From 85598a560ab828e2aae485ec551fe34b2390ae24 Mon Sep 17 00:00:00 2001
From: FanouZeng-TT <18280587072@163.com>
Date: Tue, 25 Aug 2026 15:17:03 +0800
Subject: [PATCH] fix: restore strict discovery URL validation with fixture
 allowlist

---
 protocol_test.py                             | 21 ++++++++++++++++++--
 test_data/flower_shop/conformance_input.json |  6 ++++++
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/protocol_test.py b/protocol_test.py
index 42769f1..9dcff97 100644
--- a/protocol_test.py
+++ b/protocol_test.py
@@ -96,9 +96,21 @@ def _extract_document_urls(
 
     return sorted(urls, key=lambda x: x[0])
 
-  import unittest
+  def _is_allowed_unreachable_url(self, url: str) -> bool:
+    """Whether a discovery URL is declared not-yet-published by its owner.
+
+    Some payment-handler (Google Pay / Shop Pay), mock-handler and REST schema
+    URLs in the merchant's discovery profile are owned by external parties and
+    not yet published for the declared UCP version. They remain real pointer
+    entries in the profile, but their absence must not fail a conformance run.
+    Unreachable URLs are configured per fixture via ``allow_unreachable_urls``
+    in ``conformance_input.json`` (matched as substrings) and should be deleted
+    as each owning party publishes its URL. Every other URL is strictly
+    validated.
+    """
+    allow = (self.conformance_config or {}).get("allow_unreachable_urls", [])
+    return any(pattern in url for pattern in allow)
 
-  @unittest.skip("Schemas not yet published on remote ucp.dev domain")
   def test_discovery_urls(self):
     """Verify all spec and schema URLs in discovery profile are valid.
 
@@ -123,6 +135,11 @@ def test_discovery_urls(self):
           # Handle relative URLs if any (AnyUrl should be absolute though)
           res = client.get(url)
           if res.status_code != 200:
+            if self._is_allowed_unreachable_url(url):
+              # Real profile pointer whose owning party has not published it
+              # yet (see _is_allowed_unreachable_url); keep the suite green
+              # while the dependency ships without weakening other checks.
+              continue
             failures.append(f"[{path}] {url} returned status {res.status_code}")
             continue
 
diff --git a/test_data/flower_shop/conformance_input.json b/test_data/flower_shop/conformance_input.json
index d458112..1a861f8 100644
--- a/test_data/flower_shop/conformance_input.json
+++ b/test_data/flower_shop/conformance_input.json
@@ -8,6 +8,12 @@
     "dev.ucp.shopping.buyer_consent"
   ],
   "currency": "USD",
+  "allow_unreachable_urls": [
+    "pay.google.com/gp/p/ucp/2026-04-08",
+    "shopify.dev/ucp/shop-pay-handler/2026-04-08",
+    "ucp.dev/2026-04-08/schemas/mock_payment_handler/spec",
+    "ucp.dev/2026-04-08/services/shopping/openapi.json"
+  ],
   "items": [
     {
       "id": "bouquet_roses",