test: three pins that leaned on the old CORS default name their configuration

The runtime metrics pin configured '*' with credentials, which the transport
now refuses at boot; it names the origin its preflight carries. Two
http-conformance parity pins compared the doors' CORS headers by accident;
both doors now run with CORS off, as the suite's other parity pins do.

Claude-Session: https://claude.ai/code/session_01LmjU2x1faLZ39DVTFyVca6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/qa/http-conformance/src/hono-approvals-act.conformance.test.ts

@@ -91,7 +91,9 @@ async function bootKernel(opts: { selfHosted: boolean; approvals?: boolean }) {
     const kernel = new ObjectKernel({ logger: { level: 'silent' } } as any);
     liveKernels.push(kernel);
     await kernel.use(new ObjectQLPlugin());
-    if (opts.selfHosted) await kernel.use(new HonoServerPlugin({ port: 0 }));
+    // CORS off at both doors, as on the suite's other parity pins: it is transport
+    // policy each door configures on its own, and not what these pins compare.
+    if (opts.selfHosted) await kernel.use(new HonoServerPlugin({ port: 0, cors: false }));
     await kernel.use(new AutomationStub());
     if (opts.approvals !== false) await kernel.use(new ApprovalsServicePlugin());
     await kernel.bootstrap();
@@ -139,7 +141,7 @@ async function hostedDoor(opts: { approvals?: boolean } = {}) {
     let server: unknown;
     try { server = kernel.getService<unknown>('http.server'); } catch { server = undefined; }
     expect(server, 'the hosted shape owns no socket').toBeUndefined();
-    const app = createHonoApp({ kernel: kernel as any, prefix: PREFIX });
+    const app = createHonoApp({ kernel: kernel as any, prefix: PREFIX, cors: false });
     return {
         kernel,
         openWithTokens,

packages/qa/http-conformance/src/hono-webhooks-redeliver.conformance.test.ts

@@ -139,7 +139,9 @@ async function bootKernel(opts: { selfHosted: boolean; webhooks?: boolean; guard
     const kernel = new LiteKernel({ logger: { level: 'silent' } } as any);
     liveKernels.push(kernel);
     const fixture = new FixturePlugin(opts.guardable !== false);
-    if (opts.selfHosted) kernel.use(new HonoServerPlugin({ port: 0 }));
+    // CORS off at both doors, as on the suite's other parity pins: it is transport
+    // policy each door configures on its own, and not what these pins compare.
+    if (opts.selfHosted) kernel.use(new HonoServerPlugin({ port: 0, cors: false }));
     kernel.use(fixture);
     if (opts.webhooks !== false) kernel.use(new WebhookOutboxPlugin());
     await kernel.bootstrap();
@@ -190,7 +192,7 @@ async function hostedDoor(opts: { webhooks?: boolean; guardable?: boolean } = {}
     let server: unknown;
     try { server = booted.kernel.getService<unknown>('http.server'); } catch { server = undefined; }
     expect(server, 'the hosted shape owns no socket').toBeUndefined();
-    const app = createHonoApp({ kernel: booted.kernel as any, prefix: PREFIX });
+    const app = createHonoApp({ kernel: booted.kernel as any, prefix: PREFIX, cors: false });
     return { ...booted, send: (init: RequestInit, path = PATH) => app.request(`http://tenant.example${path}`, init) };
 }
 

packages/runtime/src/http-metrics-inbound-coverage.hono.integration.test.ts

@@ -604,7 +604,10 @@ describe('#9650 §4 — the transport seam that was ruled, and its edges', () =>
         kernel.use(
             new HonoServerPlugin({
                 port: 0,
-                cors: { enabled: true, origins: '*' },
+                // The origin the preflight below carries, named: the CORS
+                // built-in refuses `'*'` while credentials are on, and an
+                // admitted preflight is the one it answers on the way in.
+                cors: { enabled: true, origins: ['https://app.test'] },
                 observability: { metrics },
             }),
         );