diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index ed36c1553..9ece3d3f2 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -111,6 +111,7 @@ jobs:
           - budget-allocator-server
           - cohort-heatmap-server
           - customer-segmentation-server
+          - conformance-server
           - debug-server
           - lazy-auth-server
           - map-server
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 478c5b807..bdf2a1919 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -33,6 +33,7 @@ jobs:
             ./examples/budget-allocator-server \
             ./examples/cohort-heatmap-server \
             ./examples/customer-segmentation-server \
+            ./examples/conformance-server \
             ./examples/debug-server \
             ./examples/lazy-auth-server \
             ./examples/map-server \
diff --git a/build.bun.ts b/build.bun.ts
index a129d5ddd..c68e4719b 100644
--- a/build.bun.ts
+++ b/build.bun.ts
@@ -61,4 +61,15 @@ await Promise.all([
     outdir: "dist/src/server",
     external: PEER_EXTERNALS,
   }),
+  // Conformance: an isomorphic protocol (browser-safe, imported by the app View)
+  // and the Node runner (Playwright kept external — an optional peer dep).
+  buildJs("src/conformance/protocol.ts", {
+    outdir: "dist/src/conformance",
+    external: PEER_EXTERNALS,
+  }),
+  buildJs("src/conformance/index.ts", {
+    outdir: "dist/src/conformance",
+    target: "node",
+    external: ["playwright", ...PEER_EXTERNALS],
+  }),
 ]);
diff --git a/examples/conformance-server/.gitignore b/examples/conformance-server/.gitignore
new file mode 100644
index 000000000..b94707787
--- /dev/null
+++ b/examples/conformance-server/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+dist/
diff --git a/examples/conformance-server/README.md b/examples/conformance-server/README.md
new file mode 100644
index 000000000..e8fa8cbde
--- /dev/null
+++ b/examples/conformance-server/README.md
@@ -0,0 +1,90 @@
+# Conformance server
+
+![MCP Apps Conformance screenshot](screenshot.png)
+
+A **host-conformance test harness** for the MCP Apps spec ([SEP-1865 · `2026-01-26`](https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/2026-01-26/apps.mdx), extension id `io.modelcontextprotocol/ui`), modeled on [web-platform-tests](https://web-platform-tests.org).
+
+It has two parts:
+
+- **The conformance app** (this server) — a single `ui://` **TestSuite** that renders inside the host's sandboxed iframe, drives the `postMessage`/JSON-RPC bridge, and asserts the host's behaviour against the spec.
+- **A reusable runner** — importable from the SDK at [`@modelcontextprotocol/ext-apps/conformance`](../../src/conformance): a `Host` interface, an abstract Playwright `BrowserHost`, and a `Runner` that drives the app against a real host and returns structured `SubtestResult[]`. Use it (dev-only) to conformance-test your own host in CI.
+
+> The host is the browser. The `ui://` page is the WPT test. The bridge is the harness.
+
+## Architecture: Host / Runner / TestSuite
+
+- **TestSuite** (this app, in the iframe) — owns the tests and the MCP-app communication. A test emits a typed `CapabilityRequest` and awaits the result.
+- **Runner** (external, platform-agnostic) — lists the tests, pumps each request to the Host, feeds the result back. No per-test logic.
+- **Host** (platform-specific) — opens the app, prompts the agent so the TestSuite renders, and answers capability requests. `BrowserHost` (Playwright) is provided; `VSCodeHost`/`Goose`-style hosts are drop-in peers.
+
+The TestSuite installs one control seam at `window.__mcpConformance` (`listTests`/`start`/`poll`/`resolve`); the Runner reaches it (a browser host does so via `frame.evaluate`). The TestSuite **pulls** (a test awaits a request) and the Runner **polls** — the iframe never has to push out (nested cross-origin `postMessage` is unreliable). A test's **vantage** says where a requirement is observable: `in-view` (asserted from inside the iframe), `host` (only from the host surface — DOM, conversation, console — which the Runner inspects), or `server`.
+
+## Run it against a host — by hand
+
+Connect a host to this server's `/mcp` endpoint, prompt the host to call the `run_conformance` tool, and click **Run**. From the monorepo root:
+
+```bash
+npm install
+EXAMPLE=conformance-server npm run examples:start   # serves http://localhost:31xx/mcp (port printed)
+```
+
+Automatic `in-view` checks run on click. A `· manual` check parks an **action card**: the trigger button fires the gesture-gated call (open a link, send a message…), and **It worked / It didn't / Skip** records the verdict — so the suite is usable with no driver at all.
+
+## Automate it — the importable runner
+
+Add `playwright` to your devDependencies (it's an **optional peer** of the SDK), subclass `BrowserHost` for your host, and run:
+
+```ts
+import type { Page } from "playwright";
+import {
+  BrowserHost,
+  Runner,
+  type SubtestResult,
+} from "@modelcontextprotocol/ext-apps/conformance";
+
+// Fill in the three hooks for YOUR host's UI; launch, the bridge, real
+// cross-origin clicks, dialog handling, and per-test isolation are all shared.
+class MyHost extends BrowserHost {
+  readonly name = "my-host";
+  readonly url = "https://my-host.example/"; // a host that already has the conformance app connected
+  readonly widgetSelector = 'iframe[src*="conformance"]';
+
+  protected async sendPrompt(page: Page, appName: string) {
+    await page.fill("#composer", `run ${appName}`);
+    await page.keyboard.press("Enter");
+  }
+  protected async dismissModal(_page: Page) {} // dismiss cookie/onboarding modals if any
+  protected async verifyConversation(page: Page, marker: string) {
+    return (await page.textContent("body"))?.includes(marker) ?? false;
+  }
+}
+
+const results: SubtestResult[] = await new Runner(new MyHost(), {
+  appName: "Conformance",
+  profileDir: ".profile", // a persistent profile so a login is reused across runs
+}).run();
+```
+
+The conformance app must **already be connected** to the host you point at — self-host this example (or any deployment of it) and connect it in the host you're testing. Every `Host` capability method is optional: an absent one is reported `unsupported`, and the affected test skips or falls back (e.g. `readModelToolList` → conversation scan).
+
+## Starter suite
+
+A small, high-signal set spanning every mechanism — extend it with the reserved requirements as you implement them:
+
+| Test                                 | Clause   | Vantage | What it proves                                                                        |
+| ------------------------------------ | -------- | ------- | ------------------------------------------------------------------------------------- |
+| `lifecycle/tool-input`               | MUST     | in-view | host delivers the tool arguments to the view                                          |
+| `security/csp-no-loosening`          | MUST NOT | in-view | an undeclared origin stays blocked under a declared CSP                               |
+| `security/sandbox-proxy-required`    | MUST     | in-view | the view is wrapped in an intermediate sandbox proxy (`window.parent !== window.top`) |
+| `security/iframe-sandboxed`          | MUST     | host    | the Runner reads the host's `<iframe sandbox>` attribute                              |
+| `visibility/app-tool-hidden`         | MUST NOT | host    | an app-only tool (`conformance_probe`) stays hidden from the model                    |
+| `messages/add-to-conversation`       | SHOULD   | host    | a `ui/message` reaches the conversation                                               |
+| `links/open-external`                | SHOULD   | host    | `ui/open-link` opens the requested URL (the Runner verifies the tab)                  |
+| `model-context/provide-future-turns` | SHOULD   | host    | `ui/update-model-context` reaches the model next turn                                 |
+
+## Layout
+
+- `server.ts` — the MCP server: one `ui://` TestSuite resource + fixture tools (`run_conformance` launcher, app-only `conformance_probe`, model-only `model_only_probe`).
+- `main.ts` — Streamable HTTP / stdio entry point.
+- `mcp-app.html` + `src/` — the React TestSuite: `mcp-app.tsx` (UI) + `harness/` (`assert` · `host-gateway` · `registry` engine · `channel`) + `tests.ts` (the suite) + `catalogue.json` (per-test spec links).
+- The runner that drives this app lives in the SDK: [`src/conformance`](../../src/conformance).
diff --git a/examples/conformance-server/catalogue.json b/examples/conformance-server/catalogue.json
new file mode 100644
index 000000000..3943a03ca
--- /dev/null
+++ b/examples/conformance-server/catalogue.json
@@ -0,0 +1,76 @@
+[
+  {
+    "id": "lifecycle/tool-input",
+    "clause": "MUST",
+    "vantage": "in-view",
+    "spec": "2026-01-26",
+    "line": 1106,
+    "implemented": true,
+    "bucket": "automatic"
+  },
+  {
+    "id": "security/csp-no-loosening",
+    "clause": "MUST NOT",
+    "vantage": "in-view",
+    "spec": "2026-01-26",
+    "line": 286,
+    "implemented": true,
+    "bucket": "automatic"
+  },
+  {
+    "id": "security/sandbox-proxy-required",
+    "clause": "MUST",
+    "vantage": "in-view",
+    "spec": "2026-01-26",
+    "line": 472,
+    "implemented": true,
+    "bucket": "automatic"
+  },
+  {
+    "id": "security/iframe-sandboxed",
+    "clause": "MUST",
+    "vantage": "host",
+    "spec": "2026-01-26",
+    "line": 1698,
+    "implemented": true,
+    "bucket": "operator-verify"
+  },
+  {
+    "id": "visibility/app-tool-hidden",
+    "clause": "MUST NOT",
+    "vantage": "host",
+    "spec": "2026-01-26",
+    "line": 400,
+    "implemented": true,
+    "bucket": "operator-verify",
+    "askAgent": true
+  },
+  {
+    "id": "messages/add-to-conversation",
+    "clause": "SHOULD",
+    "vantage": "host",
+    "spec": "2026-01-26",
+    "line": 1033,
+    "implemented": true,
+    "bucket": "operator-verify"
+  },
+  {
+    "id": "links/open-external",
+    "clause": "SHOULD",
+    "vantage": "host",
+    "spec": "2026-01-26",
+    "line": 996,
+    "implemented": true,
+    "bucket": "operator-verify"
+  },
+  {
+    "id": "model-context/provide-future-turns",
+    "clause": "SHOULD",
+    "vantage": "host",
+    "spec": "2026-01-26",
+    "line": 1097,
+    "implemented": true,
+    "bucket": "operator-verify",
+    "askAgent": true
+  }
+]
diff --git a/examples/conformance-server/grid-cell.png b/examples/conformance-server/grid-cell.png
new file mode 100644
index 000000000..14d894b2c
Binary files /dev/null and b/examples/conformance-server/grid-cell.png differ
diff --git a/examples/conformance-server/main.ts b/examples/conformance-server/main.ts
new file mode 100644
index 000000000..ec187b68a
--- /dev/null
+++ b/examples/conformance-server/main.ts
@@ -0,0 +1,93 @@
+/**
+ * Entry point for running the MCP server.
+ * Run with: npx @modelcontextprotocol/server-basic-react
+ * Or: node dist/index.js [--stdio]
+ */
+
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import cors from "cors";
+import type { Request, Response } from "express";
+import { createServer } from "./server.js";
+
+/**
+ * Starts an MCP server with Streamable HTTP transport in stateless mode.
+ *
+ * @param createServer - Factory function that creates a new McpServer instance per request.
+ */
+export async function startStreamableHTTPServer(
+  createServer: () => McpServer,
+): Promise<void> {
+  const port = parseInt(process.env.PORT ?? "3001", 10);
+
+  const app = createMcpExpressApp({ host: "0.0.0.0" });
+  app.use(cors());
+
+  app.all("/mcp", async (req: Request, res: Response) => {
+    const server = createServer();
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: undefined,
+    });
+
+    res.on("close", () => {
+      transport.close().catch(() => {});
+      server.close().catch(() => {});
+    });
+
+    try {
+      await server.connect(transport);
+      await transport.handleRequest(req, res, req.body);
+    } catch (error) {
+      console.error("MCP error:", error);
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: "2.0",
+          error: { code: -32603, message: "Internal server error" },
+          id: null,
+        });
+      }
+    }
+  });
+
+  const httpServer = app.listen(port, (err) => {
+    if (err) {
+      console.error("Failed to start server:", err);
+      process.exit(1);
+    }
+    console.log(`MCP server listening on http://localhost:${port}/mcp`);
+  });
+
+  const shutdown = () => {
+    console.log("\nShutting down...");
+    httpServer.close(() => process.exit(0));
+  };
+
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}
+
+/**
+ * Starts an MCP server with stdio transport.
+ *
+ * @param createServer - Factory function that creates a new McpServer instance.
+ */
+export async function startStdioServer(
+  createServer: () => McpServer,
+): Promise<void> {
+  await createServer().connect(new StdioServerTransport());
+}
+
+async function main() {
+  if (process.argv.includes("--stdio")) {
+    await startStdioServer(createServer);
+  } else {
+    await startStreamableHTTPServer(createServer);
+  }
+}
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});
diff --git a/examples/conformance-server/mcp-app.html b/examples/conformance-server/mcp-app.html
new file mode 100644
index 000000000..6a73265ef
--- /dev/null
+++ b/examples/conformance-server/mcp-app.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta name="color-scheme" content="light dark">
+  <title>MCP Apps Conformance Runner</title>
+</head>
+<body>
+  <div id="root"></div>
+  <script type="module" src="/src/mcp-app.tsx"></script>
+</body>
+</html>
diff --git a/examples/conformance-server/package.json b/examples/conformance-server/package.json
new file mode 100644
index 000000000..64a7eb582
--- /dev/null
+++ b/examples/conformance-server/package.json
@@ -0,0 +1,56 @@
+{
+  "name": "@modelcontextprotocol/server-conformance",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "Host-conformance test server for the MCP Apps spec: ships a ui:// runner that asserts host behaviour and reports PASS/FAIL inside the iframe",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/modelcontextprotocol/ext-apps",
+    "directory": "examples/conformance-server"
+  },
+  "license": "MIT",
+  "main": "dist/server.js",
+  "types": "dist/server.d.ts",
+  "bin": {
+    "mcp-server-conformance": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc --noEmit && cross-env INPUT=mcp-app.html vite build && tsc -p tsconfig.server.json && bun build server.ts --outdir dist --target node && bun build main.ts --outfile dist/index.js --target node --external \"./server.js\" --banner \"#!/usr/bin/env node\"",
+    "watch": "cross-env INPUT=mcp-app.html vite build --watch",
+    "serve": "bun --watch main.ts",
+    "start": "cross-env NODE_ENV=development npm run build && npm run serve",
+    "dev": "cross-env NODE_ENV=development concurrently \"npm run watch\" \"npm run serve\"",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/ext-apps": "^1.7.4",
+    "@modelcontextprotocol/sdk": "^1.24.0",
+    "cors": "^2.8.5",
+    "express": "^5.1.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "zod": "^4.1.13"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.0",
+    "@types/node": "22.10.0",
+    "@types/react": "^19.2.2",
+    "@types/react-dom": "^19.2.2",
+    "@vitejs/plugin-react": "^4.3.4",
+    "concurrently": "^9.2.1",
+    "cross-env": "^10.1.0",
+    "typescript": "^5.9.3",
+    "vite": "^6.0.0",
+    "vite-plugin-singlefile": "^2.3.0"
+  }
+}
diff --git a/examples/conformance-server/screenshot.png b/examples/conformance-server/screenshot.png
new file mode 100644
index 000000000..550bbed26
Binary files /dev/null and b/examples/conformance-server/screenshot.png differ
diff --git a/examples/conformance-server/server.ts b/examples/conformance-server/server.ts
new file mode 100644
index 000000000..45ffdc72d
--- /dev/null
+++ b/examples/conformance-server/server.ts
@@ -0,0 +1,112 @@
+/**
+ * The reference conformance test server.
+ *
+ * Exposes one ui:// test page (the conformance runner) plus the fixture tools
+ * the in-iframe harness needs: a model-visible launcher, an app-only echo probe
+ * (for the tool-proxying test), and a model-only tool (for the visibility test).
+ * Point any MCP Apps host at this server's /mcp endpoint and run the suite.
+ *
+ * POC scope: the runner only, results are shown in the iframe, not persisted.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import {
+  RESOURCE_MIME_TYPE,
+  registerAppResource,
+  registerAppTool,
+} from "@modelcontextprotocol/ext-apps/server";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
+
+const RUNNER_URI = "ui://conformance/runner";
+// Works both from source (server.ts) and compiled (dist/server.js)
+const DIST_DIR = import.meta.filename.endsWith(".ts")
+  ? path.join(import.meta.dirname, "dist")
+  : import.meta.dirname;
+const VIEW_HTML = path.join(DIST_DIR, "mcp-app.html");
+
+// The runner declares a CSP so the suite can test both directions: this origin
+// is ALLOWED (connectDomains), and any other origin must stay blocked.
+const CSP_ALLOWED_ORIGIN = "https://modelcontextprotocol.io";
+
+function loadRunnerHtml(): string {
+  if (existsSync(VIEW_HTML)) return readFileSync(VIEW_HTML, "utf-8");
+  return `<!DOCTYPE html><html><body style="font-family:sans-serif;padding:24px">
+    <h2>Runner not built</h2><p>Run <code>npm run build</code> first.</p></body></html>`;
+}
+
+export function createServer(): McpServer {
+  const server = new McpServer({
+    name: "MCP Apps Conformance Server",
+    version: "0.1.0",
+  });
+
+  const cspMeta = { ui: { csp: { connectDomains: [CSP_ALLOWED_ORIGIN] } } };
+  registerAppResource(
+    server,
+    "Conformance Runner",
+    RUNNER_URI,
+    {
+      description: "Runs the MCP Apps conformance suite inside the host.",
+      _meta: cspMeta,
+    },
+    () => ({
+      contents: [
+        {
+          uri: RUNNER_URI,
+          mimeType: RESOURCE_MIME_TYPE,
+          text: loadRunnerHtml(),
+          _meta: cspMeta,
+        },
+      ],
+    }),
+  );
+
+  registerAppTool(
+    server,
+    "run_conformance",
+    {
+      description: "Run the MCP Apps conformance test suite against this host.",
+      _meta: { ui: { resourceUri: RUNNER_URI, visibility: ["model", "app"] } },
+    },
+    (): CallToolResult => ({
+      content: [
+        { type: "text", text: "Launching the MCP Apps conformance runner…" },
+      ],
+    }),
+  );
+
+  registerAppTool(
+    server,
+    "conformance_probe",
+    {
+      description:
+        "Echo probe used by the conformance harness to verify tool proxying.",
+      inputSchema: { ping: z.string() },
+      _meta: { ui: { visibility: ["app"] } },
+    },
+    ({ ping }): CallToolResult => ({
+      content: [{ type: "text", text: `echo:${ping}` }],
+    }),
+  );
+
+  // Model-only fixture tool (NOT app-visible). The visibility test calls this
+  // from the view; a conformant host MUST reject that call.
+  registerAppTool(
+    server,
+    "model_only_probe",
+    {
+      description:
+        "Model-only fixture; an app calling this MUST be rejected by the host.",
+      inputSchema: { ping: z.string() },
+      _meta: { ui: { visibility: ["model"] } },
+    },
+    ({ ping }): CallToolResult => ({
+      content: [{ type: "text", text: `model-only:${ping}` }],
+    }),
+  );
+
+  return server;
+}
diff --git a/examples/conformance-server/src/harness/assert.ts b/examples/conformance-server/src/harness/assert.ts
new file mode 100644
index 000000000..d398c7715
--- /dev/null
+++ b/examples/conformance-server/src/harness/assert.ts
@@ -0,0 +1,174 @@
+/**
+ * The assertion side of the conformance harness — everything a test can measure
+ * from INSIDE the iframe without a host round-trip: plain assertions, value
+ * capture, cleanups, and the in-view probes (CSP / fetch / tool-call). The
+ * host-interaction side lives in `host-gateway.ts`; `TestContext` (registry.ts)
+ * intersects the two.
+ */
+import type { App } from "@modelcontextprotocol/ext-apps";
+
+export class AssertionError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "AssertionError";
+  }
+}
+
+/** Thrown by `t.skip(...)` (or an auto-skip on an unsupported capability) → status SKIP. */
+export class SkipError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "SkipError";
+  }
+}
+
+/**
+ * Host→View notifications that fire around connect (before the suite runs), so we
+ * capture them as promises BEFORE `app.connect()` and let tests await them.
+ * A notification that never arrives makes its test TIMEOUT (the correct
+ * conformance signal that the host didn't send it).
+ */
+export interface HostSignals {
+  toolInput: Promise<unknown>;
+  toolResult: Promise<unknown>;
+  /**
+   * `ui/notifications/tool-input-partial` observations. Partials may arrive 0+
+   * times BEFORE `tool-input`; the spec forbids any after it. `sawAfterToolInput`
+   * flips true if the host violates that.
+   */
+  partials: { count: number; last: unknown; sawAfterToolInput: boolean };
+}
+
+export function captureHostSignals(app: App): HostSignals {
+  let resolveInput!: (v: unknown) => void;
+  let resolveResult!: (v: unknown) => void;
+  let toolInputArrived = false;
+  const toolInput = new Promise<unknown>((r) => {
+    resolveInput = r;
+  });
+  const toolResult = new Promise<unknown>((r) => {
+    resolveResult = r;
+  });
+  const partials = {
+    count: 0,
+    last: undefined as unknown,
+    sawAfterToolInput: false,
+  };
+
+  app.ontoolinput = (params) => {
+    toolInputArrived = true;
+    resolveInput(params);
+  };
+  app.ontoolinputpartial = (params) => {
+    partials.count += 1;
+    partials.last = params;
+    if (toolInputArrived) partials.sawAfterToolInput = true; // illegal: partial after tool-input
+  };
+  app.ontoolresult = (result) => resolveResult(result);
+  return { toolInput, toolResult, partials };
+}
+
+export class Assertions {
+  constructor(
+    public readonly app: App,
+    public readonly signals: HostSignals,
+  ) {}
+
+  /**
+   * Cleanups run after the test completes — pass OR fail — in reverse order.
+   * Register one to restore any host state the test mutated (e.g. display mode)
+   * so it can't leak into the next test.
+   */
+  readonly cleanups: Array<() => void | Promise<void>> = [];
+  addCleanup(fn: () => void | Promise<void>): void {
+    this.cleanups.push(fn);
+  }
+
+  /**
+   * Surface an arbitrary value on the result (shows up as `value` in the poll
+   * snapshot / results.json). Use it to record what the host actually passed —
+   * e.g. the hostCapabilities or hostContext object — for auditing.
+   */
+  value?: unknown;
+  setValue(value: unknown): void {
+    this.value = value;
+  }
+
+  /** Abandon the test as inapplicable (e.g. host doesn't advertise a capability). */
+  skip(msg: string): never {
+    throw new SkipError(msg);
+  }
+
+  assert(cond: unknown, msg: string): asserts cond {
+    if (!cond) throw new AssertionError(msg);
+  }
+
+  assertEquals<T>(actual: T, expected: T, msg = "assertEquals"): void {
+    if (actual !== expected) {
+      throw new AssertionError(
+        `${msg}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`,
+      );
+    }
+  }
+
+  /**
+   * Returns true if a network request to `url` is blocked — either by the host's
+   * Content-Security-Policy (`connect-src`) or by the network layer. Used to
+   * prove the host enforces the spec's restrictive CSP default.
+   */
+  async expectFetchBlocked(url: string): Promise<boolean> {
+    try {
+      await fetch(url, { mode: "no-cors", cache: "no-store" });
+      return false; // request was allowed to leave → NOT blocked
+    } catch {
+      return true; // threw → blocked (CSP violation or network error)
+    }
+  }
+
+  /**
+   * Reads the CSP actually applied to this document — JS can't read its own
+   * response headers, so we use a `<meta>` CSP tag if present, otherwise trigger
+   * a `connect-src` violation and read the `securitypolicyviolation` event's
+   * `originalPolicy` (the full policy string). Returns null if neither yields it
+   * (e.g. header-only CSP that never fires a violation).
+   */
+  async readAppliedCsp(
+    violationUrl = "https://blocked.invalid/",
+  ): Promise<string | null> {
+    const meta = document.querySelector(
+      'meta[http-equiv="Content-Security-Policy" i]',
+    ) as HTMLMetaElement | null;
+    if (meta?.content) return meta.content;
+    return new Promise<string | null>((resolve) => {
+      const onViolation = (e: SecurityPolicyViolationEvent) => {
+        clearTimeout(timer);
+        document.removeEventListener("securitypolicyviolation", onViolation);
+        resolve(e.originalPolicy || null);
+      };
+      const timer = setTimeout(() => {
+        document.removeEventListener("securitypolicyviolation", onViolation);
+        resolve(null);
+      }, 1500);
+      document.addEventListener("securitypolicyviolation", onViolation);
+      void fetch(violationUrl, { mode: "no-cors", cache: "no-store" }).catch(
+        () => {},
+      );
+    });
+  }
+
+  /**
+   * Returns true if the host rejects a `tools/call` for `name` (e.g. the
+   * visibility guard rejecting an app's call to a model-only tool).
+   */
+  async expectToolRejected(
+    name: string,
+    args: Record<string, unknown> = {},
+  ): Promise<boolean> {
+    try {
+      await this.app.callServerTool({ name, arguments: args });
+      return false; // call succeeded → NOT rejected
+    } catch {
+      return true; // threw → rejected
+    }
+  }
+}
diff --git a/examples/conformance-server/src/harness/channel.ts b/examples/conformance-server/src/harness/channel.ts
new file mode 100644
index 000000000..6fd801896
--- /dev/null
+++ b/examples/conformance-server/src/harness/channel.ts
@@ -0,0 +1,34 @@
+/**
+ * The single `window.__mcpConformance` object the external Runner reaches via
+ * `frame.evaluate` (a direct property is reliable where postMessage into a
+ * sandboxed, nested, cross-origin iframe is not). The Runner polls `poll()` and
+ * calls `resolve(result)` to answer the current pending capability request.
+ */
+
+import type { App } from "@modelcontextprotocol/ext-apps";
+import {
+  type CapabilityResult,
+  CHANNEL,
+  type TestMeta,
+} from "@modelcontextprotocol/ext-apps/conformance/protocol";
+import { engine, getRegistry, type HostSignals } from "./registry";
+
+export function installChannel(app: App, signals: HostSignals): void {
+  engine.attach(app, signals);
+  window[CHANNEL] = {
+    listTests: (): TestMeta[] =>
+      getRegistry().map((d) => ({
+        id: d.id,
+        name: d.name,
+        vantage: d.vantage,
+        manual: d.manual,
+        clause: d.clause,
+        caveat: d.caveat,
+      })),
+    start: (filter) => {
+      void engine.start(filter);
+    },
+    poll: () => engine.poll(),
+    resolve: (result: CapabilityResult) => engine.resolve(result),
+  };
+}
diff --git a/examples/conformance-server/src/harness/host-gateway.ts b/examples/conformance-server/src/harness/host-gateway.ts
new file mode 100644
index 000000000..fb81fdff4
--- /dev/null
+++ b/examples/conformance-server/src/harness/host-gateway.ts
@@ -0,0 +1,78 @@
+/**
+ * The capability side of the harness. A test emits typed `CapabilityRequest`s
+ * and awaits their `CapabilityResult`s; the suite engine (registry.ts) parks each
+ * request in its single pending slot and an external Runner (or a human clicking
+ * the UI) resolves it. `HostGateway` extends `Assertions`, so `TestContext` is
+ * just their union — the in-view probes plus these host round-trips.
+ */
+
+import type { App } from "@modelcontextprotocol/ext-apps";
+import type {
+  CapabilityRequest,
+  CapabilityResult,
+} from "@modelcontextprotocol/ext-apps/conformance/protocol";
+import { Assertions, type HostSignals, SkipError } from "./assert";
+
+/** The slice of the suite engine the gateway drives. Implemented by SuiteEngine. */
+export interface RequestPump {
+  /** Park `req` in the pending slot and resolve when the Runner/human answers. */
+  request(req: CapabilityRequest): Promise<CapabilityResult>;
+  /** Register (or clear) the action a real click on the trigger button runs. */
+  setTrigger(fn: (() => void | Promise<unknown>) | null): void;
+}
+
+export class HostGateway extends Assertions {
+  constructor(
+    app: App,
+    signals: HostSignals,
+    private readonly pump: RequestPump,
+  ) {
+    super(app, signals);
+  }
+
+  /** Ask the host to perform `req`; auto-skips the test if the host doesn't support it. */
+  async host(req: CapabilityRequest): Promise<CapabilityResult> {
+    const result = await this.pump.request(req);
+    if (result.unsupported) {
+      throw new SkipError(result.error ?? `host does not support ${req.kind}`);
+    }
+    return result;
+  }
+
+  /** Like `host`, but returns the raw result (incl. `unsupported`) for tests that fall back. */
+  hostOptional(req: CapabilityRequest): Promise<CapabilityResult> {
+    return this.pump.request(req);
+  }
+
+  /**
+   * Register the gesture-gated action to run when the trigger button is really
+   * clicked (postMessage carries no user activation, so open-link / download /
+   * message / sampling must fire from a real click). Cleared after the test.
+   */
+  bindTrigger(fn: () => void | Promise<unknown>): void {
+    this.pump.setTrigger(fn);
+    this.addCleanup(() => this.pump.setTrigger(null));
+  }
+
+  /** Resolves when the app next emits `hostcontextchanged` (listener auto-removed). */
+  awaitHostContextChanged(): Promise<void> {
+    return new Promise<void>((resolve) => {
+      const handler = () => resolve();
+      this.app.addEventListener("hostcontextchanged", handler);
+      this.addCleanup(() =>
+        this.app.removeEventListener("hostcontextchanged", handler),
+      );
+    });
+  }
+
+  /** True if `p` settles within `ms`, else false — for optional/best-effort waits. */
+  settled(p: Promise<unknown>, ms: number): Promise<boolean> {
+    return Promise.race([
+      p.then(
+        () => true,
+        () => true,
+      ),
+      new Promise<boolean>((resolve) => setTimeout(() => resolve(false), ms)),
+    ]);
+  }
+}
diff --git a/examples/conformance-server/src/harness/registry.ts b/examples/conformance-server/src/harness/registry.ts
new file mode 100644
index 000000000..eecfd7597
--- /dev/null
+++ b/examples/conformance-server/src/harness/registry.ts
@@ -0,0 +1,272 @@
+/**
+ * Test registration + the suite engine. A test is `mcp_test(id, name, fn, opts)`;
+ * the engine runs the registry sequentially (manual tests last), building a fresh
+ * `TestContext` per test wired to its single pending-request slot. The channel
+ * (channel.ts) wraps the engine for the Runner; `main.tsx` renders from its state.
+ */
+
+import type { App } from "@modelcontextprotocol/ext-apps";
+import type {
+  CapabilityRequest,
+  CapabilityResult,
+  Clause,
+  SubtestResult,
+  SuitePoll,
+  Vantage,
+} from "@modelcontextprotocol/ext-apps/conformance/protocol";
+import {
+  AssertionError,
+  captureHostSignals,
+  type HostSignals,
+  SkipError,
+} from "./assert";
+import { HostGateway, type RequestPump } from "./host-gateway";
+
+/** A test sees the in-view assertions/probes and the host round-trip methods. */
+export type TestContext = HostGateway;
+
+export interface TestOptions {
+  vantage?: Vantage;
+  /** Requires a host action to trigger or verify (e.g. change theme, open a link). */
+  manual?: boolean;
+  clause?: Clause;
+  /** A warning about what this result can't distinguish or where it may mislead. */
+  caveat?: string;
+  timeoutMs?: number;
+}
+
+export interface TestDef {
+  id: string;
+  name: string;
+  vantage: Vantage;
+  manual: boolean;
+  clause?: Clause;
+  caveat?: string;
+  timeoutMs: number;
+  fn: (t: TestContext) => void | Promise<void>;
+}
+
+const registry: TestDef[] = [];
+
+export function mcp_test(
+  id: string,
+  name: string,
+  fn: (t: TestContext) => void | Promise<void>,
+  opts: TestOptions = {},
+): void {
+  registry.push({
+    id,
+    name,
+    fn,
+    vantage: opts.vantage ?? "in-view",
+    manual: opts.manual ?? false,
+    clause: opts.clause,
+    caveat: opts.caveat,
+    timeoutMs: opts.timeoutMs ?? 5000,
+  });
+}
+
+export function getRegistry(): ReadonlyArray<Omit<TestDef, "fn">> {
+  return registry;
+}
+
+function withTimeout<T>(p: Promise<T>, ms: number): Promise<T> {
+  // ms = 0 (or non-finite) disables the timeout — manual tests block on a host
+  // round-trip for an unbounded time.
+  if (!ms || !Number.isFinite(ms)) return p;
+  return new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(
+      () => reject(new AssertionError(`timed out after ${ms}ms`)),
+      ms,
+    );
+    p.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      },
+    );
+  });
+}
+
+export class SuiteEngine implements RequestPump {
+  private app: App | null = null;
+  private signals: HostSignals | null = null;
+
+  results: SubtestResult[] = [];
+  runningId: string | null = null;
+  pendingRequest: CapabilityRequest | null = null;
+  private phase: "idle" | "running" | "done" = "idle";
+
+  private pendingResolve: ((r: CapabilityResult) => void) | null = null;
+  private pendingReject: ((e: Error) => void) | null = null;
+  private trigger: (() => void | Promise<unknown>) | null = null;
+
+  /** Bumped on every state change; `main.tsx` subscribes via useSyncExternalStore. */
+  version = 0;
+  private listeners = new Set<() => void>();
+
+  attach(app: App, signals: HostSignals): void {
+    this.app = app;
+    this.signals = signals;
+  }
+
+  subscribe = (fn: () => void): (() => void) => {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  };
+  getVersion = (): number => this.version;
+
+  private emit(): void {
+    this.version += 1;
+    for (const fn of this.listeners) fn();
+  }
+
+  // ── RequestPump (called by the gateway) ──────────────────────────────────
+  request(req: CapabilityRequest): Promise<CapabilityResult> {
+    this.pendingRequest = req;
+    this.emit();
+    return new Promise<CapabilityResult>((resolve, reject) => {
+      this.pendingResolve = resolve;
+      this.pendingReject = reject;
+    });
+  }
+
+  setTrigger(fn: (() => void | Promise<unknown>) | null): void {
+    this.trigger = fn;
+  }
+
+  // ── channel surface (resolve / trigger / skip / poll) ────────────────────
+  resolve(result: CapabilityResult): void {
+    const resolve = this.pendingResolve;
+    this.clearPending();
+    resolve?.(result);
+  }
+
+  /** Human "skip" button: abort whatever the current test is awaiting → SKIP. */
+  skipCurrent(): void {
+    const reject = this.pendingReject;
+    this.clearPending();
+    reject?.(new SkipError("skipped by operator"));
+  }
+
+  invokeTrigger(): void {
+    void Promise.resolve(this.trigger?.()).catch((e) =>
+      console.error("[conformance] trigger error:", e),
+    );
+  }
+
+  private clearPending(): void {
+    this.pendingRequest = null;
+    this.pendingResolve = null;
+    this.pendingReject = null;
+    this.emit();
+  }
+
+  poll(): SuitePoll {
+    if (this.phase === "idle") return { state: "idle" };
+    if (this.phase === "done") return { state: "done", results: this.results };
+    return {
+      state: "running",
+      runningId: this.runningId ?? "",
+      request: this.pendingRequest,
+      results: this.results,
+    };
+  }
+
+  async start(
+    filter?: { manual?: boolean; id?: string } | null,
+  ): Promise<void> {
+    if (!this.app || !this.signals)
+      throw new Error("engine not attached to an app");
+    if (this.phase === "running") return;
+
+    const selected = registry.filter((d) => {
+      if (filter?.id != null && d.id !== filter.id) return false;
+      if (filter?.manual != null && d.manual !== filter.manual) return false;
+      return true;
+    });
+    // Automatic tests first (fast, no host round-trips), manual (human/Runner) last.
+    const ordered = [...selected].sort(
+      (a, b) => Number(a.manual) - Number(b.manual),
+    );
+
+    this.results = [];
+    this.phase = "running";
+    this.emit();
+
+    for (const def of ordered) {
+      if (def.manual) {
+        // Reset the host between manual tests so state can't leak (Runner-driven).
+        // A skip here (rejects) just proceeds without a reset — never strands the run.
+        await this.request({ kind: "resetIsolation" }).catch(() => {});
+      }
+      this.runningId = def.id;
+      this.emit();
+      this.results.push(await this.runOne(def));
+      this.emit();
+    }
+
+    this.runningId = null;
+    this.phase = "done";
+    this.emit();
+  }
+
+  private async runOne(def: TestDef): Promise<SubtestResult> {
+    const t = new HostGateway(this.app!, this.signals!, this);
+    const start = performance.now();
+    let status: SubtestResult["status"] = "PASS";
+    let message: string | undefined;
+    try {
+      await withTimeout(Promise.resolve(def.fn(t)), def.timeoutMs);
+    } catch (e) {
+      const err = e as Error;
+      if (err instanceof SkipError) {
+        status = "SKIP";
+      } else if (
+        err instanceof AssertionError &&
+        /timed out/.test(err.message)
+      ) {
+        status = "TIMEOUT";
+      } else {
+        status = "FAIL";
+      }
+      message = err.message;
+    } finally {
+      // Restore any host state the test mutated (newest cleanup first).
+      for (const fn of [...t.cleanups].reverse()) {
+        try {
+          await fn();
+        } catch (e) {
+          console.error("[conformance] cleanup error:", e);
+        }
+      }
+      // Return to inline after every test: some tests change the display mode.
+      try {
+        await this.app!.requestDisplayMode({ mode: "inline" });
+      } catch {
+        /* host may decline */
+      }
+    }
+    return {
+      id: def.id,
+      name: def.name,
+      status,
+      vantage: def.vantage,
+      manual: def.manual,
+      clause: def.clause,
+      caveat: def.caveat,
+      message,
+      value: t.value,
+      durationMs: Math.round(performance.now() - start),
+    };
+  }
+}
+
+/** The one engine instance the channel wraps and `main.tsx` renders from. */
+export const engine = new SuiteEngine();
+
+export { captureHostSignals, type HostSignals };
diff --git a/examples/conformance-server/src/mcp-app.tsx b/examples/conformance-server/src/mcp-app.tsx
new file mode 100644
index 000000000..fc946da56
--- /dev/null
+++ b/examples/conformance-server/src/mcp-app.tsx
@@ -0,0 +1,520 @@
+/**
+ * The conformance runner View (React, via ext-apps' `useApp`).
+ *
+ * Tests run behind a **user-gesture button** rather than auto-running on
+ * connect: some hosts (e.g. ChatGPT) only allow display-mode / fullscreen
+ * changes under transient user activation, so a click is required for those
+ * tests to behave. `useApp`'s `onAppCreated` lets us capture host→view
+ * notifications (tool-input/tool-result) BEFORE connect.
+ *
+ * The UI renders from the suite engine's state (registry.ts) and the same engine
+ * is exposed to an external Runner as `window.__mcpConformance` (channel.ts).
+ * A human drives it here: Run starts the suite; when a test parks a capability
+ * request, the action card resolves it ("It worked" / "It didn't" / Skip), and
+ * gesture-gated triggers fire from a real click on the trigger button.
+ */
+import { useApp } from "@modelcontextprotocol/ext-apps/react";
+import {
+  type CapabilityRequest,
+  CHANNEL,
+  type Status,
+} from "@modelcontextprotocol/ext-apps/conformance/protocol";
+import { useEffect, useRef, useState, useSyncExternalStore } from "react";
+import { createRoot } from "react-dom/client";
+import catalogue from "../catalogue.json";
+import { installChannel } from "./harness/channel";
+import {
+  captureHostSignals,
+  engine,
+  getRegistry,
+  type HostSignals,
+} from "./harness/registry";
+import "./tests";
+import "./style.css";
+
+// Per-test spec reference (which spec + line) from the catalogue — used in the
+// test-detail modal to link to the exact requirement on GitHub.
+const CATALOGUE: Record<string, { spec: string; line: number }> =
+  Object.fromEntries(
+    (catalogue as { id: string; spec: string; line: number }[]).map((e) => [
+      e.id,
+      { spec: e.spec, line: e.line },
+    ]),
+  );
+const specUrl = (spec: string, line: number) =>
+  `https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/${spec}/apps.mdx?plain=1#L${line}`;
+
+type Row = {
+  id: string;
+  name: string;
+  status: Status;
+  clause?: string;
+  vantage: string;
+  manual: boolean;
+  caveat?: string;
+  message?: string;
+  value?: unknown;
+};
+
+const statusClass = (s: string) => `st st-${s.toLowerCase()}`;
+
+/** Merge the static registry with the engine's completed results into UI rows. */
+function buildRows(): Row[] {
+  const byId = new Map(engine.results.map((r) => [r.id, r]));
+  return getRegistry().map((d) => {
+    const r = byId.get(d.id);
+    return {
+      id: d.id,
+      name: d.name,
+      status: r?.status ?? "NOTRUN",
+      clause: d.clause,
+      vantage: d.vantage,
+      manual: d.manual,
+      caveat: d.caveat,
+      message: r?.message,
+      value: r?.value,
+    };
+  });
+}
+
+const requestLabel = (req: CapabilityRequest): string => {
+  switch (req.kind) {
+    case "clickTrigger":
+      return "Click the trigger button, then report the outcome.";
+    case "confirmDialog":
+      return `Confirm the host's “${req.dialog}” dialog, then report the outcome.`;
+    case "checkLinkOpen":
+      return `Open the link — a tab at ${req.url} should open.`;
+    case "conversationContains":
+      return `Waiting for “${req.marker}” to appear in the conversation.`;
+    case "toggleTheme":
+      return `Toggle the host theme to ${req.to}.`;
+    case "readModelToolList":
+      return "Provide the model's tool list (or skip if unavailable).";
+    case "inspectFrame":
+      return "Inspect the host's iframe elements (operator).";
+    case "readConsole":
+      return `Scan the host console for /${req.pattern}/ (operator).`;
+    case "resetIsolation":
+      return "Reset the host to a clean state before the next manual test.";
+  }
+};
+
+/** Syntax-highlight a value as pretty JSON (keys/strings/numbers/bools/null). */
+function highlightJson(value: unknown): string {
+  const json = JSON.stringify(value, null, 2) ?? "undefined";
+  const esc = json
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+  return esc.replace(
+    /("(\\u[a-fA-F0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false)\b|\bnull\b|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)/g,
+    (m) => {
+      let cls = "j-num";
+      if (/^"/.test(m)) cls = /:$/.test(m) ? "j-key" : "j-str";
+      else if (m === "true" || m === "false") cls = "j-bool";
+      else if (m === "null") cls = "j-null";
+      return `<span class="${cls}">${m}</span>`;
+    },
+  );
+}
+
+/** One collapsible panel showing a captured value as highlighted JSON. */
+function JsonPanel({
+  label,
+  value,
+  open,
+}: {
+  label: string;
+  value: unknown;
+  open?: boolean;
+}) {
+  const present = value !== undefined && value !== null;
+  return (
+    <details className="json-panel" open={open && present}>
+      <summary>
+        {label}
+        {!present && <span className="json-empty">— not provided</span>}
+      </summary>
+      {present && (
+        <pre
+          className="json"
+          dangerouslySetInnerHTML={{ __html: highlightJson(value) }}
+        />
+      )}
+    </details>
+  );
+}
+
+function ConformanceRunner() {
+  const signalsRef = useRef<HostSignals | null>(null);
+  const dialogRef = useRef<HTMLDialogElement>(null);
+  const detailRef = useRef<HTMLDialogElement>(null);
+  const [detail, setDetail] = useState<Row | null>(null);
+  const [inspect, setInspect] = useState<Record<string, unknown>>({});
+
+  // Re-render whenever the engine's state changes (start/result/pending/resolve).
+  useSyncExternalStore(engine.subscribe, engine.getVersion);
+
+  const { app, error } = useApp({
+    appInfo: { name: "mcp-apps-conformance-runner", version: "0.1.0" },
+    // `tools` is required to register app-provided tools (app-tools/call);
+    // without it registerTool throws "Client does not support tool capability".
+    capabilities: {
+      availableDisplayModes: ["inline", "fullscreen"],
+      tools: { listChanged: true },
+    },
+    autoResize: true,
+    onAppCreated: (created) => {
+      // captureHostSignals wires tool-input/result promises the lifecycle tests
+      // await; we no longer surface those in the UI.
+      signalsRef.current = captureHostSignals(created);
+      created.onerror = (e) => console.error("[conformance] app error:", e);
+    },
+  });
+
+  // Install the Runner channel and keep the Inspector in sync with host
+  // capabilities/context (context refreshes on host-context-changed).
+  useEffect(() => {
+    if (!app) return;
+    installChannel(app, signalsRef.current!);
+    const sync = () =>
+      setInspect((p) => ({
+        ...p,
+        hostCapabilities: app.getHostCapabilities(),
+        hostContext: app.getHostContext(),
+      }));
+    sync();
+    app.addEventListener("hostcontextchanged", sync);
+    return () => app.removeEventListener("hostcontextchanged", sync);
+  }, [app]);
+
+  const poll = engine.poll();
+  const running = poll.state === "running";
+  const ran = poll.state === "done";
+  const runningId = poll.state === "running" ? poll.runningId : null;
+  const pending = poll.state === "running" ? poll.request : null;
+
+  const rows = buildRows();
+  const host = app?.getHostVersion();
+  const pass = rows.filter((r) => r.status === "PASS").length;
+  const failed = rows.filter(
+    (r) => r.status === "FAIL" || r.status === "TIMEOUT",
+  ).length;
+  const done = rows.filter((r) => r.status !== "NOTRUN").length;
+  const summaryText = `${pass}/${rows.length} passing`;
+
+  // Group tests by their area prefix (security/, display/, …) for the sidebar.
+  const groups: { name: string; tests: Row[] }[] = [];
+  const gmap = new Map<string, { name: string; tests: Row[] }>();
+  for (const r of rows) {
+    const name = r.id.split("/")[0];
+    let g = gmap.get(name);
+    if (!g) {
+      g = { name, tests: [] };
+      gmap.set(name, g);
+      groups.push(g);
+    }
+    g.tests.push(r);
+  }
+  const currentRow = runningId
+    ? rows.find((r) => r.id === runningId)
+    : undefined;
+
+  const hostLabel = error
+    ? "error"
+    : app
+      ? `${host?.name ?? "unknown"}${host?.version ? ` v${host.version}` : ""}`
+      : "connecting…";
+
+  const run = () => {
+    if (!running) window[CHANNEL]?.start();
+  };
+  const resolve = (ok: boolean) => window[CHANNEL]?.resolve({ ok });
+
+  return (
+    <main className="wrap">
+      <header className="head">
+        <div>
+          <h1>MCP Apps Conformance</h1>
+          <p className="sub">
+            Host under test: <span className="mono">{hostLabel}</span>
+          </p>
+        </div>
+        <div className="head-actions">
+          {ran && (
+            <span className={failed === 0 ? "summary ok" : "summary bad"}>
+              {summaryText}
+            </span>
+          )}
+          <button
+            type="button"
+            className="reset-btn"
+            data-testid="host-values"
+            title="Show the capabilities and context the host provided"
+            onClick={() => dialogRef.current?.showModal()}
+            disabled={!app}
+          >
+            Host values
+          </button>
+          <button
+            type="button"
+            className="reset-btn"
+            data-testid="reset-inline"
+            title="Revert the display mode to inline. Needs a real click on hosts (e.g. ChatGPT) that gate display-mode changes on a user gesture."
+            onClick={() => {
+              void app?.requestDisplayMode({ mode: "inline" }).catch(() => {});
+            }}
+            disabled={!app}
+          >
+            Reset to inline
+          </button>
+          <button
+            type="button"
+            className="run-btn"
+            data-testid="run"
+            onClick={run}
+            disabled={!app || running}
+          >
+            {running
+              ? `Running ${done}/${rows.length}…`
+              : ran
+                ? "Re-run tests"
+                : "Run conformance tests"}
+          </button>
+        </div>
+      </header>
+
+      {running && (
+        <div
+          className="progress"
+          role="progressbar"
+          aria-valuenow={done}
+          aria-valuemax={rows.length}
+        >
+          <div
+            className="progress-bar"
+            style={{
+              width: `${rows.length ? (done / rows.length) * 100 : 0}%`,
+            }}
+          />
+        </div>
+      )}
+
+      {error && <p className="msg">connection error: {error.message}</p>}
+
+      <div className="layout">
+        <aside className="sidebar">
+          {groups.map((g) => {
+            const gp = g.tests.filter((t) => t.status === "PASS").length;
+            const gf = g.tests.filter(
+              (t) => t.status === "FAIL" || t.status === "TIMEOUT",
+            ).length;
+            return (
+              <details className="group" key={g.name}>
+                <summary>
+                  <span className="group-name">{g.name}</span>
+                  <span className={`group-count${gf ? " has-fail" : ""}`}>
+                    {gp}/{g.tests.length}
+                  </span>
+                </summary>
+                <ul className="group-tests">
+                  {g.tests.map((t) => (
+                    <li
+                      key={t.id}
+                      className={t.id === runningId ? "running" : undefined}
+                    >
+                      <span
+                        className={`dot ${t.id === runningId ? "dot-running" : `dot-${t.status.toLowerCase()}`}`}
+                      />
+                      <button
+                        type="button"
+                        className="tname mono"
+                        title="Show test details"
+                        onClick={() => {
+                          setDetail(t);
+                          detailRef.current?.showModal();
+                        }}
+                      >
+                        {t.id.slice(g.name.length + 1)}
+                      </button>
+                      <span className={statusClass(t.status)}>
+                        {t.id === runningId ? "…" : t.status}
+                      </span>
+                    </li>
+                  ))}
+                </ul>
+              </details>
+            );
+          })}
+        </aside>
+
+        <section className="current">
+          {pending ? (
+            <div className="current-card">
+              <div className="current-id mono">
+                {currentRow?.id ?? runningId}
+              </div>
+              <div className="current-meta">
+                {currentRow?.clause}
+                {currentRow?.vantage ? ` · ${currentRow.vantage}` : ""}
+                {currentRow?.manual ? " · manual" : ""}
+              </div>
+              <span className="interaction-tag">action needed</span>
+              <p className="interaction-prompt">{requestLabel(pending)}</p>
+              <div className="interaction-actions">
+                {pending.kind === "clickTrigger" && (
+                  <button
+                    type="button"
+                    className="trigger-btn"
+                    data-testid="conformance-trigger"
+                    onClick={() => engine.invokeTrigger()}
+                  >
+                    ▶ Trigger action
+                  </button>
+                )}
+                <button
+                  type="button"
+                  className="verdict-btn ok"
+                  data-testid="verdict-yes"
+                  onClick={() => resolve(true)}
+                >
+                  ✅ It worked
+                </button>
+                <button
+                  type="button"
+                  className="verdict-btn no"
+                  data-testid="verdict-no"
+                  onClick={() => resolve(false)}
+                >
+                  ❌ It didn’t
+                </button>
+                <button
+                  type="button"
+                  className="verdict-btn no"
+                  data-testid="verdict-skip"
+                  onClick={() => engine.skipCurrent()}
+                >
+                  Skip
+                </button>
+              </div>
+            </div>
+          ) : currentRow ? (
+            <div className="current-card">
+              <div className="current-id mono">{currentRow.id}</div>
+              <div className="current-meta">
+                {currentRow.clause}
+                {currentRow.vantage ? ` · ${currentRow.vantage}` : ""}
+                {currentRow.manual ? " · manual" : ""}
+              </div>
+              <div className="current-status">
+                <span className="spinner" /> running…
+              </div>
+              {currentRow.message && (
+                <p className="msg">{currentRow.message}</p>
+              )}
+            </div>
+          ) : (
+            <div className="current-card idle">
+              {ran ? (
+                <>
+                  <div className={`big-summary ${failed === 0 ? "ok" : "bad"}`}>
+                    {summaryText}
+                  </div>
+                  <p>
+                    Run complete. Toggle a group on the left to review each
+                    test.
+                  </p>
+                </>
+              ) : (
+                <p>
+                  Click <strong>Run conformance tests</strong> to start. Tests
+                  run one at a time — the current test shows here, and results
+                  fill in the groups on the left.
+                </p>
+              )}
+            </div>
+          )}
+        </section>
+      </div>
+
+      <dialog ref={dialogRef} className="values-dialog">
+        <div className="values-head">
+          <h2>Values provided by the host</h2>
+          <button
+            type="button"
+            className="dialog-close"
+            onClick={() => dialogRef.current?.close()}
+          >
+            ×
+          </button>
+        </div>
+        <JsonPanel label="Host capabilities" value={inspect.hostCapabilities} />
+        <JsonPanel label="Host context" value={inspect.hostContext} />
+      </dialog>
+
+      <dialog ref={detailRef} className="values-dialog">
+        {detail && (
+          <>
+            <div className="values-head">
+              <h2 className="mono">{detail.id}</h2>
+              <button
+                type="button"
+                className="dialog-close"
+                onClick={() => detailRef.current?.close()}
+              >
+                ×
+              </button>
+            </div>
+            <div className="detail-row">
+              <span className="detail-label">Status</span>
+              <span className={statusClass(detail.status)}>
+                {detail.status}
+              </span>
+            </div>
+            <div className="detail-row">
+              <span className="detail-label">Clause</span>
+              <span className="mono">
+                {detail.clause}
+                {detail.vantage ? ` · ${detail.vantage}` : ""}
+                {detail.manual ? " · manual" : ""}
+              </span>
+            </div>
+            {detail.message && (
+              <div className="detail-row">
+                <span className="detail-label">Message</span>
+                <span className="detail-msg">{detail.message}</span>
+              </div>
+            )}
+            {CATALOGUE[detail.id] && (
+              <div className="detail-row">
+                <span className="detail-label">Spec</span>
+                <span>
+                  {CATALOGUE[detail.id].spec === "draft"
+                    ? "draft (unstable)"
+                    : CATALOGUE[detail.id].spec}{" "}
+                  ·{" "}
+                  <a
+                    href={specUrl(
+                      CATALOGUE[detail.id].spec,
+                      CATALOGUE[detail.id].line,
+                    )}
+                    target="_blank"
+                    rel="noopener"
+                  >
+                    L{CATALOGUE[detail.id].line} on GitHub ↗
+                  </a>
+                </span>
+              </div>
+            )}
+            {detail.caveat && (
+              <p className="detail-caveat">⚠️ {detail.caveat}</p>
+            )}
+          </>
+        )}
+      </dialog>
+    </main>
+  );
+}
+
+createRoot(document.getElementById("root")!).render(<ConformanceRunner />);
diff --git a/examples/conformance-server/src/style.css b/examples/conformance-server/src/style.css
new file mode 100644
index 000000000..bffd625a2
--- /dev/null
+++ b/examples/conformance-server/src/style.css
@@ -0,0 +1,132 @@
+:root {
+  /* Plain hex + a dark-mode media query rather than light-dark(): the CSS
+     minifier mangles light-dark() into an invalid value (e.g. "#fff#14171d"),
+     which made var(--bg)/var(--ink) resolve to transparent. */
+  --bg: #ffffff;
+  --ink: #171a1f;
+  --muted: #5b6573;
+  --line: #e6e8ec;
+  --pass: #1a9c63; --fail: #d6492f; --timeout: #c98a1e; --notrun: #8a93a3;
+  --accent: #3b82f6;
+  --mono: ui-monospace, "SF Mono", Menlo, monospace;
+  --sans: -apple-system, BlinkMacSystemFont, "Inter", "Segoe UI", sans-serif;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #14171d;
+    --ink: #e7ecf3;
+    --muted: #97a3b6;
+    --line: #262d39;
+  }
+}
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--bg); color: var(--ink); font-family: var(--sans); font-size: 14px; }
+.wrap { padding: 18px 20px; }
+.head { display: flex; justify-content: space-between; align-items: flex-start; gap: 16px; margin-bottom: 14px; }
+h1 { font-size: 17px; margin: 0 0 2px; letter-spacing: -0.01em; }
+.sub { margin: 0; color: var(--muted); font-size: 12px; }
+.mono { font-family: var(--mono); }
+.summary { font-family: var(--mono); font-size: 13px; padding: 4px 12px; border-radius: 8px; border: 1px solid var(--line); white-space: nowrap; }
+.summary.ok { color: var(--pass); border-color: var(--pass); }
+.summary.bad { color: var(--fail); border-color: var(--fail); }
+.head-actions { display: flex; align-items: center; gap: 12px; flex-shrink: 0; }
+.run-btn { font-family: var(--sans); font-size: 13px; font-weight: 600; padding: 7px 16px; border-radius: 8px; cursor: pointer; color: #fff; background: var(--accent); border: 1px solid var(--accent); }
+.run-btn:disabled { opacity: 0.5; cursor: default; }
+.reset-btn { font-family: var(--sans); font-size: 13px; font-weight: 600; padding: 7px 14px; border-radius: 8px; cursor: pointer; color: var(--ink); background: transparent; border: 1px solid var(--line); }
+.reset-btn:disabled { opacity: 0.5; cursor: default; }
+.reset-btn:hover:not(:disabled) { border-color: var(--accent); color: var(--accent); }
+.grid { width: 100%; border-collapse: collapse; }
+th, td { text-align: left; padding: 9px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
+th { font-size: 10px; letter-spacing: 0.08em; text-transform: uppercase; color: var(--muted); font-family: var(--mono); }
+.msg { color: var(--fail); font-family: var(--mono); font-size: 11px; margin-top: 4px; white-space: pre-wrap; }
+.caveat { color: var(--timeout); font-size: 11px; margin-top: 4px; line-height: 1.4; }
+.vantage { display: inline-block; margin-left: 8px; padding: 1px 6px; border-radius: 5px; border: 1px solid var(--line); color: var(--muted); font-size: 10px; }
+.st { font-family: var(--mono); font-size: 11px; font-weight: 600; padding: 2px 8px; border-radius: 6px; }
+.st-pass { color: var(--pass); background: color-mix(in srgb, var(--pass) 14%, transparent); }
+.st-fail { color: var(--fail); background: color-mix(in srgb, var(--fail) 14%, transparent); }
+.st-timeout { color: var(--timeout); background: color-mix(in srgb, var(--timeout) 14%, transparent); }
+.st-notrun { color: var(--notrun); background: color-mix(in srgb, var(--notrun) 14%, transparent); }
+.st-skip { color: var(--muted); background: color-mix(in srgb, var(--muted) 14%, transparent); }
+.st-info { color: var(--accent); background: color-mix(in srgb, var(--accent) 14%, transparent); }
+.st-running { color: var(--accent); background: color-mix(in srgb, var(--accent) 14%, transparent); display: inline-flex; align-items: center; gap: 6px; }
+
+/* live run progress + the currently-running row */
+.progress { height: 4px; border-radius: 999px; background: var(--line); overflow: hidden; margin: 0 0 14px; }
+.progress-bar { height: 100%; background: var(--accent); border-radius: 999px; transition: width 0.25s ease; }
+tr.running { background: color-mix(in srgb, var(--accent) 7%, transparent); }
+.spinner { width: 10px; height: 10px; border-radius: 50%; border: 2px solid currentColor; border-top-color: transparent; display: inline-block; animation: spin 0.6s linear infinite; }
+@keyframes spin { to { transform: rotate(360deg); } }
+
+/* human-in-the-loop interaction panel */
+.interaction-scrim { position: fixed; inset: 0; display: flex; align-items: center; justify-content: center; padding: 24px; background: rgba(0, 0, 0, 0.22); backdrop-filter: blur(6px); -webkit-backdrop-filter: blur(6px); z-index: 50; }
+.interaction-card { width: 100%; max-width: 460px; background: var(--bg); border: 1px solid var(--line); border-radius: 14px; padding: 22px; box-shadow: 0 20px 60px rgba(0,0,0,0.35); animation: pop 0.16s ease-out; }
+@keyframes pop { from { transform: scale(0.97); opacity: 0; } to { transform: scale(1); opacity: 1; } }
+.interaction-tag { font-family: var(--mono); font-size: 10px; letter-spacing: 0.08em; text-transform: uppercase; color: var(--accent); }
+.interaction-prompt { margin: 8px 0 18px; font-size: 15px; line-height: 1.5; }
+.interaction-actions { display: flex; flex-wrap: wrap; gap: 10px; }
+.trigger-btn { font-family: var(--sans); font-size: 14px; font-weight: 600; padding: 9px 16px; border-radius: 9px; cursor: pointer; color: #fff; background: var(--accent); border: 1px solid var(--accent); }
+.verdict-btn { font-family: var(--sans); font-size: 14px; font-weight: 600; padding: 9px 16px; border-radius: 9px; cursor: pointer; background: transparent; border: 1px solid var(--line); color: var(--ink); }
+.verdict-btn.ok { color: var(--pass); border-color: color-mix(in srgb, var(--pass) 55%, var(--line)); }
+.verdict-btn.no { color: var(--fail); border-color: color-mix(in srgb, var(--fail) 55%, var(--line)); }
+.verdict-btn:hover, .trigger-btn:hover { filter: brightness(1.05); }
+.interaction-actions .verdict-btn.ok { margin-left: auto; }
+.awaiting { display: inline-flex; align-items: center; gap: 8px; color: var(--muted); font-size: 13px; margin-right: auto; }
+
+/* Inspector — collapsible JSON viewer for host-provided values */
+.inspector { margin-top: 22px; padding-top: 16px; border-top: 1px solid var(--line); }
+.inspector-title { font-size: 11px; letter-spacing: 0.08em; text-transform: uppercase; color: var(--muted); font-family: var(--mono); margin: 0 0 10px; }
+.json-panel { border: 1px solid var(--line); border-radius: 9px; margin-bottom: 8px; overflow: hidden; }
+.json-panel > summary { cursor: pointer; padding: 9px 12px; font-family: var(--mono); font-size: 12px; font-weight: 600; list-style: none; display: flex; align-items: center; gap: 8px; }
+.json-panel > summary::-webkit-details-marker { display: none; }
+.json-panel > summary::before { content: "▸"; color: var(--muted); font-size: 10px; transition: transform 0.15s ease; }
+.json-panel[open] > summary::before { transform: rotate(90deg); }
+.json-empty { font-weight: 400; color: var(--muted); font-size: 11px; }
+.json { margin: 0; padding: 12px 14px; border-top: 1px solid var(--line); background: color-mix(in srgb, var(--ink) 4%, var(--bg)); font-family: var(--mono); font-size: 12px; line-height: 1.5; overflow-x: auto; white-space: pre; tab-size: 2; }
+.json .j-key { color: var(--accent); }
+.json .j-str { color: var(--pass); }
+.json .j-num { color: var(--timeout); }
+.json .j-bool { color: var(--fail); }
+.json .j-null { color: var(--muted); }
+
+/* ── revamped layout: sidebar (grouped tests) + current test ────────────────── */
+.layout { display: flex; gap: 20px; align-items: flex-start; margin-top: 16px; }
+.sidebar { width: 300px; flex-shrink: 0; }
+.group { border: 1px solid var(--line); border-radius: 9px; margin-bottom: 8px; overflow: hidden; }
+.group > summary { cursor: pointer; padding: 9px 12px; display: flex; align-items: center; gap: 6px; list-style: none; }
+.group > summary::-webkit-details-marker { display: none; }
+.group > summary::before { content: "▸"; color: var(--muted); font-size: 10px; transition: transform 0.15s ease; }
+.group[open] > summary::before { transform: rotate(90deg); }
+.group-name { flex: 1; font-family: var(--mono); font-size: 12px; font-weight: 600; }
+.group-count { font-family: var(--mono); font-size: 11px; color: var(--muted); }
+.group-count.has-fail { color: var(--fail); }
+.group-tests { list-style: none; margin: 0; padding: 4px 0; border-top: 1px solid var(--line); }
+.group-tests li { display: flex; align-items: center; gap: 8px; padding: 5px 12px; }
+.group-tests li.running { background: color-mix(in srgb, var(--accent) 8%, transparent); }
+.tname { flex: 1; min-width: 0; font-size: 11px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; text-align: left; background: transparent; border: none; padding: 0; cursor: pointer; color: var(--ink); font-family: var(--mono); }
+.tname:hover { color: var(--accent); text-decoration: underline; }
+.detail-row { display: flex; gap: 12px; padding: 9px 0; border-bottom: 1px solid var(--line); font-size: 13px; align-items: baseline; }
+.detail-label { width: 72px; flex-shrink: 0; color: var(--muted); font-size: 10px; text-transform: uppercase; letter-spacing: 0.05em; }
+.detail-msg { color: var(--fail); font-family: var(--mono); font-size: 12px; word-break: break-word; }
+.detail-caveat { color: var(--timeout); font-size: 12px; margin: 12px 0 0; line-height: 1.5; }
+.values-dialog a { color: var(--accent); }
+.dot { width: 8px; height: 8px; border-radius: 50%; flex-shrink: 0; background: var(--notrun); }
+.dot-pass { background: var(--pass); }
+.dot-fail, .dot-timeout { background: var(--fail); }
+.dot-running { background: var(--accent); animation: pulse 1s ease-in-out infinite; }
+@keyframes pulse { 50% { opacity: 0.3; } }
+.current { flex: 1; min-width: 0; }
+.current-card { border: 1px solid var(--line); border-radius: 12px; padding: 22px; min-height: 200px; }
+.current-card.idle { color: var(--muted); display: flex; flex-direction: column; gap: 10px; align-items: flex-start; line-height: 1.5; }
+.current-id { font-size: 15px; font-weight: 600; }
+.current-meta { color: var(--muted); font-size: 11px; font-family: var(--mono); margin-top: 4px; text-transform: uppercase; letter-spacing: 0.04em; }
+.current-status { display: inline-flex; align-items: center; gap: 8px; margin-top: 18px; color: var(--accent); font-size: 14px; }
+.big-summary { font-size: 22px; font-weight: 700; }
+.big-summary.ok { color: var(--pass); } .big-summary.bad { color: var(--fail); }
+.current-card .interaction-tag { display: inline-block; margin-top: 16px; }
+
+/* host-values dialog */
+.values-dialog { border: 1px solid var(--line); border-radius: 14px; padding: 20px; max-width: 560px; width: 90vw; color: var(--ink); background: var(--bg); box-shadow: 0 20px 60px rgba(0, 0, 0, 0.35); }
+.values-dialog::backdrop { background: rgba(0, 0, 0, 0.35); backdrop-filter: blur(4px); }
+.values-head { display: flex; align-items: center; justify-content: space-between; margin-bottom: 12px; }
+.values-head h2 { font-size: 15px; margin: 0; }
+.dialog-close { border: none; background: transparent; font-size: 22px; line-height: 1; cursor: pointer; color: var(--muted); }
diff --git a/examples/conformance-server/src/tests.ts b/examples/conformance-server/src/tests.ts
new file mode 100644
index 000000000..84ecfd111
--- /dev/null
+++ b/examples/conformance-server/src/tests.ts
@@ -0,0 +1,276 @@
+/**
+ * The conformance test catalogue (in-view slice).
+ *
+ * This platform certifies HOSTS, so every test is a host test — IDs are
+ * namespaced by spec capability area (lifecycle/, security/, …), WPT-path style.
+ * Each test carries a `vantage` (where it can be observed) and, where relevant, a
+ * `caveat` warning about what the result can't distinguish.
+ *
+ * Automatic tests (`vantage: "in-view"`) measure the host from inside the iframe
+ * with `t.assert` / the probes / `t.app.*`. Manual tests emit typed
+ * `CapabilityRequest`s (`t.host(...)`) that an external Runner — or a human
+ * clicking the UI — resolves.
+ */
+import { mcp_test, type TestContext } from "./harness/registry";
+
+// Markers the Runner searches for in the host conversation (conversationContains).
+const MESSAGE_MARKER = "conformance-msg-b8f1c2e7";
+const MODEL_CONTEXT_MARKER = "MCP-APP-7421";
+
+// An undeclared origin (not in the runner resource's connectDomains) that the
+// host's CSP must keep blocked.
+const CSP_UNDECLARED = "https://example.com/";
+
+// ── lifecycle ──────────────────────────────────────────────────────────────
+// host MUST send ui/notifications/tool-input after the View inits.
+mcp_test(
+  "lifecycle/tool-input",
+  "host sends tool-input after initialize",
+  async (t: TestContext) => {
+    const params = await t.signals.toolInput;
+    t.assert(
+      params !== undefined,
+      "host must send a ui/notifications/tool-input with the tool arguments",
+    );
+  },
+  {
+    clause: "MUST",
+    vantage: "in-view",
+    timeoutMs: 4000,
+    caveat:
+      "Captured via the ontoolinput callback (registered before connect). TIMEOUT means the host never sent it for the launching tool.",
+  },
+);
+
+// ── security · CSP ───────────────────────────────────────────────────────────
+// Even with a CSP declared, an UNDECLARED origin MUST stay blocked.
+mcp_test(
+  "security/csp-no-loosening",
+  "undeclared origin stays blocked when a CSP is declared",
+  async (t: TestContext) => {
+    const blocked = await t.expectFetchBlocked(CSP_UNDECLARED);
+    t.assert(
+      blocked,
+      `the host must not allow the undeclared origin ${CSP_UNDECLARED} (no loosening beyond declared domains)`,
+    );
+  },
+  {
+    clause: "MUST NOT",
+    vantage: "in-view",
+    caveat: `Backed by the declared origin working as a positive control: the declared origin is reachable, so blocking this one is genuinely the CSP, not a blanket fetch failure.`,
+  },
+);
+
+// security — the host MUST wrap the View in an intermediate Sandbox proxy, so the
+// View is not a direct child of the host top. Comparing window references across
+// origins is allowed (no property read), so this is an automatic in-view check.
+mcp_test(
+  "security/sandbox-proxy-required",
+  "the View is wrapped in an intermediate sandbox proxy",
+  (t: TestContext) => {
+    t.assert(
+      window.top !== window.self,
+      "not embedded in a host frame (window.top === self)",
+    );
+    t.assert(
+      window.parent !== window.top,
+      "the View is a direct child of the host top — no intermediate sandbox proxy frame between the View and the host",
+    );
+  },
+  {
+    clause: "MUST",
+    vantage: "in-view",
+    caveat:
+      "Paired with sandbox-distinct-origin (Host != Sandbox): window.parent (the sandbox) != window.top (the host) proves an intermediate proxy frame. Opened top-level, window.top === self and this FAILs — correct, it's not in a host.",
+  },
+);
+
+// security — the host MUST render the View in a sandboxed iframe. The View can't
+// self-detect the sandbox (allow-same-origin makes its origin look normal), so the
+// Runner reads the host page's <iframe> elements and confirms one is sandboxed.
+mcp_test(
+  "security/iframe-sandboxed",
+  "host renders the View in a sandboxed iframe",
+  async (t: TestContext) => {
+    const r = await t.host({ kind: "inspectFrame" });
+    t.setValue(r.value);
+    const info = r.value as
+      | { total: number; sandboxed: number; firstSandbox: string | null }
+      | undefined;
+    t.assert(
+      !!info && info.sandboxed >= 1,
+      "no sandboxed <iframe> found in the host document",
+    );
+  },
+  {
+    clause: "MUST",
+    vantage: "host",
+    manual: true,
+    timeoutMs: 0,
+    caveat:
+      "Operator-read: the sandboxed View's content is cross-origin, but the <iframe> element (and its sandbox attribute) lives in the host document and is readable. Asserts the host uses at least one sandboxed iframe.",
+  },
+);
+
+// visibility — app-only tools (visibility lacking "model") must be hidden from
+// the agent's tool list. Prefer the direct desktop-host affordance; else fall
+// back to asking the agent to enumerate its tools and confirm the name is absent.
+mcp_test(
+  "visibility/app-tool-hidden",
+  "host hides app-only tools from the agent",
+  async (t: TestContext) => {
+    const direct = await t.hostOptional({ kind: "readModelToolList" });
+    if (!direct.unsupported) {
+      t.assert(
+        !(direct.value as string[]).includes("conformance_probe"),
+        "app-only tool `conformance_probe` is present in the model's tool list (must be hidden)",
+      );
+      return;
+    }
+    t.assert(
+      !!t.app.getHostCapabilities()?.message,
+      "host does not advertise ui/message",
+    );
+    t.bindTrigger(() =>
+      t.app.sendMessage({
+        role: "user",
+        content: [
+          {
+            type: "text",
+            text: "From the MCP Apps Conformance server specifically, list every tool you can call, by name (ignore tools from other connected servers).",
+          },
+        ],
+      }),
+    );
+    await t.host({ kind: "clickTrigger", commitDraftedMessage: true });
+    const r = await t.host({
+      kind: "conversationContains",
+      marker: "conformance_probe",
+      timeoutMs: 45_000,
+    });
+    t.assert(
+      !r.ok,
+      "hidden tool name `conformance_probe` surfaced in the conversation",
+    );
+  },
+  {
+    clause: "MUST NOT",
+    vantage: "host",
+    manual: true,
+    timeoutMs: 0,
+    caveat:
+      '`conformance_probe` is app-only (visibility ["app"]) so it must not be in the model-facing tools/list. Uses the desktop-host tool-list affordance if available, else the agent\'s own (truthful) enumeration.',
+  },
+);
+
+// messages — host adds a ui/message to the conversation. The view can't read the
+// host's conversation, so the Runner triggers it (committing any drafted message)
+// and confirms the marker appeared.
+mcp_test(
+  "messages/add-to-conversation",
+  "ui/message is added to the conversation",
+  async (t: TestContext) => {
+    t.assert(
+      !!t.app.getHostCapabilities()?.message,
+      "host does not advertise ui/message",
+    );
+    t.bindTrigger(() =>
+      t.app.sendMessage({
+        role: "user",
+        content: [{ type: "text", text: MESSAGE_MARKER }],
+      }),
+    );
+    await t.host({ kind: "clickTrigger", commitDraftedMessage: true });
+    const r = await t.host({
+      kind: "conversationContains",
+      marker: MESSAGE_MARKER,
+      timeoutMs: 120_000,
+    });
+    t.assert(r.ok, "ui/message never appeared in the conversation");
+  },
+  {
+    clause: "SHOULD",
+    vantage: "host",
+    manual: true,
+    timeoutMs: 0,
+    caveat:
+      "Host-vantage: the view can't read the host's conversation, so the Runner confirms the marker appeared (some hosts draft into the composer — commitDraftedMessage sends it).",
+  },
+);
+
+// ── interactive · manual (host round-trip via CapabilityRequest) ──────────────
+// The host opens ui/open-link URLs in the user's browser / a new tab. The
+// sandboxed view can't observe a new tab (host vantage), so the Runner clicks the
+// trigger and then checks the link actually opened — accepting a consent dialog
+// if the host shows one, but not requiring one (some hosts open directly).
+mcp_test(
+  "links/open-external",
+  "ui/open-link opens the URL",
+  async (t: TestContext) => {
+    // A URL that does NOT redirect, so the opened tab's URL matches exactly.
+    const url = "https://modelcontextprotocol.io/docs/getting-started/intro";
+    t.bindTrigger(() => t.app.openLink({ url }));
+    await t.host({ kind: "clickTrigger" });
+    const r = await t.host({ kind: "checkLinkOpen", url });
+    t.assert(r.ok, "host did not open the link");
+  },
+  {
+    clause: "SHOULD",
+    vantage: "host",
+    manual: true,
+    timeoutMs: 0,
+    caveat:
+      "Host-vantage: the sandboxed view can't see the host open a tab, so the Runner triggers ui/open-link and verifies a tab opened (accepting a consent dialog if shown; some hosts open with none).",
+  },
+);
+
+// model-context — context provided via ui/update-model-context must reach the
+// model on a future turn. The app seeds a secret code, then asks the agent for
+// it; the Runner confirms the agent recalled it in the conversation.
+mcp_test(
+  "model-context/provide-future-turns",
+  "ui/update-model-context reaches the model next turn",
+  async (t: TestContext) => {
+    t.assert(
+      !!t.app.getHostCapabilities()?.updateModelContext,
+      "host does not advertise ui/update-model-context",
+    );
+    t.bindTrigger(async () => {
+      await t.app.updateModelContext({
+        content: [
+          {
+            type: "text",
+            text: `The secret conformance code is ${MODEL_CONTEXT_MARKER}. Remember it for later.`,
+          },
+        ],
+      });
+      await t.app.sendMessage({
+        role: "user",
+        content: [
+          {
+            type: "text",
+            text: "What is the secret conformance code I gave you?",
+          },
+        ],
+      });
+    });
+    await t.host({ kind: "clickTrigger", commitDraftedMessage: true });
+    const r = await t.host({
+      kind: "conversationContains",
+      marker: MODEL_CONTEXT_MARKER,
+      timeoutMs: 120_000,
+    });
+    t.assert(
+      r.ok,
+      "the model did not receive the seeded context on the next turn",
+    );
+  },
+  {
+    clause: "SHOULD",
+    vantage: "host",
+    manual: true,
+    timeoutMs: 0,
+    caveat:
+      "Multi-turn, host-vantage: seeds ui/update-model-context then asks the agent to recall it; confirms the host fed the context to the model on the following turn.",
+  },
+);
diff --git a/examples/conformance-server/src/vite-env.d.ts b/examples/conformance-server/src/vite-env.d.ts
new file mode 100644
index 000000000..11f02fe2a
--- /dev/null
+++ b/examples/conformance-server/src/vite-env.d.ts
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
diff --git a/examples/conformance-server/tsconfig.json b/examples/conformance-server/tsconfig.json
new file mode 100644
index 000000000..fc3c2101f
--- /dev/null
+++ b/examples/conformance-server/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "lib": ["ESNext", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "skipLibCheck": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["src", "server.ts"]
+}
diff --git a/examples/conformance-server/tsconfig.server.json b/examples/conformance-server/tsconfig.server.json
new file mode 100644
index 000000000..05ddd8ec4
--- /dev/null
+++ b/examples/conformance-server/tsconfig.server.json
@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "outDir": "./dist",
+    "rootDir": ".",
+    "strict": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true
+  },
+  "include": ["server.ts"]
+}
diff --git a/examples/conformance-server/vite.config.ts b/examples/conformance-server/vite.config.ts
new file mode 100644
index 000000000..21f2a94ca
--- /dev/null
+++ b/examples/conformance-server/vite.config.ts
@@ -0,0 +1,25 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+import { viteSingleFile } from "vite-plugin-singlefile";
+
+const INPUT = process.env.INPUT;
+if (!INPUT) {
+  throw new Error("INPUT environment variable is not set");
+}
+
+const isDevelopment = process.env.NODE_ENV === "development";
+
+export default defineConfig({
+  plugins: [react(), viteSingleFile()],
+  build: {
+    sourcemap: isDevelopment ? "inline" : undefined,
+    cssMinify: !isDevelopment,
+    minify: !isDevelopment,
+
+    rollupOptions: {
+      input: INPUT,
+    },
+    outDir: "dist",
+    emptyOutDir: false,
+  },
+});
diff --git a/package-lock.json b/package-lock.json
index 26be03f79..a2b8d334e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -51,11 +51,15 @@
       },
       "peerDependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
+        "playwright": "^1.49.0",
         "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0",
         "zod": "^3.25.0 || ^4.0.0"
       },
       "peerDependenciesMeta": {
+        "playwright": {
+          "optional": true
+        },
         "react": {
           "optional": true
         },
@@ -461,6 +465,53 @@
       "dev": true,
       "license": "MIT"
     },
+    "examples/conformance-server": {
+      "name": "@modelcontextprotocol/server-conformance",
+      "version": "1.0.0",
+      "license": "MIT",
+      "dependencies": {
+        "@modelcontextprotocol/ext-apps": "^1.7.4",
+        "@modelcontextprotocol/sdk": "^1.24.0",
+        "cors": "^2.8.5",
+        "express": "^5.1.0",
+        "react": "^19.2.0",
+        "react-dom": "^19.2.0",
+        "zod": "^4.1.13"
+      },
+      "bin": {
+        "mcp-server-conformance": "dist/index.js"
+      },
+      "devDependencies": {
+        "@types/cors": "^2.8.19",
+        "@types/express": "^5.0.0",
+        "@types/node": "22.10.0",
+        "@types/react": "^19.2.2",
+        "@types/react-dom": "^19.2.2",
+        "@vitejs/plugin-react": "^4.3.4",
+        "concurrently": "^9.2.1",
+        "cross-env": "^10.1.0",
+        "typescript": "^5.9.3",
+        "vite": "^6.0.0",
+        "vite-plugin-singlefile": "^2.3.0"
+      }
+    },
+    "examples/conformance-server/node_modules/@types/node": {
+      "version": "22.10.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.10.0.tgz",
+      "integrity": "sha512-XC70cRZVElFHfIUB40FgZOBbgJYFKKMa5nb9lxcwYstFG/Mi+/Y0bGS+rs6Dmhmkpq4pnNiLiuZAbc02YCOnmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.20.0"
+      }
+    },
+    "examples/conformance-server/node_modules/undici-types": {
+      "version": "6.20.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.20.0.tgz",
+      "integrity": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "examples/customer-segmentation-server": {
       "name": "@modelcontextprotocol/server-customer-segmentation",
       "version": "1.7.4",
@@ -2614,9 +2665,9 @@
       "license": "MIT"
     },
     "node_modules/@modelcontextprotocol/ext-apps": {
-      "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/ext-apps/-/ext-apps-1.7.1.tgz",
-      "integrity": "sha512-J3WdG1A4JSSKnSWKyU+895dBVYBV2Utgtf7fUsUK45mlkETm53a/1DR6Pm3hUGKqLLQthZLmpxOg8VPzJi/lyg==",
+      "version": "1.7.4",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/ext-apps/-/ext-apps-1.7.4.tgz",
+      "integrity": "sha512-QQqysE549cf/Y0VabBmAACXhj92EhB3t8yVct2BHbkWiPTFA1S91EqTVjYXXcZEefXU0pmHcdObhsNMcomJIOQ==",
       "license": "MIT",
       "workspaces": [
         "examples/*"
@@ -2629,11 +2680,15 @@
       },
       "peerDependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
+        "playwright": "^1.49.0",
         "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0",
         "zod": "^3.25.0 || ^4.0.0"
       },
       "peerDependenciesMeta": {
+        "playwright": {
+          "optional": true
+        },
         "react": {
           "optional": true
         },
@@ -2722,6 +2777,10 @@
       "resolved": "examples/cohort-heatmap-server",
       "link": true
     },
+    "node_modules/@modelcontextprotocol/server-conformance": {
+      "resolved": "examples/conformance-server",
+      "link": true
+    },
     "node_modules/@modelcontextprotocol/server-customer-segmentation": {
       "resolved": "examples/customer-segmentation-server",
       "link": true
@@ -7356,7 +7415,7 @@
       "version": "1.57.0",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.57.0.tgz",
       "integrity": "sha512-ilYQj1s8sr2ppEJ2YVadYBN0Mb3mdo9J0wQ+UuDhzYqURwSoW4n1Xs5vs7ORwgDGmyEh33tRMeS8KhdkMoLXQw==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "playwright-core": "1.57.0"
@@ -7375,7 +7434,7 @@
       "version": "1.57.0",
       "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.57.0.tgz",
       "integrity": "sha512-agTcKlMw/mjBWOnD6kFZttAAGHgi/Nw0CZ2o6JqWSbMlI219lAFLZZCyqByTsvVAJq5XA5H8cA6PrvBRpBWEuQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
diff --git a/package.json b/package.json
index b49400372..88568147c 100644
--- a/package.json
+++ b/package.json
@@ -38,6 +38,14 @@
       "types": "./dist/src/server/index.d.ts",
       "default": "./dist/src/server/index.js"
     },
+    "./conformance": {
+      "types": "./dist/src/conformance/index.d.ts",
+      "default": "./dist/src/conformance/index.js"
+    },
+    "./conformance/protocol": {
+      "types": "./dist/src/conformance/protocol.d.ts",
+      "default": "./dist/src/conformance/protocol.js"
+    },
     "./schema.json": "./dist/src/generated/schema.json"
   },
   "files": [
@@ -109,11 +117,15 @@
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "playwright": "^1.49.0",
     "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
     "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0",
     "zod": "^3.25.0 || ^4.0.0"
   },
   "peerDependenciesMeta": {
+    "playwright": {
+      "optional": true
+    },
     "react": {
       "optional": true
     },
diff --git a/src/conformance/browser-host.ts b/src/conformance/browser-host.ts
new file mode 100644
index 000000000..0761e2d61
--- /dev/null
+++ b/src/conformance/browser-host.ts
@@ -0,0 +1,386 @@
+import type { BrowserContext, Frame, Page } from "playwright";
+import { chromium } from "playwright";
+import type { Host, SetupOptions, SuiteBridge } from "./host";
+import type { CapabilityResult } from "./protocol";
+import { CHANNEL } from "./protocol";
+import { CLICK_TIMEOUT_MS, PAGE_LOAD_TIMEOUT_MS, sleep } from "./util";
+
+/**
+ * Reusable Playwright plumbing for a browser-based host. A host subclasses this
+ * and implements the three product-specific hooks ({@link BrowserHost.sendPrompt},
+ * {@link BrowserHost.dismissModal}, {@link BrowserHost.verifyConversation}, plus an
+ * optional {@link BrowserHost.commitMessage}); everything else — launch, the
+ * SuiteBridge over `frame.evaluate`, real cross-origin clicks, dialog handling,
+ * per-test isolation — is shared. The conformance app must already be connected
+ * to the target host.
+ *
+ * @example
+ * ```ts source="./index.examples.ts#BrowserHost_subclass"
+ * // Subclass BrowserHost for the host you want to test. Fill in the three hooks for
+ * // YOUR product's UI; everything else (launch, the bridge, real clicks, per-test
+ * // isolation) is shared. The conformance app must already be connected to the host.
+ * export class MyHost extends BrowserHost {
+ *   readonly name = "my-host";
+ *   // The host web app the conformance connector is connected to.
+ *   readonly url = "https://my-host.example/";
+ *   // A selector matching the rendered conformance-app iframe in the host DOM.
+ *   readonly widgetSelector = 'iframe[src*="conformance"]';
+ *
+ *   // Enter a prompt that makes the host render the connected conformance app.
+ *   protected async sendPrompt(page: Page, appName: string): Promise<void> {
+ *     await page.fill("#composer", `run ${appName}`);
+ *     await page.keyboard.press("Enter");
+ *   }
+ *
+ *   // Dismiss cookie/onboarding modals if your host shows them (no-op otherwise).
+ *   protected async dismissModal(_page: Page): Promise<void> {}
+ *
+ *   // Return true once `marker` appears in the host conversation.
+ *   protected async verifyConversation(
+ *     page: Page,
+ *     marker: string,
+ *     _timeoutMs: number,
+ *   ): Promise<boolean> {
+ *     return (await page.textContent("body"))?.includes(marker) ?? false;
+ *   }
+ * }
+ *
+ * ```
+ */
+export abstract class BrowserHost implements Host {
+  abstract readonly name: string;
+  /** The URL of the host web app the conformance connector is connected to. */
+  abstract readonly url: string;
+  /** A selector that matches the rendered conformance-app iframe in the host DOM. */
+  abstract readonly widgetSelector: string;
+
+  private context!: BrowserContext;
+  private page!: Page;
+  private recordVideoDir?: string;
+  private consoleLines: string[] = [];
+
+  /** Enter a prompt in the host that makes it render the conformance app. */
+  protected abstract sendPrompt(page: Page, appName: string): Promise<void>;
+  /** Dismiss any host chrome (cookie/onboarding modals) that blocks the composer. */
+  protected abstract dismissModal(page: Page): Promise<void>;
+  /** Return true once `marker` appears in the host conversation, within `timeoutMs`. */
+  protected abstract verifyConversation(
+    page: Page,
+    marker: string,
+    timeoutMs: number,
+  ): Promise<boolean>;
+  /** Hosts that draft a ui/message into the composer override this to send it. */
+  protected commitMessage?(page: Page): Promise<void>;
+
+  async setup(opts: SetupOptions): Promise<SuiteBridge> {
+    this.recordVideoDir = opts.recordVideoDir;
+    await this.launch(opts.profileDir);
+    await this.page.goto(this.url, { timeout: PAGE_LOAD_TIMEOUT_MS });
+    await sleep(5_000); // SPA hydration
+    await this.dismissModal(this.page);
+    await this.sendPrompt(this.page, opts.appName);
+    await this.waitForWidget();
+    await sleep(8_000); // app init handshake
+    return this.bridge();
+  }
+
+  async teardown(): Promise<void> {
+    if (this.context) await this.context.close(); // finalizes the video
+  }
+
+  async clickTrigger(req: {
+    commitDraftedMessage?: boolean;
+  }): Promise<CapabilityResult> {
+    const ok = await this.realClickTestId("conformance-trigger");
+    if (req.commitDraftedMessage && this.commitMessage) {
+      await this.commitMessage(this.page);
+    }
+    return { ok };
+  }
+
+  async confirmDialog(
+    dialog: "download" | "sampling",
+  ): Promise<CapabilityResult> {
+    const label = { download: "Download", sampling: "Allow" }[dialog];
+    return { ok: await this.clickTopPageButton(label) };
+  }
+
+  // Success is the specific link OPENING, not a dialog: some hosts open directly
+  // with no prompt, others first show an "Open link" consent. app.openLink already
+  // fired (clickTrigger) from inside the iframe, so the tab may already be open;
+  // if not, accept a consent dialog and wait for it. We match THIS url (not just
+  // any new tab) so an unrelated tab can't pass. resetBetweenTests closes it.
+  async checkLinkOpen(url: string): Promise<CapabilityResult> {
+    const target = url.replace(/\/+$/, "");
+    const isTargetTab = () =>
+      this.context
+        .pages()
+        .some(
+          (p) =>
+            p !== this.page &&
+            !p.isClosed() &&
+            p.url().replace(/\/+$/, "").startsWith(target),
+        );
+    if (isTargetTab()) return { ok: true };
+    await this.clickTopPageButton("Open link", 8);
+    const deadline = Date.now() + 10_000;
+    while (Date.now() < deadline) {
+      if (isTargetTab()) return { ok: true };
+      await sleep(500);
+    }
+    return { ok: false };
+  }
+
+  // Read the host page's <iframe> elements — their attributes are readable even
+  // though the frames' content is cross-origin.
+  async inspectFrame(): Promise<CapabilityResult> {
+    const value = await this.page.evaluate(() => {
+      const d = (globalThis as any).document;
+      const frames = Array.from(d.querySelectorAll("iframe")) as any[];
+      const sandboxed = frames.filter((f) => f.hasAttribute("sandbox"));
+      return {
+        total: frames.length,
+        sandboxed: sandboxed.length,
+        firstSandbox: sandboxed[0]?.getAttribute("sandbox") ?? null,
+      };
+    });
+    return { ok: true, value };
+  }
+
+  // Scan the buffered host console (captured since launch) for `pattern`.
+  async readConsole(
+    pattern: string,
+    timeoutMs: number,
+  ): Promise<CapabilityResult> {
+    const re = new RegExp(pattern, "i");
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+      const hit = this.consoleLines.find((l) => re.test(l));
+      if (hit) return { ok: true, value: hit };
+      if (Date.now() >= deadline) return { ok: false };
+      await sleep(500);
+    }
+  }
+
+  async conversationContains(
+    marker: string,
+    timeoutMs: number,
+  ): Promise<CapabilityResult> {
+    return { ok: await this.verifyConversation(this.page, marker, timeoutMs) };
+  }
+
+  async toggleTheme(to: "light" | "dark"): Promise<CapabilityResult> {
+    await this.page.emulateMedia({ colorScheme: to });
+    return { ok: true };
+  }
+
+  async resetBetweenTests(): Promise<void> {
+    await this.page.bringToFront();
+    await this.clearHostOverlay();
+    // A real click reverts the display mode to inline; hosts gate display-mode
+    // changes on a user gesture, so a programmatic reset alone won't work.
+    await this.realClickTestId("reset-inline");
+    await this.page.emulateMedia({ colorScheme: "light" }); // deterministic start theme
+  }
+
+  // headless MUST stay off: headless Chromium drops cross-origin MessagePort
+  // transfers, which breaks the ext-apps init handshake.
+  private async launch(profileDir: string): Promise<void> {
+    this.context = await chromium.launchPersistentContext(profileDir, {
+      channel: "chrome",
+      headless: false,
+      viewport: null, // let the page track the real OS window (scroll/resize/login)
+      args: [
+        "--disable-blink-features=AutomationControlled", // navigator.webdriver trips bot checks
+        "--disable-popup-blocking",
+        "--window-size=1440,1000",
+      ],
+      recordVideo: this.recordVideoDir
+        ? { dir: this.recordVideoDir, size: { width: 1280, height: 720 } }
+        : undefined,
+    });
+    const pages = this.context.pages();
+    this.page = pages.length ? pages[0] : await this.context.newPage();
+    this.page.on("console", (m) => this.consoleLines.push(m.text()));
+  }
+
+  private bridge(): SuiteBridge {
+    return {
+      listTests: async () => {
+        const frame = await this.appFrame();
+        return frame.evaluate((k) => globalThis[k]!.listTests(), CHANNEL);
+      },
+      start: async (filter) => {
+        const frame = await this.appFrame();
+        await frame.evaluate(([k, f]) => globalThis[k]?.start(f), [
+          CHANNEL,
+          filter ?? null,
+        ] as [typeof CHANNEL, { manual?: boolean; id?: string } | null]);
+      },
+      poll: async () => {
+        const frame = await this.appFrame();
+        return frame.evaluate((k) => globalThis[k]!.poll(), CHANNEL);
+      },
+      resolve: async (result) => {
+        const frame = await this.appFrame();
+        await frame.evaluate(([k, r]) => globalThis[k]!.resolve(r), [
+          CHANNEL,
+          result,
+        ] as [typeof CHANNEL, CapabilityResult]);
+      },
+    };
+  }
+
+  // The frame running the in-iframe suite (the one that set window[CHANNEL]).
+  // Scanning all frames finds it at any nesting depth — the widget-iframe
+  // selector alone can miss it (deeper nesting, multiple matching iframes).
+  private async appFrame(): Promise<Frame> {
+    for (const frame of this.page.frames()) {
+      if (frame === this.page.mainFrame()) continue;
+      try {
+        if (await frame.evaluate((k) => Boolean(globalThis[k]), CHANNEL)) {
+          return frame;
+        }
+      } catch {}
+    }
+    throw new Error(`app frame not found (no window[${CHANNEL}])`);
+  }
+
+  // Real, trusted cross-origin click on a widget button by data-testid.
+  // Gesture-gated effects only fire under a genuine click, so this — not
+  // postMessage — drives the triggers.
+  private async realClickTestId(testid: string): Promise<boolean> {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      // Prefer the frame with a pending interaction (the live app instance) so
+      // we don't click a stale/detached frame left by a fullscreen remount.
+      const frames = this.page
+        .frames()
+        .filter((f) => f !== this.page.mainFrame());
+      const scored: Array<[Frame, boolean]> = [];
+      for (const frame of frames)
+        scored.push([frame, await this.frameIsLiveApp(frame)]);
+      scored.sort((a, b) => Number(b[1]) - Number(a[1]));
+      for (const [frame] of scored) {
+        try {
+          const btn = frame.getByTestId(testid);
+          if (await btn.count()) {
+            await btn.first().click({ timeout: CLICK_TIMEOUT_MS });
+            return true;
+          }
+        } catch {}
+      }
+      await sleep(1_000); // a remounting frame; rescan
+    }
+    return false;
+  }
+
+  // True if this frame is the app instance with a pending interaction — the
+  // live suite showing the scrim, not a stale/duplicate frame from a remount.
+  private async frameIsLiveApp(frame: Frame): Promise<boolean> {
+    try {
+      return await frame.evaluate((k) => {
+        const s = globalThis[k]?.poll();
+        return Boolean(s && s.state === "running" && s.request);
+      }, CHANNEL);
+    } catch {
+      return false;
+    }
+  }
+
+  // Click a control by exact text in a host permission dialog. Role varies:
+  // some hosts render "Open link" as a <button>, others as an <a> — match either.
+  protected async clickTopPageButton(
+    label: string,
+    timeoutSeconds = 20,
+  ): Promise<boolean> {
+    const deadline = Date.now() + timeoutSeconds * 1_000;
+    while (Date.now() < deadline) {
+      const candidates = [
+        this.page.getByRole("button", { name: label, exact: true }),
+        this.page.getByRole("link", { name: label, exact: true }),
+        this.page.getByText(label, { exact: true }),
+      ];
+      for (const loc of candidates) {
+        try {
+          if (await loc.count()) {
+            await loc.first().click({ timeout: CLICK_TIMEOUT_MS });
+            return true;
+          }
+        } catch {}
+      }
+      await sleep(1_000);
+    }
+    return false;
+  }
+
+  // Leave a clean page for the next test: a prior test's host dialog leaves a
+  // backdrop that intercepts the next trigger click, and open-link opens a new
+  // tab. Close stray tabs and Escape any lingering modal.
+  private async clearHostOverlay(): Promise<void> {
+    for (const p of this.context.pages()) {
+      if (p !== this.page && !p.isClosed()) {
+        try {
+          await p.close();
+        } catch {
+          /* already gone */
+        }
+      }
+    }
+    for (let i = 0; i < 3; i++) {
+      let present: boolean;
+      try {
+        present = await this.page.evaluate(() =>
+          Boolean(
+            (globalThis as any).document.querySelector(
+              "[role=dialog],[aria-modal=true]",
+            ),
+          ),
+        );
+      } catch {
+        return;
+      }
+      if (!present) return;
+      try {
+        await this.page.keyboard.press("Escape");
+      } catch {
+        return;
+      }
+      await sleep(600);
+    }
+  }
+
+  private async waitForWidget(
+    timeoutSeconds = 90,
+    pollMs = 3_000,
+  ): Promise<void> {
+    const deadline = Date.now() + timeoutSeconds * 1_000;
+    while (Date.now() < deadline) {
+      if (await this.page.locator(this.widgetSelector).count()) return;
+      await sleep(pollMs);
+    }
+    throw new Error(`widget iframe did not appear within ${timeoutSeconds}s`);
+  }
+
+  // Poll a browser-side predicate that returns "found" once the marker lands.
+  // The host snapshot can lag the dispatched turn by tens of seconds.
+  protected async pollMarker(
+    page: Page,
+    fn: (marker: string) => string | Promise<string>,
+    marker: string,
+    timeoutMs: number,
+    pollMs: number,
+  ): Promise<boolean> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      let status: string;
+      try {
+        status = (await page.evaluate(fn, marker)) as string;
+      } catch (err) {
+        status = `error: ${err}`;
+      }
+      if (status === "found") return true;
+      await sleep(pollMs);
+    }
+    return false;
+  }
+}
diff --git a/src/conformance/host.ts b/src/conformance/host.ts
new file mode 100644
index 000000000..c94947173
--- /dev/null
+++ b/src/conformance/host.ts
@@ -0,0 +1,51 @@
+import type { CapabilityResult, SuitePoll, TestMeta } from "./protocol";
+
+/** Options passed to {@link Host.setup}. */
+export interface SetupOptions {
+  /** The app/connector name a host uses to render the conformance app. */
+  appName: string;
+  /** A persistent profile directory (so a login is reused across runs). */
+  profileDir: string;
+  /** If set, the host records the session video into this directory. */
+  recordVideoDir?: string;
+}
+
+/**
+ * The Runner's platform-agnostic handle to the in-iframe TestSuite. A browser
+ * host implements this over `frame.evaluate`; a desktop host substitutes its own
+ * transport (IPC / a socket to the app process) behind the same interface.
+ */
+export interface SuiteBridge {
+  listTests(): Promise<TestMeta[]>;
+  start(filter?: { manual?: boolean; id?: string }): Promise<void>;
+  poll(): Promise<SuitePoll>;
+  resolve(result: CapabilityResult): Promise<void>;
+}
+
+/**
+ * A host the Runner drives. Only {@link Host.setup} and {@link Host.teardown} are
+ * required; every capability method is OPTIONAL — an absent method means the host
+ * cannot perform that capability, so the Runner returns `{ unsupported: true }`
+ * and the affected test skips (or falls back to another capability).
+ */
+export interface Host {
+  readonly name: string;
+  /** Open the app, prompt the agent so the conformance app renders, and return a bridge to it. */
+  setup(opts: SetupOptions): Promise<SuiteBridge>;
+  teardown(): Promise<void>;
+
+  clickTrigger?(req: {
+    commitDraftedMessage?: boolean;
+  }): Promise<CapabilityResult>;
+  confirmDialog?(dialog: "download" | "sampling"): Promise<CapabilityResult>;
+  checkLinkOpen?(url: string): Promise<CapabilityResult>;
+  conversationContains?(
+    marker: string,
+    timeoutMs: number,
+  ): Promise<CapabilityResult>;
+  toggleTheme?(to: "light" | "dark"): Promise<CapabilityResult>;
+  readModelToolList?(): Promise<CapabilityResult>;
+  inspectFrame?(): Promise<CapabilityResult>;
+  readConsole?(pattern: string, timeoutMs: number): Promise<CapabilityResult>;
+  resetBetweenTests?(): Promise<void>;
+}
diff --git a/src/conformance/index.examples.ts b/src/conformance/index.examples.ts
new file mode 100644
index 000000000..228f4230d
--- /dev/null
+++ b/src/conformance/index.examples.ts
@@ -0,0 +1,51 @@
+import type { Page } from "playwright";
+import { BrowserHost, Runner, type SubtestResult } from "./index";
+
+//#region BrowserHost_subclass
+// Subclass BrowserHost for the host you want to test. Fill in the three hooks for
+// YOUR product's UI; everything else (launch, the bridge, real clicks, per-test
+// isolation) is shared. The conformance app must already be connected to the host.
+export class MyHost extends BrowserHost {
+  readonly name = "my-host";
+  // The host web app the conformance connector is connected to.
+  readonly url = "https://my-host.example/";
+  // A selector matching the rendered conformance-app iframe in the host DOM.
+  readonly widgetSelector = 'iframe[src*="conformance"]';
+
+  // Enter a prompt that makes the host render the connected conformance app.
+  protected async sendPrompt(page: Page, appName: string): Promise<void> {
+    await page.fill("#composer", `run ${appName}`);
+    await page.keyboard.press("Enter");
+  }
+
+  // Dismiss cookie/onboarding modals if your host shows them (no-op otherwise).
+  protected async dismissModal(_page: Page): Promise<void> {}
+
+  // Return true once `marker` appears in the host conversation.
+  protected async verifyConversation(
+    page: Page,
+    marker: string,
+    _timeoutMs: number,
+  ): Promise<boolean> {
+    return (await page.textContent("body"))?.includes(marker) ?? false;
+  }
+}
+//#endregion BrowserHost_subclass
+
+//#region conformance_runSuite
+export async function runConformance(): Promise<SubtestResult[]> {
+  const host = new MyHost();
+  const runner = new Runner(host, {
+    appName: "Conformance",
+    profileDir: ".profile", // persist login across runs
+  });
+  const results = await runner.run();
+  for (const r of results) {
+    const detail = r.message ? ` — ${r.message}` : "";
+    console.log(`${r.status.padEnd(7)} ${r.id}${detail}`);
+  }
+  return results;
+}
+//#endregion conformance_runSuite
+
+export {};
diff --git a/src/conformance/index.ts b/src/conformance/index.ts
new file mode 100644
index 000000000..55deff9ba
--- /dev/null
+++ b/src/conformance/index.ts
@@ -0,0 +1,38 @@
+/**
+ * @module
+ * Conformance test runner for MCP Apps hosts. Import this (dev-only) to drive the
+ * conformance app against a host and get structured pass/fail results:
+ *
+ * - {@link Host} / {@link SuiteBridge} / {@link SetupOptions} — the host interface
+ *   the {@link Runner} drives, and the bridge to the in-iframe suite.
+ * - {@link BrowserHost} — reusable Playwright plumbing; subclass it for your host.
+ * - {@link Runner} — a generic dispatcher that returns {@link SubtestResult}[].
+ * - protocol types ({@link CapabilityRequest}, {@link SubtestResult}, …).
+ *
+ * The conformance app itself must already be connected to the target host (self-host
+ * the `conformance-server` example, or any deployment of it). Playwright is an
+ * optional peer dependency — add `playwright` to your devDependencies to use
+ * {@link BrowserHost}.
+ *
+ * @example
+ * ```ts source="./index.examples.ts#conformance_runSuite"
+ * export async function runConformance(): Promise<SubtestResult[]> {
+ *   const host = new MyHost();
+ *   const runner = new Runner(host, {
+ *     appName: "Conformance",
+ *     profileDir: ".profile", // persist login across runs
+ *   });
+ *   const results = await runner.run();
+ *   for (const r of results) {
+ *     const detail = r.message ? ` — ${r.message}` : "";
+ *     console.log(`${r.status.padEnd(7)} ${r.id}${detail}`);
+ *   }
+ *   return results;
+ * }
+ *
+ * ```
+ */
+export * from "./protocol";
+export * from "./host";
+export * from "./browser-host";
+export * from "./runner";
diff --git a/src/conformance/protocol.ts b/src/conformance/protocol.ts
new file mode 100644
index 000000000..8cd84b26d
--- /dev/null
+++ b/src/conformance/protocol.ts
@@ -0,0 +1,115 @@
+/**
+ * @module
+ * Conformance protocol — the contract shared by the in-iframe TestSuite (the
+ * conformance app View) and the external {@link Runner}. Types only + the window
+ * channel name, so it stays free of any platform (DOM or Node) dependency and can
+ * be imported from both a browser bundle and a Node driver.
+ */
+
+export type Status = "PASS" | "FAIL" | "TIMEOUT" | "SKIP" | "NOTRUN";
+export type Clause =
+  | "MUST"
+  | "MUST NOT"
+  | "SHOULD"
+  | "SHOULD NOT"
+  | "MAY"
+  | "REQUIRED";
+export type Vantage = "in-view" | "host" | "server";
+
+export interface SubtestResult {
+  id: string;
+  name: string;
+  status: Status;
+  vantage: Vantage;
+  manual: boolean;
+  clause?: Clause;
+  caveat?: string;
+  message?: string;
+  value?: unknown;
+  durationMs: number;
+}
+
+export interface TestMeta {
+  id: string;
+  name: string;
+  vantage: Vantage;
+  manual: boolean;
+  clause?: Clause;
+  caveat?: string;
+}
+
+/**
+ * One variant per primitive a host can perform. Kept deliberately minimal — the
+ * test carries the semantics (e.g. absence is expressed by the test negating a
+ * `conversationContains` result, not by a dedicated variant).
+ */
+export type CapabilityRequest =
+  // Fire the in-iframe trigger button with a REAL cross-origin click (user
+  // activation). `commitDraftedMessage` sends a ui/message a host drafted into
+  // its composer instead of sending directly.
+  | { kind: "clickTrigger"; commitDraftedMessage?: boolean }
+  // Accept a host-native permission dialog surfaced after the trigger.
+  | { kind: "confirmDialog"; dialog: "download" | "sampling" }
+  // Verify a ui/open-link opened THIS url (a new tab at it), accepting a consent
+  // dialog if the host shows one — some hosts open directly with no dialog.
+  | { kind: "checkLinkOpen"; url: string }
+  // Poll the host conversation for a marker (negated by the test when the test
+  // needs the marker to be ABSENT).
+  | { kind: "conversationContains"; marker: string; timeoutMs: number }
+  // Flip the host theme (browser host: emulated OS color-scheme).
+  | { kind: "toggleTheme"; to: "light" | "dark" }
+  // Optional desktop-host affordance: the tool names in the model's context.
+  // Unimplemented on browser hosts → unsupported (tests fall back).
+  | { kind: "readModelToolList" }
+  // Operator reads the host page's <iframe> elements (sandbox/allow/csp attrs +
+  // counts) — the sandboxed View can't observe these about itself.
+  | { kind: "inspectFrame" }
+  // Operator scans the host browser console for a line matching `pattern`.
+  | { kind: "readConsole"; pattern: string; timeoutMs: number }
+  // Per-manual-test isolation, emitted by the suite's manual wrapper (not by
+  // test authors).
+  | { kind: "resetIsolation" };
+
+export interface CapabilityResult {
+  ok: boolean;
+  value?: unknown;
+  error?: string;
+  /** The host does not provide this capability; the test skips or falls back. */
+  unsupported?: boolean;
+}
+
+/** What the Runner sees when it polls the in-iframe suite. */
+export type SuitePoll =
+  | { state: "idle" }
+  | {
+      state: "running";
+      runningId: string;
+      request: CapabilityRequest | null;
+      results: SubtestResult[];
+    }
+  | { state: "done"; results: SubtestResult[] };
+
+/** The property the TestSuite installs on `window` for the Runner to reach it. */
+export const CHANNEL = "__mcpConformance" as const;
+
+/**
+ * The in-iframe channel the Runner calls (via `frame.evaluate` for a browser
+ * host, or any other transport for a desktop host). The TestSuite pulls (a test
+ * awaits a request result); the Runner polls this snapshot and resolves.
+ */
+export interface InIframeChannel {
+  listTests(): TestMeta[];
+  // `null` is accepted, not just absent: the Runner sends the filter across
+  // `frame.evaluate`, and Playwright serializes `undefined` → `null` on the wire.
+  start(filter?: { manual?: boolean; id?: string } | null): void;
+  poll(): SuitePoll;
+  resolve(result: CapabilityResult): void;
+}
+
+declare global {
+  // The TestSuite installs the channel here (browser: `window[CHANNEL]`); the
+  // Runner reaches it via `frame.evaluate`. Declared globally so the in-browser
+  // `evaluate` callbacks can read `globalThis.__mcpConformance` without a cast.
+  // eslint-disable-next-line no-var
+  var __mcpConformance: InIframeChannel | undefined;
+}
diff --git a/src/conformance/runner.ts b/src/conformance/runner.ts
new file mode 100644
index 000000000..9e6e58026
--- /dev/null
+++ b/src/conformance/runner.ts
@@ -0,0 +1,104 @@
+import type { Host } from "./host";
+import type {
+  CapabilityRequest,
+  CapabilityResult,
+  SubtestResult,
+} from "./protocol";
+import { sleep } from "./util";
+
+const unsupported = (): CapabilityResult => ({ ok: false, unsupported: true });
+
+// If the suite neither settles nor issues a request for this long, something is
+// wedged (a stuck host dialog, a dead frame) — fail loudly rather than hang.
+const STALL_MS = 5 * 60_000;
+
+/**
+ * Platform-agnostic orchestrator. It knows nothing about individual tests: it
+ * pulls the in-iframe suite's pending CapabilityRequest, dispatches it to the
+ * Host, feeds the result back, and repeats until the suite reports `done`. The
+ * dispatch is exhaustive over the protocol kinds — fixed regardless of test count.
+ */
+export class Runner {
+  constructor(
+    private readonly host: Host,
+    private readonly opts: {
+      appName: string;
+      profileDir: string;
+      recordVideoDir?: string;
+    },
+    private readonly pollMs = 800,
+  ) {}
+
+  async run(filter?: {
+    manual?: boolean;
+    id?: string;
+  }): Promise<SubtestResult[]> {
+    const bridge = await this.host.setup(this.opts);
+    try {
+      await bridge.start(filter);
+      let lastProgress = Date.now();
+      let signature = "";
+      for (;;) {
+        const p = await bridge.poll();
+        if (p.state === "done") return p.results;
+
+        if (p.state === "running" && p.request) {
+          await bridge.resolve(await this.dispatch(p.request));
+          lastProgress = Date.now();
+          signature = "";
+          continue;
+        }
+
+        // No request to service yet (auto tests settling in-iframe). Watch for a
+        // stall: progress = the running id or result count changing.
+        const next =
+          p.state === "running"
+            ? `${p.runningId}:${p.results.length}`
+            : p.state;
+        if (next !== signature) {
+          signature = next;
+          lastProgress = Date.now();
+        } else if (Date.now() - lastProgress > STALL_MS) {
+          throw new Error(
+            `conformance suite stalled (${signature || "idle"}) for ${STALL_MS}ms`,
+          );
+        }
+        await sleep(this.pollMs);
+      }
+    } finally {
+      await this.host.teardown();
+    }
+  }
+
+  private dispatch(req: CapabilityRequest): Promise<CapabilityResult> {
+    const h = this.host;
+    switch (req.kind) {
+      case "clickTrigger":
+        return h.clickTrigger?.(req) ?? Promise.resolve(unsupported());
+      case "confirmDialog":
+        return h.confirmDialog?.(req.dialog) ?? Promise.resolve(unsupported());
+      case "checkLinkOpen":
+        return h.checkLinkOpen?.(req.url) ?? Promise.resolve(unsupported());
+      case "conversationContains":
+        return (
+          h.conversationContains?.(req.marker, req.timeoutMs) ??
+          Promise.resolve(unsupported())
+        );
+      case "toggleTheme":
+        return h.toggleTheme?.(req.to) ?? Promise.resolve(unsupported());
+      case "readModelToolList":
+        return h.readModelToolList?.() ?? Promise.resolve(unsupported());
+      case "inspectFrame":
+        return h.inspectFrame?.() ?? Promise.resolve(unsupported());
+      case "readConsole":
+        return (
+          h.readConsole?.(req.pattern, req.timeoutMs) ??
+          Promise.resolve(unsupported())
+        );
+      case "resetIsolation":
+        return h.resetBetweenTests
+          ? h.resetBetweenTests().then(() => ({ ok: true }))
+          : Promise.resolve(unsupported());
+    }
+  }
+}
diff --git a/src/conformance/util.ts b/src/conformance/util.ts
new file mode 100644
index 000000000..d02c367b6
--- /dev/null
+++ b/src/conformance/util.ts
@@ -0,0 +1,5 @@
+export const CLICK_TIMEOUT_MS = 12_000;
+export const PAGE_LOAD_TIMEOUT_MS = 30_000;
+
+export const sleep = (ms: number): Promise<void> =>
+  new Promise((resolve) => setTimeout(resolve, ms));
diff --git a/tests/e2e/generate-grid-screenshots.spec.ts b/tests/e2e/generate-grid-screenshots.spec.ts
index bbe895927..17ae8453d 100644
--- a/tests/e2e/generate-grid-screenshots.spec.ts
+++ b/tests/e2e/generate-grid-screenshots.spec.ts
@@ -57,6 +57,11 @@ const ALL_SERVERS = [
     name: "Customer Segmentation Server",
     dir: "customer-segmentation-server",
   },
+  {
+    key: "conformance-server",
+    name: "MCP Apps Conformance Server",
+    dir: "conformance-server",
+  },
   { key: "debug-server", name: "Debug MCP App Server", dir: "debug-server" },
   { key: "map-server", name: "CesiumJS Map Server", dir: "map-server" },
   { key: "pdf-server", name: "PDF Server", dir: "pdf-server" },
diff --git a/tests/e2e/servers.spec.ts b/tests/e2e/servers.spec.ts
index a3c30d8a8..a5b3fe0d9 100644
--- a/tests/e2e/servers.spec.ts
+++ b/tests/e2e/servers.spec.ts
@@ -116,6 +116,11 @@ const ALL_SERVERS = [
     name: "Customer Segmentation Server",
     dir: "customer-segmentation-server",
   },
+  {
+    key: "conformance-server",
+    name: "MCP Apps Conformance Server",
+    dir: "conformance-server",
+  },
   { key: "debug-server", name: "Debug MCP App Server", dir: "debug-server" },
   { key: "map-server", name: "CesiumJS Map Server", dir: "map-server" },
   { key: "pdf-server", name: "PDF Server", dir: "pdf-server" },
diff --git a/tests/e2e/servers.spec.ts-snapshots/conformance-server.png b/tests/e2e/servers.spec.ts-snapshots/conformance-server.png
new file mode 100644
index 000000000..813a444a3
Binary files /dev/null and b/tests/e2e/servers.spec.ts-snapshots/conformance-server.png differ