[Pbarnett]

Motivation

A ContextVM encrypted client with the SDK's omitted/default gift-wrap policy can send its first initialize request in a persistent kind 1059 wrapper. An ephemeral-only server subscribing to kind 21059 never receives it, so the client times out before any capability negotiation can occur. A signed public server announcement can disclose ephemeral support before this initial request, provided the client validates the announcement rather than trusting arbitrary relay content.

Changes (separate commits)

1. Self-contained pre-existing test fixtures. Eliminate a shared hard-coded /tmp directory and a global-skills test's dependence on the developer profile. No product behavior changes.
2. Explicit policy selection. Add --gift-wrap-mode optional|persistent|ephemeral with typed validation and CLI > named-server > shared-config precedence. Omission retains SDK behavior.
3. Opt-in verified automatic selection. Add --auto-gift-wrap / autoGiftWrap for callers using encryption-mode required. Before constructing the transport, query bounded signed kind 11316 announcements for the exact selected server pubkey and verify canonical event ID/signature, age/expiration, presence-only capability tags, and conflicting-current-record rules. Prefer ephemeral wrapping when the server authenticates support; otherwise use the authenticated compatible persistent path. Explicit gift-wrap mode always wins, and the omitted default remains unchanged.

The third commit also fixes printable discovery of canonical presence-only encryption tags and handles null/oversized signed metadata defensively.

Safety and compatibility

• No default rollout. Existing callers who omit both options retain their SDK behavior.
• No plaintext downgrade or timed retry with a different wrapping kind. Automatic selection requires REQUIRED encryption and stops before MCP if metadata is invalid, absent, stale, expired, or contradictory.
• No change to the ContextVM SDK dependency or lockfile, payment interaction semantics, key custody, or server-side subscription policy.
• Signed announcements prove control of a Nostr key and advertised support, not an operator's real-world identity or a server's exclusive requirement.
• The raw WebSocket size check applies after frame assembly, not at the kernel memory level. The bounded query is not a general purpose hostile-relay sandbox.

Reproduction and qualification

• Preserved explicit-mode+fixture baseline: 429/429 tests passed.
• Combined opt-in automatic-selection successor: 517/517 tests passed, no skips or failures; formatting, TypeScript check, and build passed.
• 16/16 local SDK+encrypted-relay+client scenarios satisfied expected outcomes: ephemeral-only, optional, persistent-only, legacy omission, explicit override, payment rejection, malformed/forged/expired/conflicting announcements, and fail-closed metadata behavior. A separate valid-metadata/offline-receiver case timed out without downgrading.
• Recomputed 69 signed outer/38 signed inner events, matching relay filtering and JSON-RPC request/response correlation in the saved local matrix.
• A separate fixed-target, owner-arranged public read-only ContextVM introduction completed without a per-server ephemeral override using the local opt-in client. This is not an organic visitor or stock npm release.
• Local environment: macOS arm64, Node 24.21.0, CVMI 0.4.1 base 0c0e231116e2504f61e6cf731c0ba34c108904f5, locked @contextvm/sdk 0.13.10.

Upstream CI remains authoritative for Ubuntu/Windows Node 20 and Node 22 and maintainer review. No claim that a GitHub merge itself publishes an npm release or that existing clients already support these options.

Please feel free to review the three commits independently or request a smaller split; they deliberately separate the fixture, explicit-flag, and verified-auto concerns.