Reserved fixture access tokens force portable scenarios while each provider keeps its own error envelope:

TokenVendor responseExpected normalized code
fixture:EXPIRED_TOKEN401auth_expired
fixture:INSUFFICIENT_SCOPE_TOKEN403auth_insufficient_scope
fixture:RATE_LIMITED_TOKEN429 plus retry metadatarate_limited

Configure the token through MockCredentialProvider and call the normal executor. The provider mock must not return a NormalizedToolError itself; the adapter proves the mapping.

JSON
{
  "code": "rate_limited",
  "message": "The provider rate limit was reached.",
  "retryable": true,
  "retryAfter": 1
}

Scenarios also cover missing resources, provider outages, malformed provider payloads, timeouts before side effect, unsupported operations, and refresh rejection. Assert that no fixture secret, authorization header, or raw unsafe provider body escapes into error details.

Use the error taxonomy as the assertion checklist.