@@ -36,10 +36,16 @@ environment and lockfile; it never supplies the agent's SDK package. It writes `
 `build/tck/v2.json`, `build/tck/manifest.json`, and a detailed log for each suite.
 
 The v1 lane is a CI gate: the official TCK verdict and every mandatory test outcome must pass.
-This catches cancellation tests that TCK's aggregate verdict would otherwise allow to skip. The
-v2 lane always runs and reports its current behavior. Even with the alpha.5 TCK, the SDK
-currently fails mandatory version-negotiation and batch-response checks, so v2 is not yet a CI
-gate. Its failures remain visible in the report. Promote it after those SDK behaviors are fixed.
+This catches cancellation tests that TCK's aggregate verdict would otherwise allow to skip.
+
+The v2 lane gates mandatory outcomes only: any `MANDATORY` `FAIL`, `NOT_TESTED`, or unexpected
+`SKIPPED` requirement fails CI. The two conditional auth checks `ACP-AUTH-206` and `ACP-AUTH-207`
+are the sole exception — alpha.5 skips them when the agent advertises no auth methods, and the
+runner accepts those skips only when the fixture reports no `auth` capability and each skip's
+node id and reason match the pinned text. The v2 lane does not gate the TCK's own verdict (which
+also folds in `CAPABILITY` failures) and never gates `ADVISORY` results, which stay as advisory
+reporting.
+
 The CI job uploads all reports and logs even when its gate fails.
 
 The probes advertise only the capabilities they implement. Optional capability tests that remain
 
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import ast
 import json
 import shutil
 import subprocess
@@ -21,6 +22,20 @@
 }
 CANCEL_PROMPT = "wait_for_cancel"
 
+# The only v2 MANDATORY SKIPs the gate accepts: alpha.5's two conditional auth checks, which have
+# nothing to inspect unless the agent advertises auth methods. Pinned per requirement id to the test
+# that must skip and its exact reason, so any other MANDATORY SKIP fails CI.
+V2_PINNED_SKIPS = {
+    "ACP-AUTH-206": (
+        "test_authentication.py::test_auth_method_type_is_a_defined_or_prefixed_value",
+        "Skipped: agent advertises no authMethods",
+    ),
+    "ACP-AUTH-207": (
+        "test_authentication.py::test_terminal_auth_method_descriptor_shape",
+        "Skipped: agent advertises no type=='terminal' authMethods entry; nothing to check",
+    ),
+}
+
 
 def executable(name: str) -> str:
     path = shutil.which(name)
@@ -80,11 +95,60 @@ def run_suite(tck_dir: Path, output_dir: Path, python: Path, version: int, timeo
         ).returncode
 
 
-def check_mandatory(requirements: list[dict[str, Any]], version: int) -> list[str]:
+def advertises_auth(capabilities: Any) -> bool:
+    """Whether the report's recorded initialize capabilities advertise agent-side auth support.
+
+    Fail-closed: capabilities that are missing or not an object count as advertising auth, so an
+    unverifiable fixture can never unlock the pinned skip.
+    """
+    return not (isinstance(capabilities, dict) and capabilities.get("auth") is None)
+
+
+def skip_reason(message: Any) -> str | None:
+    """The `Skipped: ...` reason inside a TCK test message.
+
+    alpha.5 records a message as the repr of `(file, line, reason)`; fall back to the raw string
+    so an unrecognised shape can never accidentally match a pinned reason.
+    """
+    if not isinstance(message, str) or not message:
+        return None
+    try:
+        parsed = ast.literal_eval(message)
+    except (SyntaxError, ValueError):
+        return message
+    if isinstance(parsed, tuple) and parsed and isinstance(parsed[-1], str):
+        return parsed[-1]
+    return message
+
+
+def pinned_auth_skip(requirement: dict[str, Any], version: int, report: dict[str, Any]) -> bool:
+    """True if this MANDATORY SKIP is one of the two pinned alpha.5 conditional auth checks.
+
+    Requires all four conditions: the v2 lane, a requirement the TCK itself marked SKIPPED, a
+    fixture that advertises no auth, and a test whose node id and skip reason match the pin
+    exactly.
+    """
+    pinned = V2_PINNED_SKIPS.get(str(requirement.get("id"))) if version == 2 else None
+    if pinned is None or requirement.get("status") != "SKIPPED":
+        return False
+    if advertises_auth(report.get("agent_capabilities")):
+        return False
+    nodeid, reason = pinned
+    tests = requirement.get("tests", [])
+    return bool(tests) and all(
+        test.get("status") == "SKIPPED" and test.get("nodeid") == nodeid and skip_reason(test.get("message")) == reason
+        for test in tests
+    )
+
+
+def check_mandatory(requirements: list[dict[str, Any]], version: int, report: dict[str, Any]) -> list[str]:
     errors = []
     for item in requirements:
         if item.get("tier") != "MANDATORY":
             continue
+        if pinned_auth_skip(item, version, report):
+            print(f"v{version}: {item['id']} is SKIPPED (pinned conditional auth check)", flush=True)
+            continue
         if item.get("status") != "PASS":
             errors.append(f"v{version}: {item['id']} is {item.get('status')}, expected PASS")
         for test in item.get("tests", []):
@@ -135,10 +199,11 @@ def inspect_report(
         flush=True,
     )
 
-    if strict:
-        if tck_exit != 0 or verdict.get("conformant") is not True:
-            errors.append(f"v{version}: TCK conformance verdict failed")
-        errors.extend(check_mandatory(requirements, version))
+    if strict and (tck_exit != 0 or verdict.get("conformant") is not True):
+        errors.append(f"v{version}: TCK conformance verdict failed")
+    # Both lanes gate MANDATORY outcomes; only the v1 lane additionally requires the TCK's own
+    # verdict, which also folds in CAPABILITY failures. ADVISORY results are never gated.
+    errors.extend(check_mandatory(requirements, version, report))
     return errors, report
 
 
 
@@ -0,0 +1,105 @@
+"""The v2 MANDATORY gate in `scripts/run_tck.py`, and its two pinned alpha.5 auth skips.
+
+`scripts/run_tck.py` drives an external TCK checkout, so these tests call `check_mandatory`
+directly with synthetic requirement rows instead of running a suite.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+import pytest
+
+from scripts.run_tck import V2_PINNED_SKIPS, check_mandatory
+
+NO_AUTH_CAPABILITIES = {"session": {}}
+
+
+def skipped(requirement_id: str, *, nodeid: str, reason: str) -> dict[str, Any]:
+    return {
+        "id": requirement_id,
+        "tier": "MANDATORY",
+        "status": "SKIPPED",
+        "tests": [{"nodeid": nodeid, "status": "SKIPPED", "message": repr(("/tck/test_authentication.py", 1, reason))}],
+    }
+
+
+def pinned_row(requirement_id: str) -> dict[str, Any]:
+    nodeid, reason = V2_PINNED_SKIPS[requirement_id]
+    return skipped(requirement_id, nodeid=nodeid, reason=reason)
+
+
+def report(capabilities: Any = NO_AUTH_CAPABILITIES) -> dict[str, Any]:
+    return {"agent_capabilities": capabilities}
+
+
+def test_both_pinned_auth_skips_are_accepted_for_an_unauthenticated_v2_fixture() -> None:
+    rows = [pinned_row("ACP-AUTH-206"), pinned_row("ACP-AUTH-207")]
+    assert check_mandatory(rows, 2, report()) == []
+
+
+@pytest.mark.parametrize("requirement_id", ["ACP-AUTH-206", "ACP-AUTH-207"])
+def test_pin_requires_the_exact_skip_reason(requirement_id: str) -> None:
+    nodeid, reason = V2_PINNED_SKIPS[requirement_id]
+    row = skipped(requirement_id, nodeid=nodeid, reason=f"{reason} -- but for a different reason")
+    assert check_mandatory([row], 2, report()) != []
+
+
+@pytest.mark.parametrize("requirement_id", ["ACP-AUTH-206", "ACP-AUTH-207"])
+def test_pin_requires_a_fixture_that_advertises_no_auth(requirement_id: str) -> None:
+    row = pinned_row(requirement_id)
+    assert check_mandatory([row], 2, report({"session": {}, "auth": {"terminal": {}}})) != []
+
+
+@pytest.mark.parametrize("capabilities", [{}, {"auth": None}])
+def test_pin_accepts_capabilities_that_report_no_auth(capabilities: Any) -> None:
+    rows = [pinned_row("ACP-AUTH-206"), pinned_row("ACP-AUTH-207")]
+    assert check_mandatory(rows, 2, report(capabilities)) == []
+
+
+@pytest.mark.parametrize(
+    "capabilities",
+    [None, [], "unexpected"],
+    ids=["missing", "wrong-type", "string"],
+)
+def test_pin_fails_closed_on_unverifiable_capabilities(capabilities: Any) -> None:
+    rows = [pinned_row("ACP-AUTH-206"), pinned_row("ACP-AUTH-207")]
+    assert check_mandatory(rows, 2, report(capabilities)) != []
+
+
+def test_unpinned_mandatory_skip_still_fails_v2() -> None:
+    row = skipped("ACP-AUTH-202", nodeid="test_authentication.py::test_other", reason="Skipped: anything")
+    assert check_mandatory([row], 2, report()) != []
+
+
+def test_pinned_skip_fails_on_the_v1_lane() -> None:
+    assert check_mandatory([pinned_row("ACP-AUTH-206")], 1, report()) != []
+
+
+def test_fail_row_with_pinned_id_reason_and_nodeid_is_rejected() -> None:
+    """A FAIL row carrying a pinned id, node id, and reason must not unlock the gate.
+
+    `pinned_auth_skip` also requires the requirement's own status to be SKIPPED, so a corrupted
+    row whose tests all claim SKIPPED but whose aggregate verdict is FAIL stays gated.
+    """
+    requirement_id = "ACP-AUTH-206"
+    nodeid, reason = V2_PINNED_SKIPS[requirement_id]
+    row = pinned_row(requirement_id) | {"status": "FAIL"}
+    errors = check_mandatory([row], 2, report())
+    assert f"v2: {requirement_id} is FAIL, expected PASS" in errors
+    assert f"v2: {nodeid} is SKIPPED, expected PASS" in errors
+
+
+def test_mandatory_fail_and_not_tested_still_fail_v2() -> None:
+    failed = {"id": "ACP-BATCH-201", "tier": "MANDATORY", "status": "FAIL", "tests": []}
+    not_tested = {"id": "ACP-INIT-201", "tier": "MANDATORY", "status": "NOT_TESTED", "tests": []}
+    assert check_mandatory([failed, not_tested], 2, report()) != []
+
+
+def test_advisory_and_other_tiers_are_never_gated() -> None:
+    rows = [
+        {"id": "ACP-AUTH-201", "tier": "ADVISORY", "status": "FAIL", "tests": []},
+        {"id": "ACP-SESSION-004", "tier": "ADVISORY", "status": "SKIPPED", "tests": []},
+        {"id": "ACP-AUTH-203", "tier": "CAPABILITY", "status": "SKIPPED", "tests": []},
+    ]
+    assert check_mandatory(rows, 2, report()) == []