><strong>Why the stream is buffered rather than streamed to the file.</strong> The file name is
+ * derived from the provider configuration, which is not known when Cucumber wires plugins up — the
+ * suite reports it once its runtime has started, which is after the first messages have already been
+ * emitted. Buffering keeps one file per suite correctly named, and has the side benefit that
+ * {@code results.digest} is computed over exactly the bytes that were written. The stream for this
+ * suite is well under a megabyte.
+ *
+ * @see <a href="https://github.com/open-feature/spec/issues/424">open-feature/spec#424</a>
+ */
+public final class ConformanceReportPlugin implements ConcurrentEventListener {
+
+    /** Environment variable naming the directory reports are written to. */
+    public static final String REPORT_DIR_ENV = "TCK_REPORT_DIR";
+
+    /**
+     * System property naming the directory reports are written to, taking precedence over the
+     * environment variable.
+     *
+     * <p>Accepted in addition to {@value #REPORT_DIR_ENV} because {@code -D} is how a Maven or
+     * Gradle invocation is usually parameterised. The environment variable is the portable spelling
+     * and is what every other language's TCK reads, so a cross-language CI job can set one thing.
+     */
+    public static final String REPORT_DIR_PROPERTY = "tck.report.dir";
+
+    /** Extension of the envelope, which is what a consumer reads first. */
+    static final String ENVELOPE_EXTENSION = ".json";
+
+    /** Extension of the Cucumber Messages stream the envelope points at. */
+    static final String RESULTS_EXTENSION = ".ndjson";
+
+    private static final Logger log = LoggerFactory.getLogger(ConformanceReportPlugin.class);
+
+    private static final String LANGUAGE = "java";
+
+    private final Supplier<String> reportDir;
+    private final Supplier<Optional<TckRunMetadata>> metadata;
+
+    /** Creates the plugin Cucumber instantiates by name. */
+    public ConformanceReportPlugin() {
+        this(ConformanceReportPlugin::configuredReportDir, TckRuntime::lastRunMetadata);
+    }
+
+    ConformanceReportPlugin(Supplier<String> reportDir, Supplier<Optional<TckRunMetadata>> metadata) {
+        this.reportDir = reportDir;
+        this.metadata = metadata;
+    }
+
+    @Override
+    public void setEventPublisher(EventPublisher publisher) {
+        String dir = reportDir.get();
+        if (dir == null) {
+            // Nothing asked for a report, so nothing is collected either. Registering the message
+            // formatter regardless would buffer a stream for every local test run.
+            return;
+        }
+
+        ByteArrayOutputStream results = new ByteArrayOutputStream();
+        new MessageFormatter(results).setEventPublisher(publisher);
+
+        // Registered *after* the formatter, and deliberately so. Cucumber invokes the handlers for
+        // one event type in registration order, and the formatter closes its writer when it sees
+        // the run-finished message; going second is what guarantees the buffer is complete and
+        // flushed before the digest is taken over it.
+        publisher.registerHandlerFor(Envelope.class, envelope -> {
+            if (envelope.getTestRunFinished().isPresent()) {
+                write(dir, results.toByteArray());
+            }
+        });
+    }
+
+    /**
+     * Returns the directory reports are written to, or {@code null} when none was configured.
+     *
+     * @return the configured report directory, trimmed, or {@code null}
+     */
+    static String configuredReportDir() {
+        String property = System.getProperty(REPORT_DIR_PROPERTY);
+        if (property != null && !property.trim().isEmpty()) {
+            return property.trim();
+        }
+        String environment = System.getenv(REPORT_DIR_ENV);
+        if (environment != null && !environment.trim().isEmpty()) {
+            return environment.trim();
+        }
+        return null;
+    }
+
+    /**
+     * Assembles the envelope for what the run observed.
+     *
+     * @param run what the runtime recorded about this suite
+     * @param location where the results stream sits, relative to the envelope
+     * @param digest digest over the results stream
+     * @return the envelope, ready to serialise
+     */
+    ConformanceReport build(TckRunMetadata run, String location, String digest, String formatVersion) {
+        return new ConformanceReport(
+                new ConformanceReport.Provider(run.providerName(), LANGUAGE, run.configuration()),
+                new ConformanceReport.Sdk(TckBuildInfo.SDK_NAME, TckBuildInfo.sdkVersion()),
+                new ConformanceReport.Tck(
+                        TckBuildInfo.IMPLEMENTATION, TckBuildInfo.tckVersion(), TckBuildInfo.specRevision()),
+                backendOf(run),
+                new ConformanceReport.Declaration(declaredTags(run.capabilities())),
+                new ConformanceReport.Results(
+                        ConformanceReport.Results.CUCUMBER_MESSAGES, formatVersion, location, digest),
+                run.knownDeviations().isEmpty() ? null : run.knownDeviations());
+    }
+
+    /**
+     * Lists the declared capabilities as Gherkin tags, in the order the vocabulary declares them.
+     *
+     * <p>Ordered by the enum rather than by the set so that two runs of the same configuration
+     * produce byte-identical declarations, which is what makes the envelopes diffable.
+     *
+     * <p>{@linkplain Capability#reserved() Reserved} capabilities are skipped. A declaration that
+     * names one is already rejected where it enters the run, in {@link TckRunMetadata}, so this is
+     * not the thing that tells the adopter; it is what makes "no reserved tag in the emitted
+     * declaration" a property of the code that writes the document rather than a consequence of a
+     * check somewhere upstream of it.
+     */
+    private static List<String> declaredTags(Set<Capability> declared) {
+        List<String> tags = new ArrayList<>(declared.size());
+        for (Capability capability : Capability.values()) {
+            if (!capability.reserved() && declared.contains(capability)) {
+                tags.add(capability.tag());
+            }
+        }
+        return Collections.unmodifiableList(tags);
+    }
+
+    /**
+     * Assembles the {@code backend} block, which is always emitted.
+     *
+     * <p>The schema requires it at the top level, and {@code controlApi} within it, so there is no
+     * conditional emission left here: a control that could not say how it drove the backend would
+     * have failed to compile.
+     */
+    private static ConformanceReport.Backend backendOf(TckRunMetadata run) {
+        return new ConformanceReport.Backend(run.backendDescription().orElse(null), run.controlApi());
+    }
+
+    /**
+     * Reads the Messages release out of the stream's own {@code meta} message.
+     *
+     * <p>Taken from the stream rather than from a constant or the {@code io.cucumber:messages}
+     * artifact version, because the envelope and the stream disagreeing about which release produced
+     * them would be worse than either being absent. {@code meta} is the first envelope cucumber
+     * writes, so only the first line is parsed.
+     *
+     * @param results the buffered results stream
+     * @return the protocol version, or {@code null} when the stream carries none
+     */
+    private static String protocolVersionOf(byte[] results) {
+        String stream = new String(results, StandardCharsets.UTF_8);
+        int newline = stream.indexOf('\n');
+        String first = newline < 0 ? stream : stream.substring(0, newline);
+        if (first.trim().isEmpty()) {
+            return null;
+        }
+        try {
+            JsonNode version = new ObjectMapper().readTree(first).path("meta").path("protocolVersion");
+            return version.isTextual() ? version.asText() : null;
+        } catch (JsonProcessingException e) {
+            // A stream whose first line will not parse is a bug worth surfacing, but not here:
+            // omitting an optional field is better than failing a run that otherwise succeeded.
+            log.warn("tck: could not read the Messages protocol version from the stream", e);
+            return null;
+        }
+    }
+
+    @SuppressFBWarnings(
+            value = "PATH_TRAVERSAL_IN",
+            justification = "The directory is supplied by whoever started the test run, which is the "
+                    + "whole point of the setting; the file names within it are sanitised by ReportNames")
+    private void write(String dir, byte[] results) {
+        Optional<TckRunMetadata> observed = metadata.get();
+        if (!observed.isPresent()) {
+            // Nothing observed the suite, which means it never got as far as starting the runtime.
+            // The run has failed for some other reason by now; adding a report with an invented
+            // provider name on top of that would only mislead.
+            log.error(
+                    "{} is set but no TCK suite ran, so there is nothing to report on. "
+                            + "This normally means the suite failed before its backend stack started.",
+                    REPORT_DIR_ENV);
+            return;
+        }
+
+        TckRunMetadata run = observed.get();
+        String configuration = run.configuration();
+        Path directory;
+        try {
+            directory = Paths.get(dir);
+        } catch (InvalidPathException e) {
+            throw new IllegalStateException(
+                    "tck [" + configuration + "]: " + REPORT_DIR_ENV + " is not a usable path: " + dir, e);
+        }
+
+        String base = ReportNames.baseNameOf(configuration);
+        String location = base + RESULTS_EXTENSION;
+        Path resultsPath = directory.resolve(location);
+        Path envelopePath = directory.resolve(base + ENVELOPE_EXTENSION);
+
+        String json;
+        try {
+            json = new ObjectMapper()
+                            .writerWithDefaultPrettyPrinter()
+                            .writeValueAsString(build(run, location, digestOf(results), protocolVersionOf(results)))
+                    + "\n";
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("tck [" + configuration + "]: could not encode the conformance report", e);
+        }
+
+        // A failure to write is raised rather than logged and swallowed. CI that asked for a report
+        // and silently did not get one is how a publishing pipeline serves a stale result forever.
+        // The results go first: an envelope naming a stream that is not there is worse than neither.
+        try {
+            Files.createDirectories(directory);
+            Files.write(resultsPath, results);
+            Files.write(envelopePath, json.getBytes(StandardCharsets.UTF_8));
+        } catch (IOException e) {
+            throw new UncheckedIOException(
+                    "tck [" + configuration + "]: could not write the conformance report to " + directory, e);
+        }
+
+        log.info("tck [{}]: conformance report written to {}, results to {}", configuration, envelopePath, resultsPath);
+    }
+
+    /** Digests the results stream in the {@code sha256:<hex>} form the schema asks for. */
+    private static String digestOf(byte[] results) {
+        MessageDigest sha256;
+        try {
+            sha256 = MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            // SHA-256 is required of every Java platform, so this cannot happen on a working JVM.
+            throw new IllegalStateException("SHA-256 is not available", e);
+        }
+        byte[] digest = sha256.digest(results);
+        StringBuilder hex = new StringBuilder(7 + digest.length * 2);
+        hex.append("sha256:");
+        for (byte b : digest) {
+            hex.append(Character.forDigit((b >> 4) & 0xf, 16)).append(Character.forDigit(b & 0xf, 16));
+        }
+        return hex.toString();
+    }
+}
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTck.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTck.java
index a09508905..b3325c3a3 100644
--- a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTck.java
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTck.java
@@ -82,11 +82,10 @@ public final class ProviderTck {
     /**
      * The Cucumber plugins the suite registers.
      *
-     * <p>Just Cucumber's own summary. The suite runs the scenarios and reports them through JUnit;
-     * turning a run into a machine-readable conformance report is a separate concern that registers
-     * its own plugin here.
+     * <p>Spelled out rather than derived from {@code ConformanceReportPlugin.class.getName()},
+     * which is not a compile-time constant and so cannot appear in an annotation value.
      */
-    public static final String PLUGINS = "summary";
+    public static final String PLUGINS = "summary,dev.openfeature.contrib.tools.tck.ConformanceReportPlugin";
 
     /**
      * Whether scenarios may run in parallel: never.
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTckTest.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTckTest.java
index 7773f7e52..72aac4101 100644
--- a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTckTest.java
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ProviderTckTest.java
@@ -3,6 +3,7 @@
 import io.cucumber.junit.platform.engine.Constants;
 import org.junit.platform.suite.api.ConfigurationParameter;
 import org.junit.platform.suite.api.IncludeEngines;
+import org.junit.platform.suite.api.SelectClasses;
 import org.junit.platform.suite.api.SelectClasspathResource;
 import org.junit.platform.suite.api.Suite;
 
@@ -50,6 +51,13 @@
  * this JAR holding nothing but a README, because {@link SelectClasspathResource} on a resource that
  * exists on no classpath root is a discovery error rather than an empty selection.
  *
+ * <p>One JUnit Jupiter test runs alongside the scenarios: {@link CanonicalScenarioGuard}, which
+ * fails a suite whose canonical set has been reduced — by a tag filter, a selector override, or a
+ * feature file shadowing a canonical one. It is why {@code junit-jupiter} is in the engine list. It
+ * inspects the discovered test plan and the run's filter configuration, both of which are settled
+ * before the first scenario, so it costs nothing and does not depend on the order the engines happen
+ * to run in.
+ *
  * <p>Every value these annotations carry is named in {@link ProviderTck}. An adopter who does write a
  * {@code @ConfigurationParameter} of their own composes from those constants —
  * {@code ProviderTck.ALL_GLUE + ",com.vendor.steps"} — rather than restating this configuration as a
@@ -58,11 +66,14 @@
  * @see ProviderTckHarness
  * @see ContainerizedProviderTckTest
  * @see ProviderTck
+ * @see ConformanceReportPlugin
+ * @see CanonicalScenarioGuard
  */
 @Suite
-@IncludeEngines("cucumber")
+@IncludeEngines({"cucumber", "junit-jupiter"})
 @SelectClasspathResource(ProviderTck.FEATURES)
 @SelectClasspathResource(ProviderTck.EXTENSIONS)
+@SelectClasses(CanonicalScenarioGuard.class)
 @ConfigurationParameter(key = Constants.PLUGIN_PROPERTY_NAME, value = ProviderTck.PLUGINS)
 @ConfigurationParameter(
         key = Constants.PARALLEL_EXECUTION_ENABLED_PROPERTY_NAME,
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ReportNames.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ReportNames.java
index 250d97c4b..a40520c82 100644
--- a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ReportNames.java
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/ReportNames.java
@@ -45,4 +45,46 @@ static String configurationOf(Class<?> suite) {
                 .toLowerCase(Locale.ROOT);
         return hyphenated.isEmpty() ? FALLBACK : hyphenated;
     }
+
+    /**
+     * Turns a configuration name into the base name both of a run's files share.
+     *
+     * <p>A run writes an envelope and a results stream, and they are matched by name — the envelope's
+     * {@code results.location} is this base name plus the stream's extension — so one derivation
+     * produces both.
+     *
+     * <p>Configuration names are chosen to read well in a failure message rather than to be
+     * path-safe, so anything that is not obviously safe becomes a hyphen. Without this a
+     * configuration named {@code flagd/rpc} would silently write outside the directory it was given.
+     *
+     * @param configuration the configuration name
+     * @return a file name stem, with no extension
+     */
+    static String baseNameOf(String configuration) {
+        StringBuilder safe = new StringBuilder(configuration.length());
+        for (int i = 0; i < configuration.length(); i++) {
+            char c = configuration.charAt(i);
+            boolean allowed = (c >= 'a' && c <= 'z')
+                    || (c >= 'A' && c <= 'Z')
+                    || (c >= '0' && c <= '9')
+                    || c == '-'
+                    || c == '_'
+                    || c == '.';
+            safe.append(allowed ? c : '-');
+        }
+        String trimmed = trim(safe.toString());
+        return trimmed.isEmpty() ? FALLBACK : trimmed;
+    }
+
+    private static String trim(String value) {
+        int start = 0;
+        int end = value.length();
+        while (start < end && (value.charAt(start) == '-' || value.charAt(start) == '.')) {
+            start++;
+        }
+        while (end > start && (value.charAt(end - 1) == '-' || value.charAt(end - 1) == '.')) {
+            end--;
+        }
+        return value.substring(start, end);
+    }
 }
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckBuildInfo.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckBuildInfo.java
new file mode 100644
index 000000000..7346db619
--- /dev/null
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckBuildInfo.java
@@ -0,0 +1,124 @@
+package dev.openfeature.contrib.tools.tck;
+
+import dev.openfeature.sdk.OpenFeatureAPI;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * What this TCK build is, and which conformance artifacts it carries.
+ *
+ * <p>A conformance report has to say which questions were asked, not only what the answers were, and
+ * neither fact is available from the running code. The spec revision the packaged Gherkin came from
+ * is a property of the build — the artifacts are in the JAR, the repository they came from is not —
+ * so it is baked into a generated resource at build time and read back here. The SDK version is the
+ * opposite case: the TCK depends on a version <em>range</em>, so what a consumer actually ran
+ * against is only knowable at runtime.
+ *
+ * <p>Everything here degrades to {@code unknown} rather than throwing. A report that is slightly
+ * less identifiable is worth more than a test run that fails while tidying up after itself.
+ */
+final class TckBuildInfo {
+
+    /** Which TCK implementation this is, in the form the report schema asks for. */
+    static final String IMPLEMENTATION = "java-sdk-contrib/tools/tck";
+
+    /** Maven coordinates of the SDK, reported without a version. */
+    static final String SDK_NAME = "dev.openfeature:sdk";
+
+    /** Stands in for anything the build or the classpath could not tell us. */
+    static final String UNKNOWN = "unknown";
+
+    private static final Logger log = LoggerFactory.getLogger(TckBuildInfo.class);
+
+    /** Generated by the build from the module POM; see {@code src/main/resources-filtered}. */
+    private static final String BUILD_PROPERTIES = "tck-build.properties";
+
+    /** Written into every JAR by maven-archiver, and the most direct statement of what resolved. */
+    private static final String SDK_POM_PROPERTIES = "META-INF/maven/dev.openfeature/sdk/pom.properties";
+
+    private static final Properties BUILD = loadBuildProperties();
+
+    private TckBuildInfo() {}
+
+    /** Returns the version of this TCK module. */
+    static String tckVersion() {
+        return property("tck.version");
+    }
+
+    /** Returns the open-feature/spec commit the packaged conformance artifacts came from. */
+    static String specRevision() {
+        return property("spec.revision");
+    }
+
+    /**
+     * Returns the OpenFeature SDK version that was actually on the classpath.
+     *
+     * <p>Read rather than declared. The TCK depends on an SDK version range so that adopting it can
+     * never force an upgrade, which means the version is a property of the consumer's build; a
+     * hardcoded one would be a second place to be wrong.
+     */
+    static String sdkVersion() {
+        Properties pom = load(SDK_POM_PROPERTIES);
+        if (pom != null) {
+            String version = pom.getProperty("version", "").trim();
+            if (!version.isEmpty()) {
+                return version;
+            }
+        }
+
+        // The Maven descriptor can be stripped, or the SDK can arrive from somewhere that is not a
+        // JAR at all — an IDE's output directory, say — so fall back to the manifest.
+        Package sdkPackage = OpenFeatureAPI.class.getPackage();
+        String implementation = sdkPackage == null ? null : sdkPackage.getImplementationVersion();
+        if (implementation != null && !implementation.trim().isEmpty()) {
+            return implementation.trim();
+        }
+
+        log.warn(
+                "Could not determine the OpenFeature SDK version from {} or from the package manifest; "
+                        + "the conformance report will say '{}'",
+                SDK_POM_PROPERTIES,
+                UNKNOWN);
+        return UNKNOWN;
+    }
+
+    private static String property(String key) {
+        String value = BUILD.getProperty(key, "").trim();
+        return value.isEmpty() ? UNKNOWN : value;
+    }
+
+    private static Properties loadBuildProperties() {
+        Properties properties = load(packagePath() + BUILD_PROPERTIES);
+        if (properties == null) {
+            log.warn(
+                    "{} is missing from the TCK JAR, so a conformance report cannot identify the build "
+                            + "that produced it. This means the resource filtering configured in the "
+                            + "tck POM did not run.",
+                    BUILD_PROPERTIES);
+            return new Properties();
+        }
+        return properties;
+    }
+
+    private static String packagePath() {
+        return TckBuildInfo.class.getPackage().getName().replace('.', '/') + "/";
+    }
+
+    private static Properties load(String resource) {
+        ClassLoader loader = TckBuildInfo.class.getClassLoader();
+        try (InputStream in = loader.getResourceAsStream(resource)) {
+            if (in == null) {
+                return null;
+            }
+            Properties properties = new Properties();
+            properties.load(in);
+            return properties;
+        } catch (IOException e) {
+            log.warn("Could not read {} from the classpath", resource, e);
+            return null;
+        }
+    }
+}
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckRunMetadata.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckRunMetadata.java
new file mode 100644
index 000000000..1095f2658
--- /dev/null
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckRunMetadata.java
@@ -0,0 +1,106 @@
+package dev.openfeature.contrib.tools.tck;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+
+/**
+ * What a conformance report needs to know about the run, gathered as the run proceeds.
+ *
+ * <p>It exists because the two facts a report needs most are known at different times and are gone
+ * by the time it is written. The declared capabilities and the backend description come from the
+ * harness when the suite starts; the provider's own metadata name is only observable once a scenario
+ * has built a provider. Meanwhile Cucumber emits {@code TestRunFinished} — where the file is written
+ * — <em>after</em> {@code @AfterAll} has already torn the {@link TckRuntime} down.
+ *
+ * <p>So the runtime fills this in as it goes and keeps it after {@link TckRuntime#stop()}, and the
+ * report plugin reads it at the end.
+ *
+ * <p>It is also the one place every path to a report passes through, which makes it where the
+ * declaration is checked: a {@linkplain Capability#reserved() reserved} capability is rejected here
+ * rather than being carried into a document that would then claim it.
+ */
+final class TckRunMetadata {
+
+    private final String configuration;
+    private final Set<Capability> capabilities;
+    private final String backendDescription;
+    private final ControlApi controlApi;
+    private final List<KnownDeviation> knownDeviations;
+
+    private volatile String providerName;
+
+    TckRunMetadata(
+            String configuration,
+            Set<Capability> capabilities,
+            String backendDescription,
+            ControlApi controlApi,
+            List<KnownDeviation> knownDeviations) {
+        Capability.requireDeclarable(capabilities);
+        this.configuration = configuration;
+        this.capabilities = capabilities.isEmpty()
+                ? Collections.emptySet()
+                : Collections.unmodifiableSet(EnumSet.copyOf(capabilities));
+        this.backendDescription = backendDescription;
+        this.controlApi = controlApi;
+        this.knownDeviations = Collections.unmodifiableList(new ArrayList<>(knownDeviations));
+    }
+
+    /** Returns the suite name, which is the provider configuration under test. */
+    String configuration() {
+        return configuration;
+    }
+
+    /** Returns the capabilities the harness declared. */
+    Set<Capability> capabilities() {
+        return capabilities;
+    }
+
+    /** Returns a short description of the backend stack, or empty when there is none. */
+    Optional<String> backendDescription() {
+        return Optional.ofNullable(backendDescription);
+    }
+
+    /**
+     * Returns how the backend was driven.
+     *
+     * <p>Never absent. {@link BackendControl#controlApi()} is required and closed, so there is
+     * nothing here to be optional about — see {@link ControlApi}.
+     */
+    ControlApi controlApi() {
+        return controlApi;
+    }
+
+    /** Returns the deviations the provider author acknowledged, empty when there are none. */
+    List<KnownDeviation> knownDeviations() {
+        return knownDeviations;
+    }
+
+    /**
+     * Records what the provider called itself, as observed from a scenario that built one.
+     *
+     * @param name the provider's own metadata name
+     */
+    void recordProviderName(String name) {
+        if (name != null && !name.trim().isEmpty()) {
+            providerName = name;
+        }
+    }
+
+    /**
+     * Returns the provider's own metadata name, falling back to the configuration name.
+     *
+     * <p>The fallback covers a run in which no scenario ever built a provider — every scenario
+     * skipped, or the stack never came up. Reporting the suite name there is more useful than the
+     * empty string the schema would reject.
+     *
+     * @return the name to report as the provider's identity
+     */
+    String providerName() {
+        String observed = providerName;
+        return observed == null ? configuration : observed;
+    }
+}
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckRuntime.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckRuntime.java
index 613adf7a8..744141a69 100644
--- a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckRuntime.java
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckRuntime.java
@@ -35,12 +35,41 @@ public final class TckRuntime {
 
     private static TckRuntime instance;
 
+    /**
+     * What the most recent suite was, kept after {@link #stop()} for the conformance report.
+     *
+     * <p>Cucumber emits the end-of-run event that writes the report <em>after</em> {@code @AfterAll}
+     * has stopped the runtime, so the report would otherwise have nothing left to describe.
+     */
+    private static volatile TckRunMetadata lastRunMetadata;
+
     private final ProviderTckHarness harness;
     private final BackendControl backendControl;
+    private final TckRunMetadata metadata;
 
     private TckRuntime(ProviderTckHarness harness, BackendControl backendControl) {
         this.harness = harness;
         this.backendControl = backendControl;
+        this.metadata = new TckRunMetadata(
+                harness.configuration(),
+                harness.capabilities(),
+                backendControl.description(),
+                backendControl.controlApi(),
+                harness.knownDeviations());
+        recordRun(this.metadata);
+    }
+
+    /**
+     * Records what the current run is, for the conformance report to describe afterwards.
+     *
+     * <p>A method rather than a field assignment because it is also the seam the report tests use:
+     * they drive a real Cucumber run to check what the results stream says, and that needs a run to
+     * describe without needing a backend to describe it.
+     *
+     * @param metadata what the run is, or {@code null} to forget the last one
+     */
+    static void recordRun(TckRunMetadata metadata) {
+        lastRunMetadata = metadata;
     }
 
     /**
@@ -121,6 +150,27 @@ public BackendControl backendControl() {
         return backendControl;
     }
 
+    /**
+     * Records what the provider under test calls itself.
+     *
+     * <p>A conformance report identifies the provider by its own metadata name rather than by the
+     * suite's, and only a scenario that has built one can say what that is.
+     *
+     * @param name the provider's metadata name
+     */
+    public void recordProviderName(String name) {
+        metadata.recordProviderName(name);
+    }
+
+    /**
+     * Returns what was observed about the most recent suite, for the conformance report.
+     *
+     * @return the metadata of the last suite to start, or empty if none has
+     */
+    static Optional<TckRunMetadata> lastRunMetadata() {
+        return Optional.ofNullable(lastRunMetadata);
+    }
+
     /**
      * Finds the harness for the suite that is currently executing.
      *
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckSuiteListener.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckSuiteListener.java
index 8116deff0..30809f0fe 100644
--- a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckSuiteListener.java
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/TckSuiteListener.java
@@ -6,6 +6,7 @@
 import org.junit.platform.engine.support.descriptor.ClassSource;
 import org.junit.platform.launcher.TestExecutionListener;
 import org.junit.platform.launcher.TestIdentifier;
+import org.junit.platform.launcher.TestPlan;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -35,6 +36,21 @@ public class TckSuiteListener implements TestExecutionListener {
 
     private static volatile Class<? extends ProviderTckHarness> current;
 
+    /**
+     * Records what each TCK suite in the plan is about to run, for {@link CanonicalScenarioGuard}.
+     *
+     * <p>Read from the plan before any of it executes, which is as early as the selected scenarios
+     * can be known: selectors and glue are resolved by then, so a canonical file that was shadowed,
+     * replaced or added to is already visible. The guard needs nothing from the run itself and no
+     * backend.
+     *
+     * @param testPlan the plan about to be executed
+     */
+    @Override
+    public void testPlanExecutionStarted(TestPlan testPlan) {
+        CanonicalScenarioGuard.observe(testPlan);
+    }
+
     @Override
     public void executionStarted(TestIdentifier testIdentifier) {
         harnessClassOf(testIdentifier).ifPresent(suite -> {
diff --git a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/steps/ProviderSteps.java b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/steps/ProviderSteps.java
index 3456e5b60..ad915c938 100644
--- a/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/steps/ProviderSteps.java
+++ b/tools/tck/src/main/java/dev/openfeature/contrib/tools/tck/steps/ProviderSteps.java
@@ -165,11 +165,13 @@ public void createProvider(String flavour) {
         state.provider = provider;
         state.domain = domain;
         state.client = api.getClient(domain);
-        log.info(
-                "Registered {} provider {} under domain {}",
-                flavour,
-                provider.getMetadata().getName(),
-                domain);
+
+        // A conformance report identifies the provider by what it calls itself, not by the suite
+        // name, and this is the only place that knows it.
+        String providerName = provider.getMetadata().getName();
+        TckRuntime.get().recordProviderName(providerName);
+
+        log.info("Registered {} provider {} under domain {}", flavour, providerName, domain);
     }
 
     /**
diff --git a/tools/tck/src/main/resources-filtered/dev/openfeature/contrib/tools/tck/tck-build.properties b/tools/tck/src/main/resources-filtered/dev/openfeature/contrib/tools/tck/tck-build.properties
new file mode 100644
index 000000000..eabdcecc1
--- /dev/null
+++ b/tools/tck/src/main/resources-filtered/dev/openfeature/contrib/tools/tck/tck-build.properties
@@ -0,0 +1,7 @@
+# Generated at build time by Maven resource filtering. Do not edit the copy in target/.
+#
+# Identifies the TCK build and the conformance artifacts it carries, for the
+# tck section of a conformance report. The values come from the tck
+# POM; see the comment there for how the spec revision is maintained.
+tck.version=${project.version}
+spec.revision=${tck.spec.revision}
diff --git a/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/CanonicalScenarioGuardTest.java b/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/CanonicalScenarioGuardTest.java
new file mode 100644
index 000000000..d95bb943b
--- /dev/null
+++ b/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/CanonicalScenarioGuardTest.java
@@ -0,0 +1,241 @@
+package dev.openfeature.contrib.tools.tck;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import io.cucumber.junit.platform.engine.Constants;
+import java.util.Collections;
+import java.util.Iterator;
+import java.util.LinkedHashSet;
+import java.util.Map;
+import java.util.Set;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.platform.engine.discovery.DiscoverySelectors;
+import org.junit.platform.launcher.EngineFilter;
+import org.junit.platform.launcher.core.LauncherDiscoveryRequestBuilder;
+import org.junit.platform.launcher.core.LauncherFactory;
+import org.junit.platform.launcher.listeners.SummaryGeneratingListener;
+import org.junit.platform.launcher.listeners.TestExecutionSummary;
+
+/**
+ * A run that quietly asks fewer questions must not be able to report success.
+ *
+ * <p>Two levels here, deliberately. The comparison itself is checked directly, because a failure
+ * message is the whole product of a guard and it has to name the scenario that went missing. The
+ * wiring is checked by running the guard through the JUnit Platform under a real filter
+ * configuration, because "the guard sees what the Cucumber engine beside it sees" is a claim about
+ * the platform rather than about this code.
+ *
+ * <p>No scenario is executed anywhere in this file. The guard works from the discovered plan and the
+ * run's configuration, which is what lets it be checked — and, in a real build, fail — without a
+ * backend.
+ */
+class CanonicalScenarioGuardTest {
+
+    private static final Map<String, String> UNFILTERED = Collections.emptyMap();
+
+    @BeforeEach
+    void forgetPreviousPlans() {
+        CanonicalScenarioGuard.forget();
+    }
+
+    @Test
+    @DisplayName("the canonical set is read from this artifact, outline row by outline row")
+    void theCanonicalSetIsReadFromTheArtifact() {
+        Set<CanonicalScenarios.Ref> canonical = CanonicalScenarios.shipped();
+
+        assertThat(canonical).isNotEmpty();
+        assertThat(canonical)
+                .as("every canonical scenario comes from a packaged feature file")
+                .allSatisfy(ref -> assertThat(ref.toString()).startsWith(ProviderTck.FEATURES + "/"));
+
+        // The eight rows of the type-mismatch matrix share one name, so a set that counted scenarios
+        // by name would see one of them. Each Examples row is its own line and its own entry.
+        // Eleven until specification revision d47a66eb moved the three "requested as a String" rows
+        // onto @string-typing, where a backend that stores every value as a string can withhold them.
+        assertThat(canonical)
+                .filteredOn(ref -> ref.toString().contains("Requesting the wrong type returns the code default"))
+                .hasSize(8);
+    }
+
+    @Test
+    @DisplayName("a suite that selects the whole canonical set, unfiltered, passes")
+    void anIntactSuitePasses() {
+        CanonicalScenarioGuard.observe(discoverFixtureSuite());
+
+        assertThat(CanonicalScenarioGuard.check(
+                        CanonicalScenarios.shipped(), CanonicalScenarioGuard.discovered(), UNFILTERED))
+                .isNull();
+    }
+
+    @Test
+    @DisplayName("extension scenarios neither count towards the canonical set nor disturb it")
+    void extensionScenariosAreIgnored() {
+        CanonicalScenarioGuard.observe(discoverFixtureSuite());
+
+        Set<CanonicalScenarios.Ref> observed =
+                CanonicalScenarioGuard.discovered().get(TckSuiteFixture.class.getName());
+
+        // The fixture suite does select an extension feature — ExtensionPointTest checks that it does
+        // — and none of it reaches the guard.
+        assertThat(observed)
+                .as("the guard is defined over %s/ alone", ProviderTck.FEATURES)
+                .isEqualTo(CanonicalScenarios.shipped())
+                .allSatisfy(ref -> assertThat(ref.toString()).doesNotContain(ProviderTck.EXTENSIONS + "/"));
+    }
+
+    @Test
+    @DisplayName("a scenario filter fails the run, whatever it would have excluded")
+    void aScenarioFilterFails() {
+        CanonicalScenarioGuard.observe(discoverFixtureSuite());
+
+        String problems = CanonicalScenarioGuard.check(
+                CanonicalScenarios.shipped(),
+                CanonicalScenarioGuard.discovered(),
+                Collections.singletonMap(Constants.FILTER_TAGS_PROPERTY_NAME, "not @events"));
+
+        // Cucumber applies a tag filter by skipping scenarios during execution, so the plan still
+        // contains them and only the configured expression shows what will be left out. The guard
+        // therefore rejects the filter itself rather than trying to predict what it matches.
+        assertThat(problems)
+                .isNotNull()
+                .contains(Constants.FILTER_TAGS_PROPERTY_NAME)
+                .contains("not @events")
+                .as("and it points at the mechanism that legitimately narrows a run")
+                .contains("capabilities()");
+    }
+
+    @Test
+    @DisplayName("the guard reads the filter the Cucumber engine beside it would read")
+    void theGuardReadsTheRunsFilterConfiguration() {
+        CanonicalScenarioGuard.observe(discoverFixtureSuite());
+
+        TestExecutionSummary filtered = runGuard(Constants.FILTER_TAGS_PROPERTY_NAME, "@events");
+
+        assertThat(filtered.getTestsFailedCount())
+                .as("a filtered run fails at the guard, before a Compose stack is worth starting")
+                .isEqualTo(1);
+        assertThat(filtered.getFailures().get(0).getException())
+                .hasMessageContaining(Constants.FILTER_TAGS_PROPERTY_NAME);
+    }
+
+    @Test
+    @DisplayName("an unfiltered run of an intact suite passes the guard as executed")
+    void anIntactRunPassesTheGuard() {
+        CanonicalScenarioGuard.observe(discoverFixtureSuite());
+
+        assertThat(runGuard(null, null).getTestsSucceededCount()).isEqualTo(1);
+    }
+
+    @Test
+    @DisplayName("a run that declares itself partial is skipped rather than passed")
+    void aPartialRunIsSkipped() {
+        CanonicalScenarioGuard.observe(discoverFixtureSuite());
+
+        String previous = System.getProperty(CanonicalScenarioGuard.PARTIAL_PROPERTY);
+        System.setProperty(CanonicalScenarioGuard.PARTIAL_PROPERTY, "true");
+        try {
+            TestExecutionSummary summary = runGuard(Constants.FILTER_TAGS_PROPERTY_NAME, "@events");
+
+            // Aborted rather than skipped: the test ran and declined to conclude, which is what an
+            // assumption produces and what Surefire and the JUnit reports show as skipped.
+            assertThat(summary.getTestsAbortedCount())
+                    .as("a skip says the canonical set was not verified; a pass would claim it was")
+                    .isEqualTo(1);
+            assertThat(summary.getTestsSucceededCount()).isZero();
+            assertThat(summary.getTestsFailedCount()).isZero();
+        } finally {
+            restore(CanonicalScenarioGuard.PARTIAL_PROPERTY, previous);
+        }
+    }
+
+    @Test
+    @DisplayName("a feature file added to the canonical directory fails the run")
+    void anAddedCanonicalFeatureFails() {
+        Set<CanonicalScenarios.Ref> withExtra = new LinkedHashSet<>(CanonicalScenarios.shipped());
+        withExtra.add(new CanonicalScenarios.Ref(ProviderTck.FEATURES + "/vendor.feature", 7, "A vendor scenario"));
+
+        String problems = CanonicalScenarioGuard.check(
+                CanonicalScenarios.shipped(),
+                Collections.singletonMap(TckSuiteFixture.class.getName(), withExtra),
+                UNFILTERED);
+
+        assertThat(problems)
+                .isNotNull()
+                .contains(ProviderTck.FEATURES + "/vendor.feature")
+                .as("and it says where the scenario should have gone")
+                .contains(ProviderTck.EXTENSIONS + "/");
+    }
+
+    @Test
+    @DisplayName("a canonical file replaced by another of the same name fails the run")
+    void aShadowedCanonicalFileFails() {
+        // What the separate extension directory exists to prevent, expressed as what the guard sees
+        // if it happens anyway: the replacement compiles to different scenarios, so entries of the
+        // canonical set go missing.
+        Set<CanonicalScenarios.Ref> shadowed = new LinkedHashSet<>(CanonicalScenarios.shipped());
+        Iterator<CanonicalScenarios.Ref> entries = shadowed.iterator();
+        CanonicalScenarios.Ref removed = entries.next();
+        entries.remove();
+
+        String problems = CanonicalScenarioGuard.check(
+                CanonicalScenarios.shipped(),
+                Collections.singletonMap(TckSuiteFixture.class.getName(), shadowed),
+                UNFILTERED);
+
+        assertThat(problems).isNotNull().contains(removed.toString()).contains("shadowing");
+    }
+
+    @Test
+    @DisplayName("a plan with no TCK suite in it is a failure, not a pass")
+    void anUnobservedRunFails() {
+        Map<String, Set<CanonicalScenarios.Ref>> nothing = Collections.emptyMap();
+
+        assertThat(CanonicalScenarioGuard.check(CanonicalScenarios.shipped(), nothing, UNFILTERED))
+                .as("an unverifiable conformance run is not a conformance run")
+                .isNotNull()
+                .contains("TckSuiteListener")
+                .contains(CanonicalScenarioGuard.PARTIAL_PROPERTY);
+    }
+
+    @Test
+    @DisplayName("the partial-run escape hatch carries no PROVIDER_ prefix either")
+    void thePartialKnobIsSpelledWithoutThePrefix() {
+        // Literals on purpose: every TCK knob an adopter or a CI job sets is spelled TCK_*, and one
+        // of them keeping the old PROVIDER_TCK_* prefix is the half-rename that makes the set
+        // unguessable.
+        assertThat(CanonicalScenarioGuard.PARTIAL_ENV).isEqualTo("TCK_PARTIAL");
+        assertThat(CanonicalScenarioGuard.PARTIAL_PROPERTY).isEqualTo("tck.partial");
+    }
+
+    /** Discovers the real suite configuration, without executing anything. */
+    private static org.junit.platform.launcher.TestPlan discoverFixtureSuite() {
+        return LauncherFactory.create()
+                .discover(LauncherDiscoveryRequestBuilder.request()
+                        .selectors(DiscoverySelectors.selectClass(TckSuiteFixture.class))
+                        .build());
+    }
+
+    /** Runs the guard itself through the JUnit Platform, optionally under a Cucumber filter. */
+    private static TestExecutionSummary runGuard(String key, String value) {
+        LauncherDiscoveryRequestBuilder request = LauncherDiscoveryRequestBuilder.request()
+                .selectors(DiscoverySelectors.selectClass(CanonicalScenarioGuard.class))
+                .filters(EngineFilter.includeEngines("junit-jupiter"));
+        if (key != null) {
+            request.configurationParameter(key, value);
+        }
+
+        SummaryGeneratingListener summary = new SummaryGeneratingListener();
+        LauncherFactory.create().execute(request.build(), summary);
+        return summary.getSummary();
+    }
+
+    private static void restore(String key, String previous) {
+        if (previous == null) {
+            System.clearProperty(key);
+        } else {
+            System.setProperty(key, previous);
+        }
+    }
+}
diff --git a/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/ConformanceReportPluginTest.java b/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/ConformanceReportPluginTest.java
new file mode 100644
index 000000000..dbf970cf6
--- /dev/null
+++ b/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/ConformanceReportPluginTest.java
@@ -0,0 +1,730 @@
+package dev.openfeature.contrib.tools.tck;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import dev.openfeature.contrib.tools.tck.selftest.ReportSelfTestSteps;
+import io.cucumber.junit.platform.engine.Constants;
+import io.cucumber.plugin.event.EventHandler;
+import io.cucumber.plugin.event.EventPublisher;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.TreeMap;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.platform.engine.discovery.DiscoverySelectors;
+import org.junit.platform.launcher.EngineFilter;
+import org.junit.platform.launcher.core.LauncherDiscoveryRequestBuilder;
+import org.junit.platform.launcher.core.LauncherFactory;
+
+/**
+ * The conformance report exists to make one rule checkable, so these tests check it.
+ *
+ * <p>Appendix F requires that a scenario skipped for an undeclared capability is reported as skipped
+ * with the reason and never as passed. The Go TCK shipped an emitter that broke the rule silently —
+ * its runner did not deliver the capability-skip signal to the after-hook, so every skipped scenario
+ * was recorded twice, once correctly and once as passed.
+ *
+ * <p>Since the results are now a Cucumber Messages stream rather than a format this project defines,
+ * the rule is a property of what Cucumber emits, and only a real Cucumber run can demonstrate it.
+ * These tests therefore execute a fixture suite through the JUnit Platform — same engine, same gate,
+ * same plugin — and read the stream back as a consumer would: outcome per scenario derived from the
+ * most severe step result, exactly as the {@code cucumber-query} helpers do it.
+ *
+ * <p>What is <em>not</em> asserted here is the serialisation of the stream. That is Cucumber's own
+ * {@code MessageFormatter}, and re-checking it would only be checking Cucumber.
+ */
+class ConformanceReportPluginTest {
+
+    /**
+     * The fixture's {@code @stale} tag is deliberately absent, so two scenarios must be skipped — and
+     * a third that no declaration could have covered, because {@code @large-integers} is
+     * {@linkplain Capability#inexpressible() inexpressible} in Java.
+     */
+    private static final Set<Capability> DECLARED = EnumSet.of(Capability.OBJECT, Capability.EVENTS);
+
+    private static final String CONFIGURATION = "my-provider-rpc";
+
+    private static final String FEATURE_URI = "classpath:report-selftest/report.feature";
+
+    private static final String OUTLINE = "Requesting the wrong type returns the code default";
+
+    /**
+     * Severity order of {@code TestStepResultStatus}, least to most severe.
+     *
+     * <p>A {@code testCaseFinished} message carries no status: a scenario's outcome is the most
+     * severe result among its steps, hooks included. That is not incidental — it is the mechanism
+     * that makes a gated skip truthful, because the aborted {@code @Before} hook contributes a
+     * {@code SKIPPED} result that outranks every {@code PASSED} step it prevented from running.
+     */
+    private static final List<String> SEVERITY =
+            Arrays.asList("UNKNOWN", "PASSED", "SKIPPED", "PENDING", "UNDEFINED", "AMBIGUOUS", "FAILED");
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    @TempDir
+    static Path reportDir;
+
+    private static JsonNode envelope;
+    private static byte[] resultsBytes;
+    private static Results results;
+
+    @BeforeAll
+    static void runTheFixtureSuite() throws IOException {
+        runSuite(reportDir, DECLARED);
+
+        Path envelopePath = reportDir.resolve(CONFIGURATION + ".json");
+        Path resultsPath = reportDir.resolve(CONFIGURATION + ".ndjson");
+        assertThat(envelopePath).exists();
+        assertThat(resultsPath).exists();
+
+        envelope = MAPPER.readTree(Files.readAllBytes(envelopePath));
+        resultsBytes = Files.readAllBytes(resultsPath);
+        results = Results.parse(new String(resultsBytes, StandardCharsets.UTF_8));
+    }
+
+    @Test
+    @DisplayName("every scenario appears exactly once, whatever happened to it")
+    void everyScenarioAppearsExactlyOnce() {
+        // Eight pickles: five plain scenarios and three outline rows. A report that quietly omitted
+        // the ones it did not run would satisfy every other rule here and still mislead, because a
+        // reader would have no way to know how many questions went unasked.
+        assertThat(results.pickles).hasSize(8);
+
+        assertThat(results.pickleOfTestCase.values())
+                .as("one test case per pickle, and no pickle executed twice")
+                .containsExactlyInAnyOrderElementsOf(results.pickles.keySet());
+
+        assertThat(results.testCaseOfStarted.values())
+                .as("one execution per test case; a scenario counted twice is how Go's report went wrong")
+                .containsExactlyInAnyOrderElementsOf(results.pickleOfTestCase.keySet());
+
+        assertThat(results.finished)
+                .as("every started scenario also finished")
+                .containsExactlyInAnyOrderElementsOf(results.testCaseOfStarted.keySet());
+    }
+
+    @Test
+    @DisplayName("the outcome counts are what the fixture describes")
+    void theOutcomeCountsAreWhatTheFixtureDescribes() {
+        assertThat(results.outcomeCounts())
+                .containsExactlyInAnyOrderEntriesOf(counts("PASSED", 4L, "FAILED", 1L, "SKIPPED", 3L));
+    }
+
+    @Test
+    @DisplayName("a scenario gated on an undeclared capability is skipped, never passed")
+    void aGatedScenarioIsSkipped() {
+        List<String> gated = new ArrayList<>();
+        for (Map.Entry<String, JsonNode> pickle : results.pickles.entrySet()) {
+            if (needsSomethingUndeclared(results.tagsOf(pickle.getValue()))) {
+                gated.add(pickle.getKey());
+            }
+        }
+
+        assertThat(gated)
+                .as("the premise: the fixture has a gated plain scenario, a gated outline row and an "
+                        + "inexpressible one, which no declaration could have contained")
+                .hasSize(3);
+
+        for (String pickleId : gated) {
+            assertThat(results.outcomeOfPickle(pickleId))
+                    .as("pickle %s carries an undeclared capability tag", pickleId)
+                    .isEqualTo("SKIPPED");
+        }
+
+        assertThat(results.outcomeCounts().get("SKIPPED"))
+                .as("nothing else was skipped, so a skip cannot hide an unrelated one")
+                .isEqualTo((long) gated.size());
+    }
+
+    @Test
+    @DisplayName("the gate's own reason survives into the stream, and the two kinds of skip stay apart")
+    void theGateReasonSurvives() {
+        // The declaration in the envelope is enough to work out *why* most scenarios were skipped,
+        // but the reason the gate gave is carried too, on the hook result that produced the skip.
+        List<String> messages = results.messagesOfSkippedSteps();
+        assertThat(messages).hasSize(3);
+
+        // And for one of them the declaration is NOT enough, which is why this reason has to travel.
+        // @large-integers is absent from every Java declaration and absent for a reason that says
+        // nothing about the provider: the SDK's integer accessor is 32 bits. A reader who inferred
+        // "the provider declined" from the absence would be reading a decision into something no
+        // Java provider was ever offered. So the message names the SDK, and says it is not the
+        // provider declining, in words that could not be confused with the other two.
+        List<String> unaskable = new ArrayList<>();
+        messages.forEach(message -> {
+            if (message.contains("LARGE_INTEGERS")) {
+                unaskable.add(message);
+            }
+        });
+        assertThat(unaskable).hasSize(1);
+        assertThat(unaskable.get(0))
+                .contains("the Java SDK cannot express capability")
+                .contains("not the provider under test declining")
+                .doesNotContain("does not declare capability");
+
+        assertThat(messages)
+                .filteredOn(message -> !message.contains("LARGE_INTEGERS"))
+                .hasSize(2)
+                .allSatisfy(message -> assertThat(message)
+                        .contains("does not declare capability")
+                        .contains("STALE"));
+    }
+
+    @Test
+    @DisplayName("a scenario's tags include one set on its Examples block alone")
+    void tagsIncludeExamplesBlockTags() {
+        List<JsonNode> rows = results.picklesNamed(OUTLINE);
+
+        assertThat(rows).hasSize(3);
+        assertThat(rows).as("the feature tag reaches every row").allSatisfy(row -> assertThat(results.tagsOf(row))
+                .contains("@events"));
+
+        // Gherkin allows a tag on an individual Examples block, so two rows of one outline can
+        // differ in whether the gate stops them. Both rows must appear, and only the tagged one
+        // may be skipped: a skip that took its siblings with it would be invisible in the totals.
+        List<String> outcomes = new ArrayList<>();
+        List<Boolean> stale = new ArrayList<>();
+        for (JsonNode row : rows) {
+            outcomes.add(results.outcomeOfPickle(row.get("id").asText()));
+            stale.add(results.tagsOf(row).contains("@stale"));
+        }
+        assertThat(stale).containsExactly(false, false, true);
+        assertThat(outcomes).containsExactly("PASSED", "PASSED", "SKIPPED");
+    }
+
+    @Test
+    @DisplayName("each Scenario Outline row is identified by the Examples row it came from")
+    void outlineRowsAreDistinguishable() {
+        List<JsonNode> rows = results.picklesNamed(OUTLINE);
+
+        assertThat(rows)
+                .as("all three rows share one name, which is the premise of this test")
+                .extracting(row -> row.get("name").asText())
+                .containsOnly(OUTLINE);
+
+        // A pickle's astNodeIds are [scenario, table row] for an outline-derived scenario. The
+        // second is the row's identity, and it resolves in the gherkinDocument to the cells the row
+        // was compiled from. This is the mechanism the TCK used to reverse-engineer from a pickle's
+        // reported line number; the stream states it outright.
+        List<String> rowIds = new ArrayList<>();
+        List<List<String>> cells = new ArrayList<>();
+        for (JsonNode row : rows) {
+            JsonNode astNodeIds = row.get("astNodeIds");
+            assertThat(astNodeIds).hasSize(2);
+            String rowId = astNodeIds.get(1).asText();
+            rowIds.add(rowId);
+            cells.add(results.cellsOfTableRow(rowId));
+        }
+
+        assertThat(rowIds).doesNotHaveDuplicates();
+        assertThat(cells)
+                .containsExactly(
+                        Arrays.asList("string-flag", "Boolean"),
+                        Arrays.asList("string-flag", "Integer"),
+                        Arrays.asList("boolean-flag", "String"));
+    }
+
+    @Test
+    @DisplayName("the stream carries the source of the feature that executed")
+    void theStreamCarriesTheExecutedSource() throws IOException {
+        assertThat(results.sources).containsOnlyKeys(FEATURE_URI);
+
+        // Line endings are normalised on both sides: this repo is checked out with whatever the
+        // platform does, and the point of the assertion is that the text is the file's, not that
+        // Cucumber preserves CRLF.
+        byte[] onDisk = Files.readAllBytes(Paths.get("src/test/resources/report-selftest/report.feature"));
+        assertThat(results.sources.get(FEATURE_URI).replace("\r\n", "\n"))
+                .as("what ran, verbatim, rather than a claim about which revision it came from")
+                .isEqualTo(new String(onDisk, StandardCharsets.UTF_8).replace("\r\n", "\n"));
+    }
+
+    @Test
+    @DisplayName("the envelope points at the results and covers them with a digest")
+    void theEnvelopePointsAtTheResults() throws NoSuchAlgorithmException {
+        JsonNode reference = envelope.get("results");
+
+        assertThat(reference.get("format").asText()).isEqualTo("cucumber-messages");
+        assertThat(reference.get("location").asText())
+                .as("a path relative to the envelope, so a published pair can be moved together")
+                .isEqualTo(CONFIGURATION + ".ndjson");
+        assertThat(reference.get("digest").asText()).isEqualTo(sha256Of(resultsBytes));
+    }
+
+    @Test
+    @DisplayName("the envelope carries everything the schema requires and nothing it forbids")
+    void theEnvelopeCarriesWhatTheSchemaRequires() {
+        assertThat(envelope.get("schemaVersion").asText()).isEqualTo("1");
+        assertThat(envelope.get("provider").get("name").asText()).isEqualTo("My Provider");
+        assertThat(envelope.get("provider").get("language").asText()).isEqualTo("java");
+        assertThat(envelope.get("provider").get("configuration").asText()).isEqualTo(CONFIGURATION);
+        assertThat(envelope.get("sdk").get("name").asText()).isEqualTo("dev.openfeature:sdk");
+        assertThat(envelope.get("sdk").get("version").asText()).isNotEmpty();
+        assertThat(envelope.get("tck").get("implementation").asText()).isEqualTo("java-sdk-contrib/tools/tck");
+        assertThat(envelope.get("tck").get("specRevision").asText()).hasSizeGreaterThanOrEqualTo(7);
+        assertThat(envelope.get("tck").get("specRevision").asText())
+                .as("and it is the revision the packaged assets actually came from; see the test below")
+                .isEqualTo(CanonicalAssetDigestTest.PINNED_REVISION);
+        // backend is in the schema's top-level required array and controlApi in backend's, so both
+        // are asserted as present rather than as present-if-set.
+        assertThat(envelope.has("backend")).isTrue();
+        assertThat(envelope.get("backend").get("controlApi").asText()).isEqualTo("http");
+
+        // The schema sets additionalProperties: false throughout, so anything the results payload
+        // now owns is a validation failure rather than harmless duplication.
+        List<String> fields = new ArrayList<>();
+        envelope.fieldNames().forEachRemaining(fields::add);
+        assertThat(fields).doesNotContain("scenarios", "capabilities");
+        assertThat(envelope.get("tck").has("assetsTree")).isFalse();
+    }
+
+    @Test
+    @DisplayName("the declaration lists the capabilities the provider claims, in vocabulary order")
+    void theDeclarationListsWhatIsClaimed() {
+        JsonNode declared = envelope.get("declaration").get("declared");
+
+        // The declaration is an input to reading the results, not a summary of them: the stream says
+        // a scenario was skipped, and only this says whether the provider declines what it needed.
+        assertThat(declared)
+                .extracting(JsonNode::asText)
+                .containsExactly(Capability.EVENTS.tag(), Capability.OBJECT.tag());
+    }
+
+    @Test
+    @DisplayName("a reserved capability cannot reach the declaration, even when everything is claimed")
+    void aReservedCapabilityCannotReachTheDeclaration() {
+        // The provider that claims the most is the case that used to break the rule: "everything"
+        // spelt EnumSet.allOf, or "everything except X" spelt EnumSet.complementOf, collected the
+        // reserved tags along the way and published a claim about capabilities no scenario
+        // examines. So this asks the maximal declaration for its report.
+        JsonNode declared = MAPPER.valueToTree(report(Capability.declarable()))
+                .get("declaration")
+                .get("declared");
+
+        List<String> tags = new ArrayList<>();
+        declared.forEach(tag -> tags.add(tag.asText()));
+
+        assertThat(tags)
+                .as("a reserved tag gates nothing, so declaring it is a claim nothing can contradict")
+                .doesNotContain(Capability.CACHING.tag());
+        assertThat(tags)
+                .as("and every capability some scenario does gate is still there")
+                .containsExactly(
+                        Capability.LIFECYCLE.tag(),
+                        Capability.REINITIALIZATION.tag(),
+                        Capability.EVENTS.tag(),
+                        Capability.STALE.tag(),
+                        Capability.CONFIGURATION_CHANGE.tag(),
+                        Capability.OBJECT.tag(),
+                        // @variants gates the one outline that asserts a variant. 2.2.4 is a SHOULD
+                        // and types.md types the field optional, so a backend with no variant
+                        // concept withholds it and those rows are skipped with that reason.
+                        Capability.VARIANTS.tag(),
+                        // @disabled-flags gates the four-row outline that asks what a flag disabled
+                        // in the management system resolves to. Gated because the answer follows
+                        // from where the substitution happens rather than from provider quality: a
+                        // provider that evaluates locally can return the caller's default, one whose
+                        // backend decides never sent it. The maximal claim includes it.
+                        Capability.DISABLED_FLAGS.tag(),
+                        Capability.UNAVAILABLE_INIT.tag(),
+                        Capability.NUMERIC_COERCION.tag(),
+                        // @string-typing gates the two outline rows that ask a boolean and an
+                        // integer flag through the String accessor. Gated because every value has a
+                        // string representation, so a backend that stores flag values as strings has
+                        // no mismatch to report and withholds it without being non-conformant.
+                        Capability.STRING_TYPING.tag(),
+                        // @fully-typed-values asks the same of a float and a structure, and is a
+                        // separate claim because a store can record booleans and integers natively
+                        // while keeping those two as text. Both scenarios carry @string-typing as
+                        // well, so the maximal claim has to include both tags to reach them.
+                        Capability.FULLY_TYPED_VALUES.tag(),
+                        // @large-integers is absent, and for a different reason from @caching's.
+                        // Scenarios do carry it -- Go and JavaScript run them -- but the Java SDK's
+                        // integer accessor is 32 bits, so no Java provider can be asked for 2^53 - 1
+                        // and none may claim it. The maximal claim is the maximal claim a provider
+                        // written against THIS SDK can make, which is what a report has to carry.
+                        // @targeting was reserved until targeting-key-flag's three scenarios
+                        // arrived. It gates something now, so the maximal claim includes it.
+                        Capability.TARGETING.tag(),
+                        // @standard-reasons gates reason.feature in its entirety. It is a claim
+                        // rather than an exemption -- 2.2.5 lets a provider report "some other
+                        // string", so a provider that does not declare it is not thereby deficient
+                        // -- but it is an ordinary declarable capability all the same, and the
+                        // maximal claim includes it.
+                        Capability.STANDARD_REASONS.tag());
+    }
+
+    @Test
+    @DisplayName("the revision a report publishes is the one the packaged assets came from")
+    void theReportedRevisionIsTheRevisionTheAssetsCameFrom() {
+        // A report's whole claim to be readable later is that it says which questions were asked.
+        // The revision it names is a POM property, maintained by hand beside a submodule gitlink
+        // that moves by a different command -- so until now "keep them in step" was a comment in
+        // the POM, and a re-pin that updated one and not the other would have published a revision
+        // that did not produce the scenarios in the same file.
+        //
+        // CanonicalAssetDigestTest has already established that the packaged assets are
+        // PINNED_REVISION's, by digest. This is the last link: what the build filtered into the JAR
+        // and TckBuildInfo reads back is that same revision.
+        assertThat(TckBuildInfo.specRevision())
+                .as("tck.spec.revision in tools/tck/pom.xml must equal "
+                        + "CanonicalAssetDigestTest.PINNED_REVISION -- a re-pin moves the submodule "
+                        + "gitlink, that constant and this property together")
+                .isEqualTo(CanonicalAssetDigestTest.PINNED_REVISION);
+        assertThat(TckBuildInfo.specRevision())
+                .as("and the properties resource must actually have been filtered, or both are 'unknown'")
+                .isNotEqualTo(TckBuildInfo.UNKNOWN);
+    }
+
+    @Test
+    @DisplayName("naming a reserved capability fails the run rather than being dropped quietly")
+    void namingAReservedCapabilityFailsTheRun() {
+        // Chosen over a warning: the declaration is the one part of the report no result can check,
+        // and a report is read long after the log it would have been warned in has gone. Nothing is
+        // lost by refusing, because no scenario carries the tag.
+        Set<Capability> overclaimed = EnumSet.of(Capability.OBJECT, Capability.CACHING);
+
+        assertThatThrownBy(() -> metadata(overclaimed))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining(Capability.CACHING.tag())
+                .hasMessageContaining("declarableExcept");
+    }
+
+    @Test
+    @DisplayName("\"everything except X\" means everything declarable except X")
+    void declarableExceptYieldsOnlyDeclarableCapabilities() {
+        assertThat(Capability.declarableExcept(Capability.STALE))
+                .doesNotContain(Capability.STALE, Capability.CACHING)
+                .contains(Capability.OBJECT, Capability.NUMERIC_COERCION, Capability.TARGETING);
+
+        // The counterpart it replaces, and why it had to be replaced.
+        assertThat(EnumSet.complementOf(EnumSet.of(Capability.STALE)))
+                .as("complementOf is the complement of the enum, not of the declarable vocabulary")
+                .contains(Capability.CACHING);
+    }
+
+    @Test
+    @DisplayName("a withheld capability that is a defect is reported as a deviation")
+    void aDefectIsReportedAsADeviation() {
+        JsonNode deviations = envelope.get("knownDeviations");
+
+        assertThat(deviations).hasSize(1);
+        assertThat(deviations.get(0).get("capability").asText()).isEqualTo(Capability.CONFIGURATION_CHANGE.tag());
+        assertThat(deviations.get(0).get("summary").asText()).isNotEmpty();
+        assertThat(deviations.get(0).has("issue"))
+                .as("the fixture's deviation is untracked, and the field is omitted rather than empty")
+                .isFalse();
+    }
+
+    @Test
+    @DisplayName("the SDK version is read from the classpath rather than declared")
+    void theSdkVersionIsRead() {
+        assertThat(TckBuildInfo.sdkVersion())
+                .as("the OpenFeature SDK is on the test classpath, so its version must be discoverable")
+                .isNotEqualTo(TckBuildInfo.UNKNOWN)
+                .matches("\\d+\\.\\d+.*");
+    }
+
+    @Test
+    @DisplayName("nothing is collected or written when no report directory is configured")
+    void nothingIsWrittenByDefault(@TempDir Path dir) throws IOException {
+        CountingEventPublisher publisher = new CountingEventPublisher();
+        new ConformanceReportPlugin(() -> null, () -> Optional.of(metadata(DECLARED))).setEventPublisher(publisher);
+
+        assertThat(publisher.registered)
+                .as("not even the message formatter is wired up, so an unasked-for run buffers nothing")
+                .isZero();
+        try (Stream<Path> written = Files.list(dir)) {
+            assertThat(written).isEmpty();
+        }
+    }
+
+    @Test
+    @DisplayName("the report-directory knob is spelled the way the other three languages spell it")
+    void theReportDirectoryKnobIsSpelledPortably() {
+        // Asserted as literals rather than through the constants, because the point is the name a
+        // cross-language CI job sets, not that the code is self-consistent. Go, Python and
+        // JavaScript read TCK_REPORT_DIR; one job exporting one variable has to drive all four, so
+        // a rename here is a breaking change to something no compiler checks.
+        assertThat(ConformanceReportPlugin.REPORT_DIR_ENV).isEqualTo("TCK_REPORT_DIR");
+        assertThat(ConformanceReportPlugin.REPORT_DIR_PROPERTY).isEqualTo("tck.report.dir");
+    }
+
+    @Test
+    @DisplayName("both files are named after the configuration, safely")
+    void theFilesAreNamedAfterTheConfiguration() {
+        assertThat(ReportNames.configurationOf(MyProviderRpcTckTest.class)).isEqualTo(CONFIGURATION);
+        assertThat(ReportNames.baseNameOf("flagd-rpc")).isEqualTo("flagd-rpc");
+        assertThat(ReportNames.baseNameOf("flagd/rpc"))
+                .as("a configuration name is chosen to read well, not to be path-safe")
+                .isEqualTo("flagd-rpc");
+        assertThat(ReportNames.baseNameOf("../escape")).isEqualTo("escape");
+    }
+
+    /** A suite whose name the default configuration derivation has to cope with. */
+    private static final class MyProviderRpcTckTest {}
+
+    /**
+     * Runs the fixture feature through the real Cucumber engine, with the real plugin registered.
+     *
+     * <p>Driven through the JUnit Platform rather than through Cucumber's CLI because that is how the
+     * TCK itself runs: {@link ProviderTckTest} is a JUnit Platform Suite, and the plugin's
+     * position in the event stream is a property of that engine.
+     */
+    private static void runSuite(Path dir, Set<Capability> declared) {
+        ReportSelfTestSteps.declare(declared);
+        TckRuntime.recordRun(metadata(declared));
+        String previous = System.getProperty(ConformanceReportPlugin.REPORT_DIR_PROPERTY);
+        System.setProperty(ConformanceReportPlugin.REPORT_DIR_PROPERTY, dir.toString());
+        try {
+            LauncherFactory.create()
+                    .execute(LauncherDiscoveryRequestBuilder.request()
+                            .selectors(DiscoverySelectors.selectClasspathResource("report-selftest"))
+                            .filters(EngineFilter.includeEngines("cucumber"))
+                            .configurationParameter(
+                                    Constants.GLUE_PROPERTY_NAME,
+                                    ReportSelfTestSteps.class.getPackage().getName())
+                            .configurationParameter(
+                                    Constants.PLUGIN_PROPERTY_NAME, ConformanceReportPlugin.class.getName())
+                            .configurationParameter(Constants.PARALLEL_EXECUTION_ENABLED_PROPERTY_NAME, "false")
+                            .configurationParameter(
+                                    Constants.OBJECT_FACTORY_PROPERTY_NAME, "io.cucumber.picocontainer.PicoFactory")
+                            .build());
+        } finally {
+            if (previous == null) {
+                System.clearProperty(ConformanceReportPlugin.REPORT_DIR_PROPERTY);
+            } else {
+                System.setProperty(ConformanceReportPlugin.REPORT_DIR_PROPERTY, previous);
+            }
+            TckRuntime.recordRun(null);
+        }
+    }
+
+    /** Builds the envelope a run with this declaration would emit, without running one. */
+    private static ConformanceReport report(Set<Capability> declared) {
+        return new ConformanceReportPlugin(() -> null, Optional::empty)
+                .build(metadata(declared), CONFIGURATION + ".ndjson", "sha256:0", "26.1.0");
+    }
+
+    private static TckRunMetadata metadata(Set<Capability> declared) {
+        TckRunMetadata metadata = new TckRunMetadata(
+                CONFIGURATION,
+                declared,
+                "a test double",
+                ControlApi.HTTP,
+                // Withheld-and-skipped, which is the shape a fixture may legitimately depict: this
+                // provider cannot attempt the behaviour, because it never subscribes to the thing
+                // that would tell it. A narrowing-coercion deviation used to stand here, and that
+                // is the shape the guidance discourages -- a provider that attempts a behaviour and
+                // gets it wrong declares the capability and lets the scenario fail.
+                Collections.singletonList(KnownDeviation.untracked(
+                        Capability.CONFIGURATION_CHANGE,
+                        "the fixture provider swallows its child's change events and can never " + "report one")));
+        metadata.recordProviderName("My Provider");
+        return metadata;
+    }
+
+    private static boolean needsSomethingUndeclared(List<String> tags) {
+        for (String tag : tags) {
+            Optional<Capability> capability = Capability.fromTag(tag);
+            if (capability.isPresent() && !DECLARED.contains(capability.get())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static Map<String, Long> counts(Object... statusesAndCounts) {
+        Map<String, Long> expected = new LinkedHashMap<>();
+        for (int i = 0; i < statusesAndCounts.length; i += 2) {
+            expected.put((String) statusesAndCounts[i], (Long) statusesAndCounts[i + 1]);
+        }
+        return expected;
+    }
+
+    private static String sha256Of(byte[] bytes) throws NoSuchAlgorithmException {
+        byte[] digest = MessageDigest.getInstance("SHA-256").digest(bytes);
+        StringBuilder hex = new StringBuilder("sha256:");
+        for (byte b : digest) {
+            hex.append(String.format("%02x", b));
+        }
+        return hex.toString();
+    }
+
+    /** Counts what a plugin registers, for the case where it should register nothing. */
+    private static final class CountingEventPublisher implements EventPublisher {
+
+        private int registered;
+
+        @Override
+        public <T> void registerHandlerFor(Class<T> eventType, EventHandler<T> handler) {
+            registered++;
+        }
+
+        @Override
+        public <T> void removeHandlerFor(Class<T> eventType, EventHandler<T> handler) {
+            registered--;
+        }
+    }
+
+    /**
+     * A Cucumber Messages stream, read the way a consumer reads one.
+     *
+     * <p>Deliberately built from the raw ndjson with nothing but Jackson. Using Cucumber's own query
+     * helpers would make these tests agree with Cucumber by construction; the point is to show that
+     * the facts the report needs are recoverable from the bytes on disk.
+     */
+    private static final class Results {
+
+        private final Map<String, JsonNode> pickles = new LinkedHashMap<>();
+        private final Map<String, String> pickleOfTestCase = new LinkedHashMap<>();
+        private final Map<String, String> testCaseOfStarted = new LinkedHashMap<>();
+        private final Map<String, String> mostSevereByStarted = new LinkedHashMap<>();
+        private final Map<String, JsonNode> tableRows = new LinkedHashMap<>();
+        private final Map<String, String> sources = new TreeMap<>();
+        private final List<String> finished = new ArrayList<>();
+        private final List<String> skippedStepMessages = new ArrayList<>();
+
+        static Results parse(String ndjson) throws IOException {
+            Results results = new Results();
+            for (String line : ndjson.split("\n")) {
+                if (line.trim().isEmpty()) {
+                    continue;
+                }
+                results.accept(MAPPER.readTree(line));
+            }
+            return results;
+        }
+
+        private void accept(JsonNode message) {
+            if (message.has("source")) {
+                JsonNode source = message.get("source");
+                sources.put(source.get("uri").asText(), source.get("data").asText());
+            }
+            if (message.has("gherkinDocument")) {
+                collectTableRows(message.get("gherkinDocument"));
+            }
+            if (message.has("pickle")) {
+                JsonNode pickle = message.get("pickle");
+                pickles.put(pickle.get("id").asText(), pickle);
+            }
+            if (message.has("testCase")) {
+                JsonNode testCase = message.get("testCase");
+                pickleOfTestCase.put(
+                        testCase.get("id").asText(), testCase.get("pickleId").asText());
+            }
+            if (message.has("testCaseStarted")) {
+                JsonNode started = message.get("testCaseStarted");
+                testCaseOfStarted.put(
+                        started.get("id").asText(), started.get("testCaseId").asText());
+            }
+            if (message.has("testCaseFinished")) {
+                finished.add(
+                        message.get("testCaseFinished").get("testCaseStartedId").asText());
+            }
+            if (message.has("testStepFinished")) {
+                JsonNode step = message.get("testStepFinished");
+                String startedId = step.get("testCaseStartedId").asText();
+                JsonNode result = step.get("testStepResult");
+                String status = result.get("status").asText();
+                mostSevereByStarted.merge(startedId, status, Results::moreSevere);
+                if ("SKIPPED".equals(status) && result.has("message")) {
+                    skippedStepMessages.add(result.get("message").asText());
+                }
+            }
+        }
+
+        private void collectTableRows(JsonNode document) {
+            for (JsonNode child : orEmpty(document.get("feature"), "children")) {
+                JsonNode scenario = child.get("scenario");
+                if (scenario == null) {
+                    continue;
+                }
+                for (JsonNode examples : orEmpty(scenario, "examples")) {
+                    for (JsonNode row : orEmpty(examples, "tableBody")) {
+                        tableRows.put(row.get("id").asText(), row);
+                    }
+                }
+            }
+        }
+
+        private static Iterable<JsonNode> orEmpty(JsonNode parent, String field) {
+            JsonNode node = parent == null ? null : parent.get(field);
+            return node == null ? Collections.emptyList() : node;
+        }
+
+        private static String moreSevere(String left, String right) {
+            return SEVERITY.indexOf(left) >= SEVERITY.indexOf(right) ? left : right;
+        }
+
+        Map<String, Long> outcomeCounts() {
+            Map<String, Long> counts = new LinkedHashMap<>();
+            for (String status : mostSevereByStarted.values()) {
+                counts.merge(status, 1L, Long::sum);
+            }
+            return counts;
+        }
+
+        String outcomeOfPickle(String pickleId) {
+            for (Map.Entry<String, String> started : testCaseOfStarted.entrySet()) {
+                if (pickleId.equals(pickleOfTestCase.get(started.getValue()))) {
+                    return mostSevereByStarted.get(started.getKey());
+                }
+            }
+            throw new AssertionError("pickle " + pickleId + " was never executed");
+        }
+
+        List<String> tagsOf(JsonNode pickle) {
+            List<String> tags = new ArrayList<>();
+            for (JsonNode tag : orEmpty(pickle, "tags")) {
+                tags.add(tag.get("name").asText());
+            }
+            return tags;
+        }
+
+        List<JsonNode> picklesNamed(String name) {
+            List<JsonNode> matching = new ArrayList<>();
+            for (JsonNode pickle : pickles.values()) {
+                if (name.equals(pickle.get("name").asText())) {
+                    matching.add(pickle);
+                }
+            }
+            return matching;
+        }
+
+        List<String> cellsOfTableRow(String rowId) {
+            JsonNode row = tableRows.get(rowId);
+            assertThat(row)
+                    .as("ast node %s is a table row in the gherkin document", rowId)
+                    .isNotNull();
+            List<String> values = new ArrayList<>();
+            for (JsonNode cell : orEmpty(row, "cells")) {
+                values.add(cell.get("value").asText());
+            }
+            return values;
+        }
+
+        List<String> messagesOfSkippedSteps() {
+            return skippedStepMessages;
+        }
+    }
+}
diff --git a/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/selftest/ReportSelfTestSteps.java b/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/selftest/ReportSelfTestSteps.java
new file mode 100644
index 000000000..67fe60086
--- /dev/null
+++ b/tools/tck/src/test/java/dev/openfeature/contrib/tools/tck/selftest/ReportSelfTestSteps.java
@@ -0,0 +1,75 @@
+package dev.openfeature.contrib.tools.tck.selftest;
+
+import dev.openfeature.contrib.tools.tck.Capability;
+import dev.openfeature.contrib.tools.tck.CapabilityGate;
+import io.cucumber.java.Before;
+import io.cucumber.java.Scenario;
+import io.cucumber.java.en.Given;
+import java.util.EnumSet;
+import java.util.Set;
+
+/**
+ * Glue for {@code report-selftest/report.feature}, the fixture the conformance report tests run.
+ *
+ * <p>It stands in for a provider, and for nothing else: there is no Compose stack, no control API
+ * and no provider here, because none of that is what the report tests are about. What it does share
+ * with the real suite is the part that matters — the capability gate is
+ * {@link CapabilityGate#requireDeclared}, the same call the real
+ * {@code ProviderSteps.gateOnCapabilities} makes from the same kind of {@code @Before(order = 0)}
+ * hook. A fixture that aborted by some other route would prove only that some abort becomes a skip.
+ */
+public class ReportSelfTestSteps {
+
+    private static volatile Set<Capability> declared = Capability.declarable();
+
+    /**
+     * Sets the capabilities the fixture provider declares, for the run that is about to start.
+     *
+     * @param capabilities the declared capabilities
+     */
+    public static void declare(Set<Capability> capabilities) {
+        declared = EnumSet.copyOf(capabilities);
+    }
+
+    /**
+     * Gates the scenario on the declared capabilities, exactly as the real suite does.
+     *
+     * @param scenario the scenario about to run
+     */
+    @Before(order = 0)
+    public void gateOnCapabilities(Scenario scenario) {
+        CapabilityGate.requireDeclared(scenario.getSourceTagNames(), declared);
+    }
+
+    /** A step that does nothing, successfully. */
+    @Given("a step that passes")
+    public void aStepThatPasses() {
+        // A passing scenario needs a step that passes and nothing more.
+    }
+
+    /**
+     * A step that does nothing, unsuccessfully.
+     *
+     * <p>An {@link AssertionError} rather than a checked failure, because that is what a failing
+     * assertion in a step definition throws, and the point is what the results stream makes of it.
+     */
+    @Given("a step that fails")
+    public void aStepThatFails() {
+        throw new AssertionError("this fixture scenario is expected to fail");
+    }
+
+    /**
+     * A passing step that takes its arguments from an Examples row.
+     *
+     * <p>The parameters are unused. They exist so the outline's rows differ in their compiled step
+     * text as well as in their table row, which is how a consumer that reads only the steps can
+     * still tell the rows apart.
+     *
+     * @param key the flag key from the row
+     * @param requested the requested type from the row
+     */
+    @Given("a step that passes with {string} as {string}")
+    public void aStepThatPassesWith(String key, String requested) {
+        // Interpolated into the pickle's step text by Cucumber; nothing to do here.
+    }
+}
diff --git a/tools/tck/src/test/resources/report-selftest/report.feature b/tools/tck/src/test/resources/report-selftest/report.feature
new file mode 100644
index 000000000..99d5caaa0
--- /dev/null
+++ b/tools/tck/src/test/resources/report-selftest/report.feature
@@ -0,0 +1,46 @@
+# Fixture for ConformanceReportPluginTest, and not part of the conformance suite: it lives under a
+# separate classpath root so that nothing selecting "gherkin" can pick it up.
+#
+# It is shaped like the real suite rather than minimal, because the properties the report has to
+# preserve are properties of that shape: a capability tag on the feature, one on a scenario, one on
+# a single Examples block, and an outline whose rows all share a name. Running real Cucumber over
+# this is the only way to check what a capability-gated abort actually becomes in the results.
+#
+# It also carries both kinds of skip, because they are the two a reader has to be able to tell
+# apart: a capability this provider did not declare, and a capability no provider in this language
+# can be asked. Both end as SKIPPED, and only the reason carried on the hook result distinguishes
+# them.
+
+@events
+Feature: Report self-test
+
+  Scenario: A mandatory scenario
+    Given a step that passes
+
+  @object
+  Scenario: A scenario needing a declared capability
+    Given a step that passes
+
+  @stale
+  Scenario: A scenario needing an undeclared capability
+    Given a step that passes
+
+  @large-integers
+  Scenario: A scenario needing a capability this SDK cannot express
+    Given a step that passes
+
+  Scenario: A scenario that fails
+    Given a step that fails
+
+  Scenario Outline: Requesting the wrong type returns the code default
+    Given a step that passes with "<key>" as "<requested>"
+
+    Examples: a string flag requested as something else
+      | key         | requested |
+      | string-flag | Boolean   |
+      | string-flag | Integer   |
+
+    @stale
+    Examples: gated by a tag on this block alone
+      | key          | requested |
+      | boolean-flag | String    |