zip v1.24.1: tests stop reaching through fiber, so they see what serving installs

Upstream landed the v1.23 verb migration (Graft/Add/Mount folded into Use). This
is the half that was missing, and it is the half that made tests lie.

App.Test used to skip prepare, which installs the deferred projections — /mcp, the
OpenAPI document, the op-call plane, the plugin route. So those four addresses
answered 404 under test and 200 in production, and the papering-over was an
exported Prepare each caller had to remember. zip v1.24.1 makes Test prepare;
apps/ai's MCP door test passes because of that, not because of anything here.

414 call sites move from app.Fiber().Test(...) to app.Test(...) with
zip.TestConfig. That is the point of the escape hatch living on the concrete type:
reaching through it bypasses what App.Test does, so the tests most wanting to
exercise the real program were the ones that did not. Sites whose receiver is a
raw fiber app keep fiber's type — the two are not interchangeable and pretending
otherwise is how the first sweep broke things.

Also: the multi-line `Use(func(c *zip.Ctx) error {…})` literals in tests, which
the verb migration missed because they fail vet rather than build; and the last
`.Prepare()` calls, now that it is implicit.

iam v1.34.11 → v1.34.12.

Measured against upstream on the same host: 103 failing packages before, 97 after
— ZERO new, 6 fixed. The remainder is the macOS SQLCipher limit (no tmpfs for the
pure-Go codec), unrelated and unchanged.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

agency_test.go

@@ -67,7 +67,7 @@ func TestCredentialClass_ReadsTheCredentialNotTheClient(t *testing.T) {
 			if tc.ua != "" {
 				req.Header.Set("User-Agent", tc.ua)
 			}
-			if _, err := app.Fiber().Test(req); err != nil {
+			if _, err := app.Test(req); err != nil {
 				t.Fatal(err)
 			}
 			if got != tc.want {
@@ -148,7 +148,7 @@ func TestCredentialClass_UsesTheBoundarysOwnResolution(t *testing.T) {
 			req.Header.Set("X-Org-Id", "acme")
 			req.Header.Set("X-User-Id", "u-acme")
 			tc.set(req)
-			if _, err := app.Fiber().Test(req); err != nil {
+			if _, err := app.Test(req); err != nil {
 				t.Fatal(err)
 			}
 			if class != tc.wantClass {

apps/account/account_test.go

@@ -40,7 +40,7 @@ type fakeIAM struct {
 	// rows is every row update-user was asked to write, whole. movedTo keeps only
 	// the owner, which is all the onboarding move needed; the profile photo is a
 	// different field of the same write, so the row itself is what a test must see.
-	rows []map[string]any
+	rows        []map[string]any
 	createdOrgs []map[string]any
 	failAddOrg  bool // when true, add-organization answers status!=ok
 	failMintKey bool
@@ -286,7 +286,7 @@ func callH(t *testing.T, app *zip.App, method, path string, headers map[string]s
 			req.Header.Set(k, v)
 		}
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -314,7 +314,7 @@ func call(t *testing.T, app *zip.App, method, path, user, org, body string) (int
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -566,7 +566,7 @@ func TestKeys_DirectBearerPath_MintsByUsernameNotUUID(t *testing.T) {
 	req.Header.Set("X-User-Id", uuid)  // direct-path stamp: the subject UUID
 	req.Header.Set("X-User-Name", "z") // direct-path stamp: the IAM username
 	req.Header.Set("X-Org-Id", "hanzo")
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/account/avatar_test.go

@@ -170,7 +170,7 @@ func upload(t *testing.T, app *zip.App, user, org, filename string, data []byte)
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST /v1/avatar: %v", err)
 	}
@@ -182,7 +182,7 @@ func upload(t *testing.T, app *zip.App, user, org, filename string, data []byte)
 // fetch drives the read route with NO credentials, which is how an <img> loads it.
 func fetch(t *testing.T, app *zip.App, path string) (*http.Response, []byte) {
 	t.Helper()
-	resp, err := app.Fiber().Test(httptest.NewRequest(http.MethodGet, path, nil))
+	resp, err := app.Test(httptest.NewRequest(http.MethodGet, path, nil))
 	if err != nil {
 		t.Fatalf("Test GET %s: %v", path, err)
 	}

apps/account/csrf_test.go

@@ -25,7 +25,7 @@ func req(t *testing.T, app *zip.App, method, path string, hdr map[string]string,
 	for k, v := range hdr {
 		r.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(r)
+	resp, err := app.Test(r)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/admin/audit/audit_test.go

@@ -212,7 +212,7 @@ func TestAdminAudit_VerifyWithoutStore(t *testing.T) {
 	for k, v := range superAdmin {
 		req.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(req, fiber.TestConfig{Timeout: 30 * time.Second})
+	resp, err := app.Test(req, zip.TestConfig{Timeout: 30 * time.Second})
 	if err != nil {
 		t.Fatalf("verify: %v", err)
 	}

apps/admin/core/grant_address_test.go

@@ -64,7 +64,7 @@ func TestGrantIdempotencyKeyBindsTheSubject(t *testing.T) {
 		})
 		req := httptest.NewRequest("GET", "/k", nil)
 		req.Header.Set("Idempotency-Key", "one-nonce")
-		resp, err := app.Fiber().Test(req)
+		resp, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("key probe: %v", err)
 		}

apps/admission/approval_test.go

@@ -27,7 +27,7 @@ func ctxWith(t *testing.T, headers map[string]string, fn func(c *zip.Ctx)) {
 	for k, v := range headers {
 		hr.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(hr)
+	resp, err := app.Test(hr)
 	if err != nil {
 		t.Fatalf("probe: %v", err)
 	}

apps/admission/middleware_test.go

@@ -79,7 +79,7 @@ func drive(t *testing.T, app *zip.App, r greq) (int, string) {
 	if r.apiKeyHeader != "" {
 		hr.Header.Set("api-key", r.apiKeyHeader)
 	}
-	resp, err := app.Fiber().Test(hr)
+	resp, err := app.Test(hr)
 	if err != nil {
 		t.Fatalf("drive: %v", err)
 	}

apps/admission/waitlist_route_test.go

@@ -39,7 +39,7 @@ func ask(t *testing.T, app *zip.App, url, hostHeader string) waitlistModeView {
 	if hostHeader != "" {
 		req.Host = hostHeader
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s: %v", url, err)
 	}

apps/ads/typed_wire_test.go

@@ -65,7 +65,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body []byte) (int,
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u_"+org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/affiliates/affiliates_test.go

@@ -17,7 +17,6 @@ import (
 	// test process has no KMS.
 	_ "github.com/hanzoai/cloud/internal/devmaster"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -131,7 +130,7 @@ func req(t *testing.T, app *zip.App, method, path, org string, admin bool, body
 	// A generous ceiling: a correct request completes in well under 100ms, so 30s
 	// never fires spuriously — it only guards a genuine hang. The fiber default is 1s,
 	// which flakes under CI/machine load, not on request latency.
-	resp, err := app.Fiber().Test(hr, fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
+	resp, err := app.Test(hr, zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -862,7 +861,7 @@ func TestMount(t *testing.T) {
 	t.Cleanup(func() { _ = Shutdown() })
 	// A no-principal GET is refused 403 (proves the route is bound + gated).
 	r := httptest.NewRequest(http.MethodGet, "/v1/affiliates", nil)
-	resp, err := app.Fiber().Test(r, fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
+	resp, err := app.Test(r, zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/agent/agent.go

@@ -19,6 +19,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	fiber "github.com/zap-proto/fiber/v3"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -28,7 +29,6 @@ import (
 	"github.com/hanzoai/cloud/apps/tools"
 	"github.com/hanzoai/cloud/openapi"
 	openai "github.com/hanzoai/go-openai"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 

apps/agents/billing_test.go

@@ -252,7 +252,7 @@ func TestRunRequiresValidatedPrincipal(t *testing.T) {
 	// A raw run request carrying ONLY X-Org-Id (no X-User-Id) must be 403.
 	req := httptest.NewRequest(http.MethodPost, "/v1/agents/a/run", nil)
 	req.Header.Set("X-Org-Id", "acme") // forged/unvalidated org, no principal
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/agents/http_test.go

@@ -69,7 +69,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body any) (int, []
 		// the gateway would. Empty org => no user (the anonymous 403 path).
 		req.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/agents/routing_http_test.go

@@ -23,7 +23,7 @@ func doKey(t *testing.T, app *zip.App, method, path, org, key string) (int, []by
 	if key != "" {
 		req.Header.Set(claimKeyHeader, key)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -162,7 +162,7 @@ func doKeyBody(t *testing.T, app *zip.App, method, path, org, key string, body a
 	if key != "" {
 		req.Header.Set(claimKeyHeader, key)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -283,7 +283,7 @@ func reqAs(t *testing.T, app *zip.App, method, path, org, user string, admin boo
 	if key != "" {
 		req.Header.Set(claimKeyHeader, key)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/agents/sessions_test.go

@@ -182,7 +182,7 @@ func doNoUser(t *testing.T, app *zip.App, method, path, org string, body any) (i
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/ai/mcp_test.go

@@ -47,7 +47,6 @@ func served(t *testing.T) *zip.App {
 	app := zip.New(zip.Config{AppName: "ai", Logger: luxlog.New("aimcptest"), DisableStartupMessage: true})
 	app.Use(cloud.Bridge())
 	mountMCP(app)
-	app.Prepare()
 	return app
 }
 
@@ -63,7 +62,7 @@ func rpc(t *testing.T, app *zip.App, msg, user, org string) string {
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("POST %s: %v", door, err)
 	}
@@ -125,7 +124,7 @@ func get(t *testing.T, app *zip.App, user string) (int, string) {
 		req.Header.Set("X-User-Id", user)
 		req.Header.Set("X-Org-Id", "acme")
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("GET: %v", err)
 	}

apps/analytics/anon_capability_test.go

@@ -69,7 +69,7 @@ func postHostBody(t *testing.T, app *zip.App, host, path, body string) (int, []b
 	req := httptest.NewRequest(http.MethodPost, "http://"+host+path, strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
 	req.Host = host
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST %s%s: %v", host, path, err)
 	}

apps/analytics/anon_wire_integrity_test.go

@@ -84,7 +84,7 @@ func postAuth(t *testing.T, app *zip.App, path, auth, body string) (int, []byte)
 	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Authorization", auth)
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST %s: %v", path, err)
 	}

apps/analytics/capture_keyorg_test.go

@@ -57,7 +57,7 @@ func postKeyed(t *testing.T, app *zip.App, path, host, body string, hdr map[stri
 	for k, v := range hdr {
 		req.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST %s: %v", path, err)
 	}

apps/analytics/capture_live_test.go

@@ -233,7 +233,7 @@ func livePost(t *testing.T, app *zip.App, path, user, org, body string) (int, []
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("X-User-Id", user)
 	req.Header.Set("X-Org-Id", org)
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST %s: %v", path, err)
 	}
@@ -264,7 +264,7 @@ func TestLiveAnonymousCapture(t *testing.T) {
 	req := httptest.NewRequest(http.MethodPost, canonDoor, strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
 	req.Host = "hanzo.ai" // brand host buys NOTHING; the row lands under $public
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("anon POST: %v", err)
 	}

apps/analytics/capture_test.go

@@ -395,7 +395,7 @@ func doBody(t *testing.T, app *zip.App, method, path, user, org, body string) (i
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -489,7 +489,7 @@ func doHost(t *testing.T, app *zip.App, path, user, org, host, body string) (int
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST %s: %v", path, err)
 	}

apps/analytics/hostcarve_test.go

@@ -132,7 +132,7 @@ func postHost(t *testing.T, app *zip.App, host, path, body string, hdr map[strin
 	for k, v := range hdr {
 		req.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST %s%s: %v", host, path, err)
 	}
@@ -258,7 +258,7 @@ func TestMount_HostCarve_CustomDomainCarves(t *testing.T) {
 func TestMount_HostCarve_GetNotHijacked(t *testing.T) {
 	app := carveApp(t, "hanzo")
 	req := httptest.NewRequest(http.MethodGet, "http://yadota.hanzo.app/v1/analytics/overview", nil)
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("GET: %v", err)
 	}

apps/analytics/http_test.go

@@ -48,7 +48,7 @@ func do(t *testing.T, app *zip.App, method, path, user, org string) (int, []byte
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/analytics/public_test.go

@@ -32,7 +32,7 @@ func postAnon(t *testing.T, app *zip.App, path, body string, hdr map[string]stri
 	for k, v := range hdr {
 		req.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test POST %s: %v", path, err)
 	}
@@ -581,7 +581,7 @@ func TestAuthenticated_OptOutNotHonoredForPrincipal(t *testing.T) {
 	req.Header.Set("X-User-Id", "user-dave")
 	req.Header.Set("X-Org-Id", "acme")
 	req.Header.Set("DNT", "1")
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/analytics/team_test.go

@@ -48,7 +48,7 @@ func postBody(t *testing.T, app *zip.App, path, body, auth string) (int, Capture
 	if auth != "" {
 		req.Header.Set("Authorization", "Bearer "+auth)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("POST %s: %v", path, err)
 	}
@@ -440,7 +440,7 @@ func resolvedTeamOrg(t *testing.T, app *zip.App, bearer string) (string, bool) {
 	if bearer != "" {
 		req.Header.Set("Authorization", "Bearer "+bearer)
 	}
-	resp, err := probe.Fiber().Test(req)
+	resp, err := probe.Test(req)
 	if err != nil {
 		t.Fatalf("probe: %v", err)
 	}
@@ -629,7 +629,7 @@ func runTenant(t *testing.T, headers map[string]string, fn func(*zip.Ctx) (admis
 	for k, v := range headers {
 		req.Header.Set(k, v)
 	}
-	resp, err := probe.Fiber().Test(req)
+	resp, err := probe.Test(req)
 	if err != nil {
 		t.Fatalf("probe: %v", err)
 	}
@@ -671,7 +671,7 @@ func teamPresented2(t *testing.T, bearer string) bool {
 	})
 	req := httptest.NewRequest(http.MethodPost, "/probe", strings.NewReader("[]"))
 	req.Header.Set("Authorization", "Bearer "+bearer)
-	resp, _ := probe.Fiber().Test(req)
+	resp, _ := probe.Test(req)
 	defer func() { _ = resp.Body.Close() }()
 	return got
 }

apps/ask/ask_test.go

@@ -91,7 +91,7 @@ func ask(t *testing.T, app *zip.App, org, question string) (int, askAnswer) {
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("ask %q: %v", question, err)
 	}
@@ -242,7 +242,7 @@ func TestAnonymousRefused(t *testing.T) {
 	req := httptest.NewRequest(http.MethodPost, "/v1/ask", strings.NewReader(string(body)))
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("X-Org-Id", "acme")
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("test: %v", err)
 	}

apps/ask/books.go

@@ -12,13 +12,13 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	fiber "github.com/zap-proto/fiber/v3"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 
 	"github.com/hanzoai/cloud"
-	fiber "github.com/zap-proto/fiber/v3"
 )
 
 // booksMetricsPath is the books domain's grounded read the contributor replays. It is the ONE

apps/ask/typed_wire_test.go

@@ -40,7 +40,7 @@ func askRaw(t *testing.T, app *zip.App, body string, hdr map[string]string) *htt
 	for k, v := range hdr {
 		rq.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(rq)
+	resp, err := app.Test(rq)
 	if err != nil {
 		t.Fatalf("POST /v1/ask: %v", err)
 	}

apps/ask/web_test.go

@@ -61,7 +61,7 @@ func TestAskWebModeDispatch(t *testing.T) {
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("X-Org-Id", "acme")
 	req.Header.Set("X-User-Id", "u-acme")
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("web ask: %v", err)
 	}

apps/auditlog/auditlog_test.go

@@ -55,7 +55,7 @@ func call(t *testing.T, app *zip.App, path, user, org string) (int, []audit.Wire
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test GET %s: %v", path, err)
 	}

apps/auditlog/typed_wire_test.go

@@ -27,7 +27,7 @@ func doRaw(t *testing.T, app *zip.App, path, user, org string) (*http.Response,
 	if org != "" {
 		rq.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(rq)
+	resp, err := app.Test(rq)
 	if err != nil {
 		t.Fatalf("Test GET %s: %v", path, err)
 	}

apps/authors/authors_test.go

@@ -17,7 +17,6 @@ import (
 	// test process has no KMS.
 	_ "github.com/hanzoai/cloud/internal/devmaster"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -185,7 +184,7 @@ func req(t *testing.T, app *zip.App, method, path, org string, admin bool, body
 		hr.Header.Set("X-User-IsAdmin", "true")
 	}
 	// Generous ceiling — the fiber default is 1s, which flakes under machine load.
-	resp, err := app.Fiber().Test(hr, fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
+	resp, err := app.Test(hr, zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -923,7 +922,7 @@ func TestMount(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = Shutdown() })
 	r := httptest.NewRequest(http.MethodGet, "/v1/authors", nil)
-	resp, err := app.Fiber().Test(r, fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
+	resp, err := app.Test(r, zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/auto/typed_wire_test.go

@@ -274,7 +274,7 @@ func do(t *testing.T, app *zip.App, method, path, user, org, body string) (int,
 	if body != "" {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test(%s %s): %v", method, path, err)
 	}

apps/automations/harness_test.go

@@ -12,7 +12,6 @@ import (
 	"github.com/hanzoai/cloud"
 	"github.com/hanzoai/cloud/audit"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -49,7 +48,6 @@ func newAppMCP(t *testing.T) *zip.App {
 	}
 	// zip installs /mcp in prepare(), which Listen would call; a Fiber().Test app
 	// never listens. Once-guarded, so calling it here is safe.
-	app.Prepare()
 	t.Cleanup(func() { _ = Shutdown(context.Background()) })
 	return app
 }
@@ -144,7 +142,7 @@ func req(t *testing.T, app *zip.App, method, path, org string, body any) httpRes
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: 0})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: 0})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -162,7 +160,7 @@ func reqRaw(t *testing.T, app *zip.App, path, org string, raw string) httpResult
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: 0})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: 0})
 	if err != nil {
 		t.Fatalf("Test POST %s: %v", path, err)
 	}

apps/base/base_test.go

@@ -20,7 +20,6 @@ import (
 	"github.com/hanzoai/cloud"
 	"github.com/hanzoai/cloud/apps/goja"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -58,7 +57,7 @@ func req(t *testing.T, app *zip.App, method, path, org string, body any) (int, [
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org) // makes principal.Validated true
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: 30 * time.Second})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: 30 * time.Second})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/base/collections_test.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -102,7 +101,7 @@ func TestServeCollectionsGate(t *testing.T) {
 	app.All("/v1/collections/*", func(c *zip.Ctx) error { return serveCollections(proxy, c) })
 
 	// No principal → 403, upstream never reached.
-	res, err := app.Fiber().Test(httptest.NewRequest(http.MethodGet, "/v1/collections/tenants/records", nil), fiber.TestConfig{Timeout: 30 * time.Second})
+	res, err := app.Test(httptest.NewRequest(http.MethodGet, "/v1/collections/tenants/records", nil), zip.TestConfig{Timeout: 30 * time.Second})
 	if err != nil {
 		t.Fatalf("app.Test (anon): %v", err)
 	}
@@ -116,7 +115,7 @@ func TestServeCollectionsGate(t *testing.T) {
 	// Validated principal (X-User-Id set) + allow-listed path → forwarded.
 	req := httptest.NewRequest(http.MethodGet, "/v1/collections/tenants/records", nil)
 	req.Header.Set("X-User-Id", "u-123")
-	res, err = app.Fiber().Test(req, fiber.TestConfig{Timeout: 30 * time.Second})
+	res, err = app.Test(req, zip.TestConfig{Timeout: 30 * time.Second})
 	if err != nil {
 		t.Fatalf("app.Test (authed): %v", err)
 	}

apps/billing/balance_s2s_test.go

@@ -45,7 +45,7 @@ func s2sCall(t *testing.T, app *zip.App, path, token, org string) (int, []byte)
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test GET %s: %v", path, err)
 	}

apps/billing/balance_test.go

@@ -130,7 +130,7 @@ func TestBalance_SubjectIsTheGateSubject(t *testing.T) {
 			if tc.userName != "" {
 				req.Header.Set("X-User-Name", tc.userName)
 			}
-			resp, err := app.Fiber().Test(req)
+			resp, err := app.Test(req)
 			if err != nil {
 				t.Fatalf("Test: %v", err)
 			}
@@ -251,7 +251,7 @@ func TestBalance_ReportsTheAccountItRead(t *testing.T) {
 			if tc.userName != "" {
 				req.Header.Set("X-User-Name", tc.userName)
 			}
-			resp, err := app.Fiber().Test(req)
+			resp, err := app.Test(req)
 			if err != nil {
 				t.Fatalf("Test: %v", err)
 			}

apps/billing/billing_test.go

@@ -85,7 +85,7 @@ func call(t *testing.T, app *zip.App, method, path, user, org string) (int, []by
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -230,7 +230,7 @@ func callBody(t *testing.T, app *zip.App, method, path, user, org, body string)
 	if org != "" {
 		req.Header.Set("X-Org-Id", org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/blueprint/blueprint_test.go

@@ -98,7 +98,7 @@ func mountApp(t *testing.T) *zip.App {
 func get(t *testing.T, app *zip.App, path string) (int, []byte) {
 	t.Helper()
 	req := httptest.NewRequest(http.MethodGet, path, nil)
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("GET %s: %v", path, err)
 	}

apps/books/wire_test.go

@@ -32,11 +32,10 @@ import (
 
 	"github.com/hanzoai/cloud"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
-var wireCfg = fiber.TestConfig{Timeout: 60 * time.Second, FailOnTimeout: true}
+var wireCfg = zip.TestConfig{Timeout: 60 * time.Second, FailOnTimeout: true}
 
 // mountBooks brings up the real /v1/books surface over a temp DataDir: the real
 // router, the real middleware, the real stores.
@@ -67,7 +66,7 @@ func hit(t *testing.T, app *zip.App, method, path, org string, body []byte) (int
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(req, wireCfg)
+	resp, err := app.Test(req, wireCfg)
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, path, err)
 	}

apps/bot/subsystem_test.go

@@ -12,14 +12,13 @@ import (
 
 	"github.com/hanzoai/cloud"
 	luxlog "github.com/luxfi/log"
-	"github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
 // botTestCfg replaces fiber's Test() default of a 1s WALL-CLOCK deadline on an
 // in-process request: under load a correct handler blows it and the test reports
 // an i/o timeout, which teaches nothing. The generous bound still fails a hang.
-var botTestCfg = fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true}
+var botTestCfg = zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true}
 
 // mountBot builds the surface over a registry the test controls, through the same
 // routes() the binary calls — so what a test drives is the code that ships.
@@ -56,7 +55,7 @@ func botCall(t *testing.T, app *zip.App, method, path, org string, body any) (in
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(req, botTestCfg)
+	resp, err := app.Test(req, botTestCfg)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}
@@ -138,7 +137,7 @@ func TestNodeRoutesRefuseAnUnvalidatedCaller(t *testing.T) {
 	// A forged org with NO validated user is the same refusal.
 	req := httptest.NewRequest(http.MethodGet, "/v1/bot/nodes", nil)
 	req.Header.Set("X-Org-Id", "acme") // forged; no X-User-Id
-	resp, err := app.Fiber().Test(req, botTestCfg)
+	resp, err := app.Test(req, botTestCfg)
 	if err != nil {
 		t.Fatal(err)
 	}

apps/bots/bots_list_stop_test.go

@@ -118,7 +118,7 @@ func call(t *testing.T, app *zip.App, method, path, org string) (int, []byte) {
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}
@@ -230,7 +230,7 @@ func TestListRefusesForgedOrgWithoutValidatedPrincipal(t *testing.T) {
 
 	req := httptest.NewRequest(http.MethodGet, "/v1/bots", nil)
 	req.Header.Set("X-Org-Id", "acme") // forged: no X-User-Id
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/bots/testcfg_test.go

@@ -1,9 +1,8 @@
 package bots
 
 import (
+	"github.com/zap-proto/zip"
 	"time"
-
-	"github.com/zap-proto/fiber/v3"
 )
 
 // testCfg replaces fiber's Test() default of Timeout: 1s (fiber/v3@v3.2.1
@@ -13,4 +12,4 @@ import (
 // for reasons unrelated to what it guards teaches nothing, and a tenant-isolation
 // guard that is a coin flip is worse than none. The generous bound still fails a
 // genuine hang.
-var testCfg = fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true}
+var testCfg = zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true}

apps/bots/typed_wire_test.go

@@ -157,7 +157,7 @@ func post(t *testing.T, app *zip.App, path, body, org string) (int, string) {
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/campaign/typed_wire_test.go

@@ -20,7 +20,6 @@ import (
 	"testing"
 	"time"
 
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/cloud"
@@ -56,7 +55,7 @@ func send(t *testing.T, app *zip.App, method, path, org, ctype, body string) (in
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org) // a validated principal (principal.Org gate)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: wireTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: wireTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/captable/http_test.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/hanzoai/cloud"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -59,7 +58,7 @@ func probe(t *testing.T, app *zip.App, method, path, org string, body any) (int,
 	// A generous timeout: fiber's 1s default is too tight for the in-memory harness
 	// under an occasional GC / cold-sqlite pause (the goja dispatch does real DB
 	// work), which would flake this suite.
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/captable/writes_test.go

@@ -41,7 +41,6 @@ import (
 	"github.com/hanzoai/cloud"
 	"github.com/hanzoai/cloud/apps/goja"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -442,7 +441,6 @@ func newAppMCP(t *testing.T) *zip.App {
 	}
 	// zip installs /mcp in prepare(), which Listen would call; a Fiber().Test app
 	// never listens. Once-guarded, so calling it here is safe.
-	app.Prepare()
 	t.Cleanup(func() { _ = Shutdown(context.Background()) })
 	return app
 }
@@ -459,7 +457,7 @@ func toolsCall(t *testing.T, app *zip.App, org, op, args string) (string, bool)
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: 30 * time.Second, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("tools/call %s: %v", op, err)
 	}

apps/catalog/catalog_test.go

@@ -46,7 +46,7 @@ func do(t *testing.T, app *zip.App, method, url, body string, hdr map[string]str
 	for k, v := range hdr {
 		r.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(r)
+	resp, err := app.Test(r)
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, url, err)
 	}

apps/channels/ingest_test.go

@@ -110,7 +110,7 @@ func doReq(t *testing.T, e *testEnv, method, path, org string, admin bool, body
 	if admin {
 		rq.Header.Set("X-User-IsOrgAdmin", "true")
 	}
-	resp, err := e.app.Fiber().Test(rq)
+	resp, err := e.app.Test(rq)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/channels/typed_wire_test.go

@@ -149,7 +149,7 @@ func TestSendKeepsItsCapAndItsStrictness(t *testing.T) {
 	rq.Header.Set("Content-Type", "application/json")
 	rq.Header.Set("X-Org-Id", "acme")
 	rq.Header.Set("X-User-Id", "u-acme")
-	resp, err := e.app.Fiber().Test(rq)
+	resp, err := e.app.Test(rq)
 	if err != nil {
 		t.Fatalf("Test: %v", err)
 	}

apps/cloudflare/cloudflare_test.go

@@ -136,7 +136,7 @@ func doReq(t *testing.T, app *zip.App, method, path, user, org string, admin boo
 	if body != "" {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test(%s %s): %v", method, path, err)
 	}

apps/cms/cms_test.go

@@ -169,7 +169,7 @@ func call(t *testing.T, app *zip.App, method, path, org string, body any) (int,
 	}
 	req.Header.Set("X-Org-Id", org)
 	req.Header.Set("X-User-Id", "u_"+org) // the validated-principal signal
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/code/testutil_test.go

@@ -105,7 +105,7 @@ func doAuth(t *testing.T, app *zip.App, method, path, org string, body any) (int
 
 func runReq(t *testing.T, app *zip.App, req *http.Request) (int, []byte) {
 	t.Helper()
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", req.Method, req.URL.Path, err)
 	}

apps/commerce/errorscope_test.go

@@ -33,7 +33,7 @@ func TestCommerceErrorScope(t *testing.T) {
 
 	probe := func(path string) (int, string) {
 		req := httptest.NewRequest("GET", path, nil)
-		resp, err := app.Fiber().Test(req)
+		resp, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("%s: %v", path, err)
 		}

apps/commerce/ledger_wire_test.go

@@ -93,7 +93,7 @@ func readAs(t *testing.T, app *zip.App, path, org string) []byte {
 	req := httptest.NewRequest(http.MethodGet, path, nil)
 	req.Header.Set("X-User-Id", org+"/dave")
 	req.Header.Set("X-Org-Id", org)
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("GET %s: %v", path, err)
 	}

apps/commerce/prefix_test.go

@@ -32,10 +32,10 @@ import (
 func TestCommercePrefixesPinned(t *testing.T) {
 	want := map[string]bool{
 		"/v1/billing/recharge": false,
-		"/v1/billing/webhooks":      false,
-		"/v1/store":                 false,
-		"/v1/catalog":               false,
-		"/v1/plans":                 false,
+		"/v1/billing/webhooks": false,
+		"/v1/store":            false,
+		"/v1/catalog":          false,
+		"/v1/plans":            false,
 	}
 	for _, p := range Prefixes {
 		if _, ok := want[p]; ok {
@@ -112,7 +112,7 @@ func TestStoreSurfaceRoutedToCommerceNotAIGate(t *testing.T) {
 // doReq drives one request through the mounted app and returns (status, body).
 func doReq(t *testing.T, app *zip.App, method, path string) (int, []byte) {
 	t.Helper()
-	resp, err := app.Fiber().Test(httptest.NewRequest(method, path, nil))
+	resp, err := app.Test(httptest.NewRequest(method, path, nil))
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/commerce/transport/routersemantics_test.go

@@ -19,7 +19,7 @@ func TestRouterSemantics(t *testing.T) {
 		defer func() { panicked = recover() }()
 		app := zip.New(zip.Config{})
 		register(app)
-		resp, err := app.Fiber().Test(httptest.NewRequest(http.MethodGet, path, nil))
+		resp, err := app.Test(httptest.NewRequest(http.MethodGet, path, nil))
 		if err != nil {
 			t.Fatalf("probe %s: %v", path, err)
 		}

apps/company/company_test.go

@@ -15,7 +15,6 @@ import (
 	// test process has no KMS.
 	_ "github.com/hanzoai/cloud/internal/devmaster"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -179,7 +178,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body any) (int, ma
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -207,7 +206,7 @@ func doAdmin(t *testing.T, app *zip.App, method, path, org string, body any) (in
 	rq.Header.Set("X-Org-Id", org)
 	rq.Header.Set("X-User-Id", "admin_"+org)
 	rq.Header.Set("X-User-IsAdmin", "true")
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/company/typed_test.go

@@ -10,7 +10,6 @@ import (
 	"testing"
 
 	"github.com/hanzoai/cloud/apps/metering"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -43,7 +42,7 @@ func raw(t *testing.T, app *zip.App, method, path, org, contentType string, body
 	rq.Header.Set("Content-Type", contentType)
 	rq.Header.Set("X-Org-Id", org)
 	rq.Header.Set("X-User-Id", "u_"+org)
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/compliance/compliance_test.go

@@ -22,7 +22,6 @@ import (
 	// test process has no KMS.
 	_ "github.com/hanzoai/cloud/internal/devmaster"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -82,7 +81,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body any) (int, ma
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org) // a validated principal (principal.Org gate)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -110,7 +109,7 @@ func doOrgAdmin(t *testing.T, app *zip.App, method, path, org string, body any)
 	rq.Header.Set("X-Org-Id", org)
 	rq.Header.Set("X-User-Id", "admin_"+org)
 	rq.Header.Set("X-User-IsOrgAdmin", "true")
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -130,7 +129,7 @@ func doWebhook(t *testing.T, app *zip.App, sig string, body []byte) (int, map[st
 	if sig != "" {
 		rq.Header.Set(idv.WebhookRefHeader, sig)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test webhook: %v", err)
 	}

apps/compliance/typed_wire_test.go

@@ -8,7 +8,6 @@ import (
 	"strings"
 	"testing"
 
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/cloud/openapi"
@@ -19,7 +18,7 @@ import (
 // decoded JSON that do() hands back.
 func doRaw(t *testing.T, app *zip.App, rq *http.Request) *http.Response {
 	t.Helper()
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: testTimeout, FailOnTimeout: true})
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", rq.Method, rq.URL.Path, err)
 	}

apps/connectorruntime/http_run_test.go

@@ -11,7 +11,6 @@ import (
 
 	"github.com/hanzoai/cloud"
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
@@ -44,7 +43,7 @@ func post(t *testing.T, app *zip.App, path, org string, body any) (int, []byte)
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u-"+org)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: 0})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: 0})
 	if err != nil {
 		t.Fatalf("Test POST %s: %v", path, err)
 	}

apps/content/content_test.go

@@ -142,7 +142,7 @@ func call(t *testing.T, app *zip.App, method, path, org, user string, body any)
 	if user != "" {
 		hr.Header.Set("X-User-Id", user)
 	}
-	resp, err := app.Fiber().Test(hr)
+	resp, err := app.Test(hr)
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, path, err)
 	}

apps/crawl/typed_wire_test.go

@@ -27,7 +27,7 @@ func post(t *testing.T, app *zip.App, path, body string) (int, string) {
 	rq := httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
 	rq.Header.Set("Content-Type", "application/json")
 	rq.Header.Set("X-API-Key", "test-service-key")
-	resp, err := app.Fiber().Test(rq)
+	resp, err := app.Test(rq)
 	if err != nil {
 		t.Fatalf("POST %s: %v", path, err)
 	}

apps/crm/http_test.go

@@ -37,7 +37,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body any) (int, []
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u_"+org) // validated principal (tenant() gates on it)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -251,7 +251,7 @@ func TestRed_NoPrincipalForgedOrgRefused(t *testing.T) {
 		req := httptest.NewRequest(http.MethodGet, p, nil)
 		req.Header.Set("X-Org-Id", "victim") // forged; equals the seeded tenant's org
 		// deliberately NO X-User-Id — the anonymous-forge signature.
-		resp, err := app.Fiber().Test(req)
+		resp, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("forged GET %s: %v", p, err)
 		}
@@ -268,7 +268,7 @@ func TestRed_NoPrincipalForgedOrgRefused(t *testing.T) {
 		req := httptest.NewRequest(method, path, body)
 		req.Header.Set("Content-Type", "application/json")
 		req.Header.Set("X-Org-Id", "victim") // forged; deliberately NO X-User-Id
-		resp, err := app.Fiber().Test(req)
+		resp, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("forged %s %s: %v", method, path, err)
 		}

apps/dataroom/flow_test.go

@@ -79,7 +79,7 @@ func req(t *testing.T, app *zip.App, method, path, org, contentType string, raw
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org)
 	}
-	resp, err := app.Fiber().Test(rq)
+	resp, err := app.Test(rq)
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, path, err)
 	}

apps/dataset/dataset_test.go

@@ -25,7 +25,6 @@ import (
 	"time"
 
 	luxlog "github.com/luxfi/log"
-	"github.com/zap-proto/fiber/v3"
 
 	"github.com/hanzoai/cloud"
 	"github.com/hanzoai/cloud/apps/metering"
@@ -33,7 +32,7 @@ import (
 	"github.com/zap-proto/zip"
 )
 
-var httpCfg = fiber.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
+var httpCfg = zip.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
 
 const brand = "hanzo"
 
@@ -123,7 +122,7 @@ func vouched(t *testing.T, app *zip.App, method, path, org, by string, body any)
 	if by != "" {
 		rq.Header.Set(cloud.HeaderUserBrand, by)
 	}
-	resp, err := app.Fiber().Test(rq, httpCfg)
+	resp, err := app.Test(rq, httpCfg)
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, path, err)
 	}

apps/deploy/cdapps_test.go

@@ -30,7 +30,7 @@ func listApplicationsAs(t *testing.T, s *cloud.Service[state], headers map[strin
 	for k, v := range headers {
 		req.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("GET: %v", err)
 	}

apps/deploy/dashboard_endpoints_test.go

@@ -31,7 +31,7 @@ func getJSON(t *testing.T, s *cloud.Service[state], path string) map[string]any
 	routes(app, s)
 	req := httptest.NewRequest("GET", path, nil)
 	req.Header.Set("X-User-IsAdmin", "true")
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("GET %s: %v", path, err)
 	}
@@ -143,7 +143,7 @@ func TestNewRoutesRequireAdmin(t *testing.T) {
 		req := httptest.NewRequest("GET", path, nil)
 		req.Header.Set("Accept", "text/event-stream")
 		req.Header.Set("Sec-Fetch-Dest", "empty")
-		resp, err := app.Fiber().Test(req)
+		resp, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("GET %s: %v", path, err)
 		}

apps/deploy/dashboard_guard_test.go

@@ -37,7 +37,7 @@ func TestDeployRoutesRequireAdmin(t *testing.T) {
 	}
 	for _, r := range guarded {
 		// WITHOUT admin → 403 (the guard, fail-closed).
-		resp, err := app.Fiber().Test(httptest.NewRequest(r.method, r.path, nil))
+		resp, err := app.Test(httptest.NewRequest(r.method, r.path, nil))
 		if err != nil {
 			t.Fatalf("%s %s: %v", r.method, r.path, err)
 		}
@@ -49,7 +49,7 @@ func TestDeployRoutesRequireAdmin(t *testing.T) {
 		// WITH admin → the guard passes (handler may 200/404/503, never the guard's 403).
 		req := httptest.NewRequest(r.method, r.path, nil)
 		req.Header.Set("X-User-IsAdmin", "true")
-		resp2, err := app.Fiber().Test(req)
+		resp2, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("%s %s admin: %v", r.method, r.path, err)
 		}
@@ -61,7 +61,7 @@ func TestDeployRoutesRequireAdmin(t *testing.T) {
 	}
 
 	// The health probe is DELIBERATELY public (liveness without a JWT) — never 403.
-	resp, err := app.Fiber().Test(httptest.NewRequest("GET", "/v1/deploy/health", nil))
+	resp, err := app.Test(httptest.NewRequest("GET", "/v1/deploy/health", nil))
 	if err != nil {
 		t.Fatalf("health: %v", err)
 	}
@@ -79,7 +79,7 @@ func TestDeployRoutesRequireAdmin(t *testing.T) {
 		{"GET", "/v1/deploy/callback"},
 		{"POST", "/v1/deploy/logout"},
 	} {
-		resp, err := app.Fiber().Test(httptest.NewRequest(r.method, r.path, nil))
+		resp, err := app.Test(httptest.NewRequest(r.method, r.path, nil))
 		if err != nil {
 			t.Fatalf("%s %s: %v", r.method, r.path, err)
 		}
@@ -92,7 +92,7 @@ func TestDeployRoutesRequireAdmin(t *testing.T) {
 
 	// Logout must NOT be reachable as a GET: it changes state, and a cross-site
 	// top-level navigation carries a SameSite=Lax cookie.
-	resp, err = app.Fiber().Test(httptest.NewRequest("GET", "/v1/deploy/logout", nil))
+	resp, err = app.Test(httptest.NewRequest("GET", "/v1/deploy/logout", nil))
 	if err != nil {
 		t.Fatalf("GET logout: %v", err)
 	}
@@ -111,7 +111,7 @@ func TestUserInfoIsPublicBootstrap(t *testing.T) {
 	app := zip.New(zip.Config{Logger: luxlog.New("test")})
 	routes(app, fakeService())
 
-	resp, err := app.Fiber().Test(httptest.NewRequest("GET", "/v1/deploy/session/userinfo", nil))
+	resp, err := app.Test(httptest.NewRequest("GET", "/v1/deploy/session/userinfo", nil))
 	if err != nil {
 		t.Fatalf("userinfo: %v", err)
 	}
@@ -147,7 +147,7 @@ func TestUserInfoIsPublicBootstrap(t *testing.T) {
 	req := httptest.NewRequest("GET", "/v1/deploy/session/userinfo", nil)
 	req.Header.Set("X-User-IsAdmin", "true")
 	req.Header.Set("X-User-Id", "cto")
-	resp2, err := app.Fiber().Test(req)
+	resp2, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("admin userinfo: %v", err)
 	}

apps/deploy/gitops_test.go

@@ -111,7 +111,7 @@ func TestGitOpsGuarded(t *testing.T) {
 	s := fakeService()
 	app := zip.New(zip.Config{Logger: luxlog.New("test")})
 	routes(app, s)
-	resp, err := app.Fiber().Test(httptest.NewRequest("GET", "/v1/deploy/gitops", nil))
+	resp, err := app.Test(httptest.NewRequest("GET", "/v1/deploy/gitops", nil))
 	if err != nil {
 		t.Fatalf("GET /v1/deploy/gitops: %v", err)
 	}

apps/deploy/login_test.go

@@ -635,7 +635,7 @@ func completeSignin(t *testing.T, app *zip.App) *http.Response {
 
 func do(t *testing.T, app *zip.App, req *http.Request) *http.Response {
 	t.Helper()
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("%s %s: %v", req.Method, req.URL, err)
 	}

apps/deploy/scope_test.go

@@ -53,7 +53,7 @@ func getAs(t *testing.T, s *cloud.Service[state], path string, headers map[strin
 	for k, v := range headers {
 		req.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("GET %s: %v", path, err)
 	}
@@ -107,7 +107,7 @@ func probeScope(t *testing.T, headers map[string]string) (scope, bool) {
 	for k, v := range headers {
 		req.Header.Set(k, v)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("probe: %v", err)
 	}

apps/deploy/typed_wire_test.go

@@ -38,7 +38,7 @@ func probe(t *testing.T, s *cloud.Service[state], req *http.Request) (int, strin
 	t.Helper()
 	app := zip.New(zip.Config{Logger: luxlog.New("test")})
 	routes(app, s)
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("%s %s: %v", req.Method, req.URL.Path, err)
 	}
@@ -133,7 +133,7 @@ func TestRefusalIsA403AndANavigationIsBounced(t *testing.T) {
 		nav.Header.Set("Sec-Fetch-Dest", "document")
 		app := zip.New(zip.Config{Logger: luxlog.New("test")})
 		routes(app, s)
-		resp, err := app.Fiber().Test(nav)
+		resp, err := app.Test(nav)
 		if err != nil {
 			t.Fatalf("GET %s (navigation): %v", path, err)
 		}

apps/destinations/typed_wire_test.go

@@ -72,7 +72,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, admin bool, body a
 	if admin {
 		req.Header.Set("X-User-IsOrgAdmin", "true")
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/dns/dns_test.go

@@ -80,7 +80,7 @@ func as(req *http.Request, org, user, bearer string) *http.Request {
 
 func do(t *testing.T, app *zip.App, req *http.Request) (*http.Response, string) {
 	t.Helper()
-	res, err := app.Fiber().Test(req)
+	res, err := app.Test(req)
 	if err != nil {
 		t.Fatal(err)
 	}

apps/do/do_test.go

@@ -11,14 +11,13 @@ import (
 	"time"
 
 	"github.com/digitalocean/godo"
-	"github.com/zap-proto/fiber/v3"
 	luxlog "github.com/luxfi/log"
 
 	"github.com/hanzoai/cloud"
 	"github.com/zap-proto/zip"
 )
 
-var testCfg = fiber.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
+var testCfg = zip.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
 
 // ── fakes: an in-memory DigitalOcean account shared across all orgs ──────────
 //
@@ -124,7 +123,7 @@ func req(t *testing.T, app *zip.App, method, path, org string, body any) (int, [
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org)
 	}
-	resp, err := app.Fiber().Test(rq, testCfg)
+	resp, err := app.Test(rq, testCfg)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -265,7 +264,7 @@ func TestForgePathRefused(t *testing.T) {
 	routes(app2, s)
 	rq := httptest.NewRequest(http.MethodGet, "/v1/vpcs", nil)
 	rq.Header.Set("X-Org-Id", "victim") // forged org, no validated user
-	resp, err := app2.Fiber().Test(rq, testCfg)
+	resp, err := app2.Test(rq, testCfg)
 	if err != nil {
 		t.Fatalf("forge test: %v", err)
 	}

apps/engine/typed_wire_test.go

@@ -184,7 +184,7 @@ func do(t *testing.T, app *zip.App, method, path, user, org, body string) (int,
 	if body != "" {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test(%s %s): %v", method, path, err)
 	}

apps/entitlements/entitlements_test.go

@@ -83,7 +83,7 @@ func mount(t *testing.T, commerce cloud.CommerceClient) (*zip.App, *service) {
 
 func send(t *testing.T, app *zip.App, req *http.Request) (int, []byte) {
 	t.Helper()
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", req.Method, req.URL.Path, err)
 	}

apps/erp/erp_test.go

@@ -374,7 +374,7 @@ func submitStatus(app *zip.App, org, doctype, name string) int {
 	req := httptest.NewRequest(http.MethodPost, "/v1/framework/"+doctype+"/"+name+"/submit", nil)
 	req.Header.Set("X-Org-Id", org)
 	req.Header.Set("X-User-Id", "u_"+org)
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		return -1
 	}
@@ -448,7 +448,7 @@ func reqAs(t *testing.T, app *zip.App, method, path, org, user string, body any)
 	}
 	req.Header.Set("X-Org-Id", org)
 	req.Header.Set("X-User-Id", user) // the validated-principal signal
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/esign/sign_test.go

@@ -109,7 +109,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body any) (int, []
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u_"+org)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/eval/attribution_test.go

@@ -38,7 +38,7 @@ func doProj(t *testing.T, app *zip.App, method, path, org, project, authz string
 	if authz != "" {
 		req.Header.Set("Authorization", authz)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/eval/eval_test.go

@@ -45,7 +45,7 @@ func TestTenantIgnoresClientProjectID(t *testing.T) {
 		if projectHeader != "" {
 			req.Header.Set("X-Project-Id", projectHeader) // client-controllable sub-scope
 		}
-		resp, err := app.Fiber().Test(req)
+		resp, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("Test: %v", err)
 		}

apps/eval/http_test.go

@@ -99,7 +99,7 @@ func newReqJSON(method, path string, body any) *http.Request {
 // send runs a hand-built request through the app and returns status + body.
 func send(t *testing.T, app *zip.App, req *http.Request) (int, []byte) {
 	t.Helper()
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", req.Method, req.URL.Path, err)
 	}
@@ -130,7 +130,7 @@ func doAuth(t *testing.T, app *zip.App, method, path, org, authz string, body an
 	if authz != "" {
 		req.Header.Set("Authorization", authz)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/exec/typed_wire_test.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	luxlog "github.com/luxfi/log"
-	fiber "github.com/zap-proto/fiber/v3"
 
 	"github.com/hanzoai/cloud"
 	"github.com/hanzoai/cloud/openapi"
@@ -300,7 +299,7 @@ func (u *echoUpstream) call(t *testing.T, app *zip.App, method, path, ctype, bod
 	if ctype != "" {
 		rq.Header.Set("Content-Type", ctype)
 	}
-	resp, err := app.Fiber().Test(rq, fiber.TestConfig{Timeout: 30 * time.Second})
+	resp, err := app.Test(rq, zip.TestConfig{Timeout: 30 * time.Second})
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, path, err)
 	}

apps/experiments/experiments_test.go

@@ -84,7 +84,7 @@ func do(t *testing.T, app *zip.App, method, path, org, project string, body any)
 	if project != "" {
 		req.Header.Set("X-Project-Id", project)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -117,7 +117,7 @@ func doAdmin(t *testing.T, app *zip.App, method, path, org, project string, body
 	if project != "" {
 		req.Header.Set("X-Project-Id", project)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/flags/routes_test.go

@@ -19,14 +19,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/zap-proto/fiber/v3"
 	luxlog "github.com/luxfi/log"
 
 	"github.com/hanzoai/cloud"
 	"github.com/zap-proto/zip"
 )
 
-var httpCfg = fiber.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
+var httpCfg = zip.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
 
 // mountHTTP puts the flag surface on a bare app over a temp-dir store tree.
 func mountHTTP(t *testing.T) *zip.App {
@@ -57,7 +56,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body []byte) (int,
 		rq.Header.Set("X-Org-Id", org)
 		rq.Header.Set("X-User-Id", "u_"+org)
 	}
-	resp, err := app.Fiber().Test(rq, httpCfg)
+	resp, err := app.Test(rq, httpCfg)
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, path, err)
 	}

apps/flow/typed_wire_test.go

@@ -76,8 +76,8 @@ type upstreamCall struct {
 type fakeFlow struct {
 	mu       sync.Mutex
 	calls    []upstreamCall
-	projects map[string]string            // name → id
-	flows    map[string]map[string]any    // id → FlowRead-ish record
+	projects map[string]string         // name → id
+	flows    map[string]map[string]any // id → FlowRead-ish record
 	nextID   int
 	deny     bool // refuse the platform credential (401) when set
 }
@@ -217,7 +217,7 @@ func do(t *testing.T, app *zip.App, method, path, user, org, body string) (int,
 	if body != "" {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test(%s %s): %v", method, path, err)
 	}

apps/framework/http_test.go

@@ -45,7 +45,7 @@ func call(t *testing.T, app *zip.App, method, path, org, user string, admin bool
 	if admin {
 		req.Header.Set("X-User-IsAdmin", "true")
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -219,7 +219,7 @@ func TestForgedPrincipalRefused(t *testing.T) {
 		}
 		req.Header.Set("X-Org-Id", "victim") // forged; equals a real tenant
 		// deliberately NO X-User-Id — the anonymous-forge signature.
-		resp, err := app.Fiber().Test(req)
+		resp, err := app.Test(req)
 		if err != nil {
 			t.Fatalf("forged %s %s: %v", method, path, err)
 		}

apps/framework/ops_projection_test.go

@@ -145,7 +145,7 @@ func TestOpenObjectRefusalStillHolds(t *testing.T) {
 	})
 	req := httptest.NewRequest(http.MethodPost, "/probe/Task", bytes.NewReader([]byte(`{"subject":"x"}`)))
 	req.Header.Set("Content-Type", "application/json")
-	if _, err := probe.Fiber().Test(req); err != nil {
+	if _, err := probe.Test(req); err != nil {
 		t.Fatalf("probe request: %v", err)
 	}
 	if bound["subject"] != "x" {

apps/functions/billing_test.go

@@ -23,8 +23,8 @@ import (
 
 	"github.com/hanzoai/cloud"
 	"github.com/hanzoai/cloud/apps/metering"
-	"github.com/zap-proto/zip"
 	luxlog "github.com/luxfi/log"
+	"github.com/zap-proto/zip"
 )
 
 // billServer is a minimal commerce double: it returns a fixed balance and records
@@ -130,7 +130,7 @@ func fireInvoke(t *testing.T, s *cloud.Service[state], org, name string) *http.R
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u_"+org) // validated principal (org() gates on it)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test invoke: %v", err)
 	}

apps/functions/http_test.go

@@ -9,8 +9,8 @@ import (
 	"testing"
 
 	"github.com/hanzoai/cloud"
-	"github.com/zap-proto/zip"
 	luxlog "github.com/luxfi/log"
+	"github.com/zap-proto/zip"
 )
 
 func mountApp(t *testing.T) *zip.App {
@@ -40,7 +40,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body any) (int, []
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u_"+org) // validated principal (org() gates on it)
 	}
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/functions/red_admin_test.go

@@ -27,7 +27,7 @@ func doAdmin(t *testing.T, app *zip.App, method, path string, body any) (int, []
 	}
 	req.Header.Set("X-User-Id", "u_admin") // validated principal; empty org still 403 (no admin bucket)
 	req.Header.Set("X-User-IsAdmin", "true")
-	resp, err := app.Fiber().Test(req)
+	resp, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}

apps/gateway/gateway_test.go

@@ -41,7 +41,7 @@ func call(t *testing.T, app *zip.App, method, path, body string, hdr map[string]
 	for k, v := range hdr {
 		req.Header.Set(k, v)
 	}
-	res, err := app.Fiber().Test(req)
+	res, err := app.Test(req)
 	if err != nil {
 		t.Fatalf("test: %v", err)
 	}

apps/git/git_test.go

@@ -23,11 +23,10 @@ import (
 	"github.com/hanzoai/cloud"
 	luxlog "github.com/luxfi/log"
 	"github.com/valyala/fasthttp"
-	"github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 )
 
-var testCfg = fiber.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
+var testCfg = zip.TestConfig{Timeout: 10 * time.Second, FailOnTimeout: true}
 
 // asOrg carries the org identity a go-git client sends. Tests run
 // sequentially, so a single guarded value + a globally-installed
@@ -95,7 +94,7 @@ func do(t *testing.T, app *zip.App, method, path, org string, body any) (int, []
 		req.Header.Set("X-Org-Id", org)
 		req.Header.Set("X-User-Id", "u_"+org) // validated principal (org() gates on it)
 	}
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -205,7 +204,7 @@ func TestInfoRefsAdvertisement(t *testing.T) {
 	req := httptest.NewRequest(http.MethodGet, "/v1/git/acme/adv.git/info/refs?service=git-upload-pack", nil)
 	req.Header.Set("X-Org-Id", "acme")
 	req.Header.Set("X-User-Id", "u_acme")
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("info/refs: %v", err)
 	}
@@ -224,7 +223,7 @@ func TestInfoRefsAdvertisement(t *testing.T) {
 	req = httptest.NewRequest(http.MethodGet, "/v1/git/acme/adv.git/info/refs?service=bogus", nil)
 	req.Header.Set("X-Org-Id", "acme")
 	req.Header.Set("X-User-Id", "u_acme")
-	resp, _ = app.Fiber().Test(req, testCfg)
+	resp, _ = app.Test(req, testCfg)
 	if resp.StatusCode != http.StatusBadRequest {
 		t.Fatalf("bogus service want 400, got %d", resp.StatusCode)
 	}

apps/git/host_route_test.go

@@ -21,7 +21,7 @@ func TestRootSmartHTTP_HostGuard(t *testing.T) {
 	// ran (not a routing miss, which would be 404).
 	req := httptest.NewRequest(http.MethodGet, "/acme/repo.git/info/refs?service=git-receive-pack", nil)
 	req.Host = "git.hanzo.test"
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("git-host request: %v", err)
 	}
@@ -34,7 +34,7 @@ func TestRootSmartHTTP_HostGuard(t *testing.T) {
 	// never serves off the git host.
 	req = httptest.NewRequest(http.MethodGet, "/acme/repo.git/info/refs?service=git-receive-pack", nil)
 	req.Host = "api.hanzo.test"
-	resp, err = app.Fiber().Test(req, testCfg)
+	resp, err = app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("api-host request: %v", err)
 	}
@@ -56,7 +56,7 @@ func TestRootUI_HostGuard(t *testing.T) {
 	// git and did not fall through to the console SPA.
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	req.Host = "git.hanzo.test"
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("git-host / request: %v", err)
 	}
@@ -72,7 +72,7 @@ func TestRootUI_HostGuard(t *testing.T) {
 	// from a routing miss by the git-native error body.
 	req = httptest.NewRequest(http.MethodGet, "/acme/widget", nil)
 	req.Host = "git.hanzo.test"
-	resp, err = app.Fiber().Test(req, testCfg)
+	resp, err = app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("git-host /:org/:repo request: %v", err)
 	}
@@ -89,7 +89,7 @@ func TestRootUI_HostGuard(t *testing.T) {
 	for _, path := range []string{"/", "/acme/widget"} {
 		req = httptest.NewRequest(http.MethodGet, path, nil)
 		req.Host = "api.hanzo.test"
-		resp, err = app.Fiber().Test(req, testCfg)
+		resp, err = app.Test(req, testCfg)
 		if err != nil {
 			t.Fatalf("api-host %s request: %v", path, err)
 		}

apps/git/ops_test.go

@@ -22,7 +22,6 @@ const typedOpCount = 24
 // operation in the document is one of git's.
 func TestTypedOpsProject(t *testing.T) {
 	app := mountApp(t)
-	app.Prepare() // installs the deferred projections a Listen would
 
 	code, body := do(t, app, http.MethodGet, "/.well-known/openapi.json", "", nil)
 	if code != http.StatusOK {
@@ -70,7 +69,6 @@ func TestTypedOpsProject(t *testing.T) {
 // a tool argument is a cross-tenant read, and this test is what catches it.
 func TestTypedOpRefusesAnonymousMCP(t *testing.T) {
 	app := mountApp(t)
-	app.Prepare()
 
 	code, body := do(t, app, http.MethodPost, "/mcp", "", map[string]any{
 		"jsonrpc": "2.0", "id": 1, "method": "tools/call",

apps/git/project_path_test.go

@@ -34,7 +34,7 @@ func doScoped(t *testing.T, app *zip.App, method, path, org, project string, bod
 	if project != "" {
 		req.Header.Set("X-Project-Id", project)
 	}
-	resp, err := app.Fiber().Test(req, testCfg)
+	resp, err := app.Test(req, testCfg)
 	if err != nil {
 		t.Fatalf("Test %s %s: %v", method, path, err)
 	}
@@ -218,7 +218,7 @@ func TestProjectSegmentIsTraversalSafe(t *testing.T) {
 		req := httptest.NewRequest("GET", "/v1/git/acme/"+bad+"/code.git/info/refs?service=git-upload-pack", nil)
 		req.Header.Set("X-Org-Id", "acme")
 		req.Header.Set("X-User-Id", "u_acme")
-		resp, err := app.Fiber().Test(req, testCfg)
+		resp, err := app.Test(req, testCfg)
 		if err != nil {
 			continue // the router rejected the shape outright, which is also a refusal
 		}