{
  "schema_version": 1,
  "fixture_version": "1.0.0",
  "started_at": "2026-11-10T22:46:41.801562+00:00",
  "method": "Real curl subprocesses against locally spawned fixture servers, one fresh server per scenario",
  "limiter": {
    "limit": 5,
    "window_seconds": 60
  },
  "scope": {
    "hosts": [
      "127.0.0.1"
    ],
    "methods": [
      "POST"
    ],
    "paths": [
      "/login"
    ],
    "data": "Two synthetic accounts; all passwords are public demo values; X-Forwarded-For values are TEST-NET documentation addresses"
  },
  "versions": {
    "python": "3.15.2",
    "os": "Darwin",
    "architecture": "arm64",
    "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0"
  },
  "sha256": {
    "fixture.py": "a705c7965e4fcb247a0fd1540d6d067013b7c7e79c59a1d79d8454f115ae3a46",
    "verify.py": "3d32432af1717d8d889142958c137cf59019e09c2cbee66aeb03a613cd109965"
  },
  "reproduction_command": "python3 verify.py --output recorded-run",
  "agent_execution": {
    "executed": false,
    "note": "HTTP verification was scripted; no model or agent ran"
  },
  "cases": [
    {
      "id": "vulnerable/same-header/try-01",
      "started_at": "2026-11-10T22:46:41.843615+00:00",
      "elapsed_ms": 7.547,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53052"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-01\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53052/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-same-header-try-01.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/same-header/try-02",
      "started_at": "2026-11-10T22:46:41.851370+00:00",
      "elapsed_ms": 6.678,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53052"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-02\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53052/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-same-header-try-02.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/same-header/try-03",
      "started_at": "2026-11-10T22:46:41.858104+00:00",
      "elapsed_ms": 6.895,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53052"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-03\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53052/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-same-header-try-03.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/same-header/try-04",
      "started_at": "2026-11-10T22:46:41.865058+00:00",
      "elapsed_ms": 6.477,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53052"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-04\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53052/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-same-header-try-04.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/same-header/try-05",
      "started_at": "2026-11-10T22:46:41.871590+00:00",
      "elapsed_ms": 5.995,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53052"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-05\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53052/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-same-header-try-05.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/same-header/try-06",
      "started_at": "2026-11-10T22:46:41.877631+00:00",
      "elapsed_ms": 6.194,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53052"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-06\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53052/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": null,
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-same-header-try-06.http",
      "response_sha256": "66cb5e6284530779a82d7cf4c1817e5318cc848b2af5ce8a45b21bcd00e50f40"
    },
    {
      "id": "vulnerable/rotating-header/try-01",
      "started_at": "2026-11-10T22:46:41.918276+00:00",
      "elapsed_ms": 7.223,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-01\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.1",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.1",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-01.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-02",
      "started_at": "2026-11-10T22:46:41.925561+00:00",
      "elapsed_ms": 6.278,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-02\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.2",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.2",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-02.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-03",
      "started_at": "2026-11-10T22:46:41.931885+00:00",
      "elapsed_ms": 5.828,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-03\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.3",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.3",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-03.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-04",
      "started_at": "2026-11-10T22:46:41.937768+00:00",
      "elapsed_ms": 6.704,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-04\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.4",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.4",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-04.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-05",
      "started_at": "2026-11-10T22:46:41.944533+00:00",
      "elapsed_ms": 13.609,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-05\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.5",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.5",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-05.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-06",
      "started_at": "2026-11-10T22:46:41.958339+00:00",
      "elapsed_ms": 14.909,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-06\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.6",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.6",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-06.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-07",
      "started_at": "2026-11-10T22:46:41.973320+00:00",
      "elapsed_ms": 9.138,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-07\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.7",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-07.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-08",
      "started_at": "2026-11-10T22:46:41.982559+00:00",
      "elapsed_ms": 8.44,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-08\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.8",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.8",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-08.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-09",
      "started_at": "2026-11-10T22:46:41.991073+00:00",
      "elapsed_ms": 7.075,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-09\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.9",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.9",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-09.http",
      "response_sha256": "283300492a9f80ba5644a48870d4fd11cc48d8e4aab3c0d41d0930b8175e34f4"
    },
    {
      "id": "vulnerable/rotating-header/try-10",
      "started_at": "2026-11-10T22:46:41.998212+00:00",
      "elapsed_ms": 6.45,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-10\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.10",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.10",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-10.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-11",
      "started_at": "2026-11-10T22:46:42.004710+00:00",
      "elapsed_ms": 5.761,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-11\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.11",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.11",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-11.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-12",
      "started_at": "2026-11-10T22:46:42.010517+00:00",
      "elapsed_ms": 5.655,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-12\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.12",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.12",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-12.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-13",
      "started_at": "2026-11-10T22:46:42.016215+00:00",
      "elapsed_ms": 5.701,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-13\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.13",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.13",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-13.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-14",
      "started_at": "2026-11-10T22:46:42.021967+00:00",
      "elapsed_ms": 6.464,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-14\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.14",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.14",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-14.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-15",
      "started_at": "2026-11-10T22:46:42.028479+00:00",
      "elapsed_ms": 6.658,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-15\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.15",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.15",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-15.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-16",
      "started_at": "2026-11-10T22:46:42.035188+00:00",
      "elapsed_ms": 6.99,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-16\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.16",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.16",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-16.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-17",
      "started_at": "2026-11-10T22:46:42.042227+00:00",
      "elapsed_ms": 7.378,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-17\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.17",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.17",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-17.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-18",
      "started_at": "2026-11-10T22:46:42.049663+00:00",
      "elapsed_ms": 7.894,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-18\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.18",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.18",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-18.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-19",
      "started_at": "2026-11-10T22:46:42.057627+00:00",
      "elapsed_ms": 8.079,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-19\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.19",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.19",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-19.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "vulnerable/rotating-header/try-20",
      "started_at": "2026-11-10T22:46:42.065765+00:00",
      "elapsed_ms": 6.713,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53059"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"demo-passphrase-alice\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.20",
        "http://127.0.0.1:53059/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.20",
      "expected_status": 200,
      "observed_status": 200,
      "retry_after": null,
      "observed_body": {
        "status": "ok",
        "user": "alice"
      },
      "matches_expectation": true,
      "response_file": "vulnerable-rotating-header-try-20.http",
      "response_sha256": "504d3800f137ed8ed7cb636ca2e16052687d2369b2de3c23f8a9ed51badd84e6"
    },
    {
      "id": "fixed/same-header/try-01",
      "started_at": "2026-11-10T22:46:42.106568+00:00",
      "elapsed_ms": 6.921,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53081"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-01\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53081/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-same-header-try-01.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/same-header/try-02",
      "started_at": "2026-11-10T22:46:42.113550+00:00",
      "elapsed_ms": 6.555,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53081"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-02\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53081/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-same-header-try-02.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/same-header/try-03",
      "started_at": "2026-11-10T22:46:42.120156+00:00",
      "elapsed_ms": 7.527,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53081"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-03\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53081/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-same-header-try-03.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/same-header/try-04",
      "started_at": "2026-11-10T22:46:42.127749+00:00",
      "elapsed_ms": 8.175,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53081"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-04\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53081/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-same-header-try-04.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/same-header/try-05",
      "started_at": "2026-11-10T22:46:42.135984+00:00",
      "elapsed_ms": 7.146,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53081"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-05\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53081/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-same-header-try-05.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/same-header/try-06",
      "started_at": "2026-11-10T22:46:42.143188+00:00",
      "elapsed_ms": 6.808,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53081"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-06\"}",
        "--header",
        "X-Forwarded-For: 203.0.113.7",
        "http://127.0.0.1:53081/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "203.0.113.7",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-same-header-try-06.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-01",
      "started_at": "2026-11-10T22:46:42.185377+00:00",
      "elapsed_ms": 7.084,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-01\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.1",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.1",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-01.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/rotating-header/try-02",
      "started_at": "2026-11-10T22:46:42.192529+00:00",
      "elapsed_ms": 6.176,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-02\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.2",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.2",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-02.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/rotating-header/try-03",
      "started_at": "2026-11-10T22:46:42.198751+00:00",
      "elapsed_ms": 5.874,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-03\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.3",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.3",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-03.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/rotating-header/try-04",
      "started_at": "2026-11-10T22:46:42.204670+00:00",
      "elapsed_ms": 6.273,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-04\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.4",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.4",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-04.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/rotating-header/try-05",
      "started_at": "2026-11-10T22:46:42.210992+00:00",
      "elapsed_ms": 6.354,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-05\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.5",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.5",
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-05.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/rotating-header/try-06",
      "started_at": "2026-11-10T22:46:42.217393+00:00",
      "elapsed_ms": 6.054,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-06\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.6",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.6",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-06.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-07",
      "started_at": "2026-11-10T22:46:42.223497+00:00",
      "elapsed_ms": 5.873,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-07\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.7",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.7",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-07.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-08",
      "started_at": "2026-11-10T22:46:42.229421+00:00",
      "elapsed_ms": 6.048,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-08\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.8",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.8",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-08.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-09",
      "started_at": "2026-11-10T22:46:42.235522+00:00",
      "elapsed_ms": 6.419,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-09\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.9",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.9",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-09.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-10",
      "started_at": "2026-11-10T22:46:42.241988+00:00",
      "elapsed_ms": 5.687,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-10\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.10",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.10",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-10.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-11",
      "started_at": "2026-11-10T22:46:42.247720+00:00",
      "elapsed_ms": 5.842,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-11\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.11",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.11",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-11.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-12",
      "started_at": "2026-11-10T22:46:42.253608+00:00",
      "elapsed_ms": 5.469,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-12\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.12",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.12",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-12.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-13",
      "started_at": "2026-11-10T22:46:42.259124+00:00",
      "elapsed_ms": 5.997,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-13\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.13",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.13",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-13.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-14",
      "started_at": "2026-11-10T22:46:42.265167+00:00",
      "elapsed_ms": 5.878,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-14\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.14",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.14",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-14.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-15",
      "started_at": "2026-11-10T22:46:42.271094+00:00",
      "elapsed_ms": 5.84,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-15\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.15",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.15",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-15.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-16",
      "started_at": "2026-11-10T22:46:42.276980+00:00",
      "elapsed_ms": 6.076,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-16\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.16",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.16",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-16.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-17",
      "started_at": "2026-11-10T22:46:42.283100+00:00",
      "elapsed_ms": 5.73,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-17\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.17",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.17",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-17.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-18",
      "started_at": "2026-11-10T22:46:42.288874+00:00",
      "elapsed_ms": 6.19,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-18\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.18",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.18",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-18.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-19",
      "started_at": "2026-11-10T22:46:42.295112+00:00",
      "elapsed_ms": 5.514,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-19\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.19",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.19",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-19.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/try-20",
      "started_at": "2026-11-10T22:46:42.300668+00:00",
      "elapsed_ms": 5.459,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"demo-passphrase-alice\"}",
        "--header",
        "X-Forwarded-For: 198.51.100.20",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": "198.51.100.20",
      "expected_status": 429,
      "observed_status": 429,
      "retry_after": "60",
      "observed_body": {
        "error": "too_many_requests"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-try-20.http",
      "response_sha256": "8e622c43b08451a5152184eb08b4f21a8c91c0080e0b62fb3484b41df7b3da79"
    },
    {
      "id": "fixed/rotating-header/bob-correct-after",
      "started_at": "2026-11-10T22:46:42.306169+00:00",
      "elapsed_ms": 5.599,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53088"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"bob\", \"password\": \"demo-passphrase-bob\"}",
        "http://127.0.0.1:53088/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "bob",
      "x_forwarded_for": null,
      "expected_status": 200,
      "observed_status": 200,
      "retry_after": null,
      "observed_body": {
        "status": "ok",
        "user": "bob"
      },
      "matches_expectation": true,
      "response_file": "fixed-rotating-header-bob-correct-after.http",
      "response_sha256": "b9b3c7cbeb803ef7d16c47b87d5e8d3eb9691847f05224d8c5a9be6ca91b2974"
    },
    {
      "id": "fixed/controls/alice-correct",
      "started_at": "2026-11-10T22:46:42.344789+00:00",
      "elapsed_ms": 6.752,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53111"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"demo-passphrase-alice\"}",
        "http://127.0.0.1:53111/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": null,
      "expected_status": 200,
      "observed_status": 200,
      "retry_after": null,
      "observed_body": {
        "status": "ok",
        "user": "alice"
      },
      "matches_expectation": true,
      "response_file": "fixed-controls-alice-correct.http",
      "response_sha256": "504d3800f137ed8ed7cb636ca2e16052687d2369b2de3c23f8a9ed51badd84e6"
    },
    {
      "id": "fixed/controls/alice-wrong",
      "started_at": "2026-11-10T22:46:42.351605+00:00",
      "elapsed_ms": 6.463,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53111"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"alice\", \"password\": \"wrong-guess-01\"}",
        "http://127.0.0.1:53111/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "alice",
      "x_forwarded_for": null,
      "expected_status": 401,
      "observed_status": 401,
      "retry_after": null,
      "observed_body": {
        "error": "invalid_credentials"
      },
      "matches_expectation": true,
      "response_file": "fixed-controls-alice-wrong.http",
      "response_sha256": "a6ef2f4854e663eb37dd378eb2863d9e83d39c5fc4efd0b49b52e8d666093fc5"
    },
    {
      "id": "fixed/controls/bob-correct",
      "started_at": "2026-11-10T22:46:42.358121+00:00",
      "elapsed_ms": 6.526,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53111"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"username\": \"bob\", \"password\": \"demo-passphrase-bob\"}",
        "http://127.0.0.1:53111/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "username": "bob",
      "x_forwarded_for": null,
      "expected_status": 200,
      "observed_status": 200,
      "retry_after": null,
      "observed_body": {
        "status": "ok",
        "user": "bob"
      },
      "matches_expectation": true,
      "response_file": "fixed-controls-bob-correct.http",
      "response_sha256": "b9b3c7cbeb803ef7d16c47b87d5e8d3eb9691847f05224d8c5a9be6ca91b2974"
    }
  ],
  "failures": [],
  "finished_at": "2026-11-10T22:46:42.366004+00:00",
  "all_checks_passed": true
}