diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index e45b933..cbbcf82 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -7,24 +7,6 @@ on:
   workflow_dispatch:
 
 jobs:
-  provin-compatibility:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-      - name: Enable pnpm via corepack
-        run: |
-          npm install -g corepack --force
-          corepack enable
-          corepack prepare pnpm@10.29.3 --activate
-      - name: Clone dependencies over HTTPS
-        run: git config --global url."https://github.com/".insteadOf "git@github.com:"
-      - name: Test pinned Provin source against the candidate auth packages
-        run: make test-provin
-
   test-e2e:
     runs-on: ubuntu-latest
     timeout-minutes: 30
diff --git a/Makefile b/Makefile
index 6a2c706..84f9d45 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,6 @@
 PROVIDER_REV := 4c44adfbf8e780863c1d7c22bf0129a86bdc62d9
 PROXY_REV := 9fc0dab66bcbb74c189c2b17812cf50851b9d2f2
 VERIFIER_REV := cc982b795efc8807712b3db9ef596182a3bfd815
-PROVIN_REV := abb14d9ff971e88261447dd255863301f22c3a7c
 
 define clone_or_pull
 	@if [ -d "$(1)/.git" ]; then \
@@ -24,18 +23,6 @@ setup:
 .PHONY: pull
 pull: setup
 
-# Exercise the actual downstream DID grant and policy extensions before release.
-.PHONY: setup-provin test-provin
-setup-provin:
-	$(call clone_or_pull,repos/auth.provider,git@github.com:o3co/auth.provider.git,$(PROVIDER_REV))
-	$(call clone_or_pull,repos/auth.policy-verifier,git@github.com:o3co/auth.policy-verifier.git,$(VERIFIER_REV))
-	$(call clone_or_pull,repos/provin.auth,git@github.com:provin-line/auth.git,$(PROVIN_REV))
-
-test-provin: setup-provin
-	cd repos/auth.provider && pnpm install --frozen-lockfile && pnpm --filter @o3co/auth-provider-oauth... run build
-	cd repos/auth.policy-verifier && pnpm install --frozen-lockfile && pnpm --filter @o3co/auth.policy-verifier.server... --filter @o3co/auth.policy-verifier.builtins... run build
-	node tests/provin/run.mjs
-
 .PHONY: status
 status:
 	@for dir in repos/auth.provider repos/auth.proxy repos/auth.policy-verifier; do \
diff --git a/docs/internal-adoption.md b/docs/internal-adoption.md
index fc7424a..eee170f 100644
--- a/docs/internal-adoption.md
+++ b/docs/internal-adoption.md
@@ -1,10 +1,5 @@
 # Internal adoption baseline
 
-The actual Provin consumer also has a separate
-[compatibility check](../tests/provin/README.md): `make test-provin`. It tests
-the pinned downstream DID extensions and generated composition roots against
-candidate auth packages without publishing a release.
-
 Start with ordinary Bearer access tokens, the provider's real login and PKCE
 authorization-code flow, and signature-verifying policy evaluation. The E2E
 also covers session-grant issuance and an optional validation proxy. Component
diff --git a/tests/provin/README.md b/tests/provin/README.md
deleted file mode 100644
index 26372b9..0000000
--- a/tests/provin/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# Provin consumer compatibility
-
-`make test-provin` tests actual `provin-line/auth` source pinned in the Makefile
-against the candidate Provider/Verifier revisions used by the Bearer E2E suite.
-It packs the five Provider/Verifier packages, overriding every matching direct
-and transitive dependency. No npm release or image push is needed.
-
-It covers workspace build/typecheck/tests, DID issuance and HTTP policy decisions,
-then generated composition-root build/typecheck/config tests, service startup and
-the generated Provider's valid/tampered DID-signature grant.
-
-`repos/provin.auth` is disposable: its manifest/lockfile are rewritten and
-`instances/` regenerated. Use a fresh checkout for fresh dependency resolution.
-Do not use this test checkout for application work.
-
-The consumer's generated release pins remain unchanged. Deploying the candidate
-fixes requires deliberately using the tested artifacts/revisions and updating
-configuration. This check does not deploy a Provin node, prove registry ACLs or
-exercise a Web/mobile application's login flow.
diff --git a/tests/provin/run.mjs b/tests/provin/run.mjs
deleted file mode 100644
index c5836ea..0000000
--- a/tests/provin/run.mjs
+++ /dev/null
@@ -1,77 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
-
-// npm_execpath also lets local callers select an already installed pnpm CLI.
-const cli = process.env.npm_execpath;
-const root = resolve(import.meta.dirname, "../..");
-const consumer = resolve(root, "repos/provin.auth");
-// Generated workspaces from an earlier run must not enter the source test pass.
-rmSync(resolve(consumer, "instances"), { recursive: true, force: true });
-const artifacts = resolve(consumer, ".auth-compatibility");
-mkdirSync(artifacts, { recursive: true });
-function pnpm(cwd, ...args) {
-  execFileSync(cli ? process.execPath : "pnpm", cli ? [cli, ...args] : args, {
-    cwd,
-    stdio: "inherit",
-    env: { ...process.env, npm_config_manage_package_manager_versions: "false" },
-  });
-}
-
-// Pack the real build output. pnpm pack rewrites workspace:* dependencies;
-// overrides then replace every upstream dependency, including transitive ones.
-// Directories are relative to the cloned repo root. @o3co/auth.utils is no
-// longer packed: Provin's scaffolds stopped emitting it (provin-line/auth#22),
-// which was the package's last consumer across the family.
-const packages = [
-  ["auth.provider", "packages/core"],
-  ["auth.provider", "packages/oauth"],
-  ["auth.policy-verifier", "packages/core"],
-  ["auth.policy-verifier", "packages/builtins"],
-  ["auth.policy-verifier", "packages/server"],
-];
-const manifestPath = resolve(consumer, "package.json");
-const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-manifest.pnpm ??= {};
-manifest.pnpm.overrides ??= {};
-for (const [repo, directory] of packages) {
-  const cwd = resolve(root, "repos", repo, directory);
-  const { name, version } = JSON.parse(readFileSync(resolve(cwd, "package.json"), "utf8"));
-  pnpm(cwd, "pack", "--pack-destination", artifacts);
-  const archive = `${name.replace(/^@/, "").replaceAll("/", "-")}-${version}.tgz`;
-  manifest.pnpm.overrides[name] = `file:./.auth-compatibility/${archive}`;
-}
-writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
-
-// The consumer's original lock remains the baseline for other dependencies.
-// Only this disposable checkout is changed; no package or image is published.
-pnpm(consumer, "install", "--no-frozen-lockfile");
-pnpm(consumer, "-r", "run", "build");
-pnpm(consumer, "-r", "--if-present", "run", "typecheck");
-pnpm(consumer, "-r", "run", "test");
-
-// Also exercise generated composition roots: their configuration and explicit
-// module wiring are a separate contract from the hand-built integration fixture.
-const ref = execFileSync("git", ["rev-parse", "HEAD"], { cwd: consumer, encoding: "utf8" }).trim();
-for (const [generator, name] of [
-  ["create-provider", "provider"],
-  ["create-policy-verifier", "policy-verifier"],
-]) {
-  execFileSync(process.execPath, [
-    `packages/${generator}/dist/cli.mjs`, name,
-    "--dplaax-module-ref", ref, "--out", `instances/${name}`, "--no-git-init",
-  ], { cwd: consumer, stdio: "inherit" });
-}
-pnpm(consumer, "install", "--no-frozen-lockfile");
-for (const task of ["build", "typecheck", "test"]) {
-  pnpm(consumer, "--filter", "./instances/*", "--if-present", "run", task);
-}
-for (const [name, port, path] of [
-  ["provider", "3000", "/_healthcheck"],
-  ["policy-verifier", "3001", "/healthcheck"],
-]) {
-  execFileSync("bash", ["scripts/smoke-instance.sh", `instances/${name}`, port, path],
-    { cwd: consumer, stdio: "inherit" });
-}
-execFileSync(process.execPath, ["scripts/smoke-did-grant.mjs", "instances/provider", "3100"],
-  { cwd: consumer, stdio: "inherit" });