{ "schema_version": 1, "fixture_version": "1.0.0", "started_at": "2026-11-10T22:46:38.702728+00:00", "method": "Real curl subprocesses against four locally spawned fixture configurations", "scope": { "hosts": [ "127.0.0.1" ], "methods": [ "GET", "PUT", "DELETE" ], "paths": [ "/invoices", "/invoices/" ], "data": "Three synthetic invoices and two synthetic users; tokens are public demo values" }, "versions": { "python": "3.15.2", "os": "Darwin", "architecture": "arm64", "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0" }, "sha256": { "fixture.py": "824182a3084f50f12375b3fe7256c58e7fb5ca177f668b4d40680a6c55446322", "verify.py": "fb302b54bbb1564e8552df6685d6756b179d34d27fa882b2fcade951409d4dd3" }, "reproduction_command": "python3 verify.py --output recorded-run", "agent_execution": { "executed": false, "note": "HTTP verification was scripted; no model or agent ran" }, "cases": [ { "id": "sequential-none/alice-lists", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.746605+00:00", "elapsed_ms": 7.483, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52911/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "1002", "owner": "alice", "status": "open" }, { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "1003", "owner": "bob", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": "Alice's own list", "response_file": "sequential-none-alice-lists.http", "response_sha256": "cb1854c87b1eab9bba5b77e2965571a0d943373ee01339dab2f3a76ed6498d68" }, { "id": "sequential-none/bob-lists", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.754156+00:00", "elapsed_ms": 6.191, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "1002", "owner": "alice", "status": "open" }, { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "1003", "owner": "bob", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": "Policy: Bob sees only his invoice", "response_file": "sequential-none-bob-lists.http", "response_sha256": "cb1854c87b1eab9bba5b77e2965571a0d943373ee01339dab2f3a76ed6498d68" }, { "id": "sequential-none/alice-reads-own", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.760415+00:00", "elapsed_ms": 6.652, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52911/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-none-alice-reads-own.http", "response_sha256": "2efb2472869654bb2a8823ade2fccf15c4cbe6efa3347e89471482723f496b3e" }, { "id": "sequential-none/bob-reads-own", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.767119+00:00", "elapsed_ms": 6.39, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1003" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1003", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "1003", "owner": "bob", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-none-bob-reads-own.http", "response_sha256": "d89161aac189fc08d0df03a1ef53b281c631a8719aa40f13f3936de80b2ae69c" }, { "id": "sequential-none/unauthenticated", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.773561+00:00", "elapsed_ms": 6.277, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "http://127.0.0.1:52911/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": null, "method": "GET", "path": "/invoices/1001", "secure_expected_status": 401, "demonstration_expected_status": 401, "observed_status": 401, "observed_body": { "error": "authentication_required" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-none-unauthenticated.http", "response_sha256": "fae7972fc09e8a1bd8e1dc4d6a19532d2e2194e96d274af63b65b9def9a48834" }, { "id": "sequential-none/bob-guesses-1001", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.779893+00:00", "elapsed_ms": 6.19, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": "Numeric guess, not taken from any response", "response_file": "sequential-none-bob-guesses-1001.http", "response_sha256": "2efb2472869654bb2a8823ade2fccf15c4cbe6efa3347e89471482723f496b3e" }, { "id": "sequential-none/bob-guesses-1002", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.786137+00:00", "elapsed_ms": 6.252, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1002", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "1002", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": "Numeric guess, not taken from any response", "response_file": "sequential-none-bob-guesses-1002.http", "response_sha256": "d036e9c9d0066029e02460e6852de004588ab9abd7f95240bf1ba390c3f9f0c8" }, { "id": "sequential-none/bob-guesses-1004", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.792440+00:00", "elapsed_ms": 6.328, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1004" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1004", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "sequential-none-bob-guesses-1004.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "sequential-none/bob-reads-alice", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.798834+00:00", "elapsed_ms": 6.237, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "sequential-none-bob-reads-alice.http", "response_sha256": "2efb2472869654bb2a8823ade2fccf15c4cbe6efa3347e89471482723f496b3e" }, { "id": "sequential-none/bob-updates-alice", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.805119+00:00", "elapsed_ms": 5.712, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-bob-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 1, \"status\": \"paid\"}", "http://127.0.0.1:52911/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "PUT", "path": "/invoices/1001", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 1, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "sequential-none-bob-updates-alice.http", "response_sha256": "b52f76464c3895f8bcc87304005373b8b1a5ef47baa05387379a44dc26980695" }, { "id": "sequential-none/alice-reads-after-update", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.810874+00:00", "elapsed_ms": 5.704, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52911/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 1, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "sequential-none-alice-reads-after-update.http", "response_sha256": "b52f76464c3895f8bcc87304005373b8b1a5ef47baa05387379a44dc26980695" }, { "id": "sequential-none/bob-deletes-alice", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.816632+00:00", "elapsed_ms": 5.896, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/1002", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "deleted": "1002" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "sequential-none-bob-deletes-alice.http", "response_sha256": "a73e7868e8bd39f2b6c49a6a6118727658bdb7f2e3b55c79d1928447ba75b3a1" }, { "id": "sequential-none/alice-reads-after-delete", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.822573+00:00", "elapsed_ms": 5.994, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52911/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/1002", "secure_expected_status": 200, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "sequential-none-alice-reads-after-delete.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "sequential-none/alice-updates-own", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.828611+00:00", "elapsed_ms": 5.673, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-alice-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 12500, \"status\": \"paid\"}", "http://127.0.0.1:52911/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "PUT", "path": "/invoices/1001", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-none-alice-updates-own.http", "response_sha256": "945ad35d9163188dab8228d78316e479fd9fb2976461c91d29874a98643cd087" }, { "id": "sequential-none/bob-deletes-own", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.834327+00:00", "elapsed_ms": 5.427, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1003" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/1003", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "deleted": "1003" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-none-bob-deletes-own.http", "response_sha256": "1258077379db62272af0c7b62d58113e43ccadac7453c48503b12bb1e2efc4c8" }, { "id": "sequential-none/bob-reads-own-after-delete", "config": { "ids": "sequential", "authz": "none" }, "started_at": "2026-11-10T22:46:38.839797+00:00", "elapsed_ms": 6.676, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "none", "base_url": "http://127.0.0.1:52911" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52911/invoices/1003" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1003", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-none-bob-reads-own-after-delete.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "uuid-none/alice-lists", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.882198+00:00", "elapsed_ms": 8.017, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52929/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "be29ac11-01ad-48dc-b414-481312e18f87", "owner": "alice", "status": "open" }, { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "cfcab13e-0ef7-40e4-96ab-60d679e4bb31", "owner": "alice", "status": "open" }, { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "352711e1-9dae-450d-abe7-f2cc9b668f10", "owner": "bob", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": "Alice's own list", "response_file": "uuid-none-alice-lists.http", "response_sha256": "4f996cf83bbefdbf1a092f98f36a37b547fa4866abdf5631d2df5c289f803dde" }, { "id": "uuid-none/bob-lists", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.890279+00:00", "elapsed_ms": 7.433, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "be29ac11-01ad-48dc-b414-481312e18f87", "owner": "alice", "status": "open" }, { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "cfcab13e-0ef7-40e4-96ab-60d679e4bb31", "owner": "alice", "status": "open" }, { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "352711e1-9dae-450d-abe7-f2cc9b668f10", "owner": "bob", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": "Policy: Bob sees only his invoice", "response_file": "uuid-none-bob-lists.http", "response_sha256": "4f996cf83bbefdbf1a092f98f36a37b547fa4866abdf5631d2df5c289f803dde" }, { "id": "uuid-none/alice-reads-own", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.897779+00:00", "elapsed_ms": 9.786, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52929/invoices/be29ac11-01ad-48dc-b414-481312e18f87" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/be29ac11-01ad-48dc-b414-481312e18f87", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "be29ac11-01ad-48dc-b414-481312e18f87", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-none-alice-reads-own.http", "response_sha256": "7177c97b5c1674e4eba1bff8e3718aae97e03a762e4ab434d93283b4fc40031e" }, { "id": "uuid-none/bob-reads-own", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.907632+00:00", "elapsed_ms": 7.047, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/352711e1-9dae-450d-abe7-f2cc9b668f10" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/352711e1-9dae-450d-abe7-f2cc9b668f10", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "352711e1-9dae-450d-abe7-f2cc9b668f10", "owner": "bob", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-none-bob-reads-own.http", "response_sha256": "868ae4ee1f4f03c1ebb45d1cee8ba749017d5c81e9200a58962e8eefa402221a" }, { "id": "uuid-none/unauthenticated", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.914742+00:00", "elapsed_ms": 6.783, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "http://127.0.0.1:52929/invoices/be29ac11-01ad-48dc-b414-481312e18f87" ], "curl_exit_code": 0, "stderr": "", "identity": null, "method": "GET", "path": "/invoices/be29ac11-01ad-48dc-b414-481312e18f87", "secure_expected_status": 401, "demonstration_expected_status": 401, "observed_status": 401, "observed_body": { "error": "authentication_required" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-none-unauthenticated.http", "response_sha256": "fae7972fc09e8a1bd8e1dc4d6a19532d2e2194e96d274af63b65b9def9a48834" }, { "id": "uuid-none/bob-guesses-1001", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.921577+00:00", "elapsed_ms": 6.048, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "uuid-none-bob-guesses-1001.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "uuid-none/bob-guesses-1002", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.927677+00:00", "elapsed_ms": 6.072, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1002", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "uuid-none-bob-guesses-1002.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "uuid-none/bob-guesses-1004", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.933794+00:00", "elapsed_ms": 5.704, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/1004" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1004", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "uuid-none-bob-guesses-1004.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "uuid-none/bob-reads-alice", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.939540+00:00", "elapsed_ms": 6.885, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/be29ac11-01ad-48dc-b414-481312e18f87" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/be29ac11-01ad-48dc-b414-481312e18f87", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "be29ac11-01ad-48dc-b414-481312e18f87", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "uuid-none-bob-reads-alice.http", "response_sha256": "7177c97b5c1674e4eba1bff8e3718aae97e03a762e4ab434d93283b4fc40031e" }, { "id": "uuid-none/bob-updates-alice", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.946479+00:00", "elapsed_ms": 6.604, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-bob-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 1, \"status\": \"paid\"}", "http://127.0.0.1:52929/invoices/be29ac11-01ad-48dc-b414-481312e18f87" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "PUT", "path": "/invoices/be29ac11-01ad-48dc-b414-481312e18f87", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 1, "customer": "Acme Synthetic Ltd", "id": "be29ac11-01ad-48dc-b414-481312e18f87", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "uuid-none-bob-updates-alice.http", "response_sha256": "71d57c87e00131bf3e23caf5df6dfe5bc39467154f02412baec31e4afb47d8e1" }, { "id": "uuid-none/alice-reads-after-update", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.953136+00:00", "elapsed_ms": 7.013, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52929/invoices/be29ac11-01ad-48dc-b414-481312e18f87" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/be29ac11-01ad-48dc-b414-481312e18f87", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 1, "customer": "Acme Synthetic Ltd", "id": "be29ac11-01ad-48dc-b414-481312e18f87", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "uuid-none-alice-reads-after-update.http", "response_sha256": "71d57c87e00131bf3e23caf5df6dfe5bc39467154f02412baec31e4afb47d8e1" }, { "id": "uuid-none/bob-deletes-alice", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.960210+00:00", "elapsed_ms": 7.502, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/cfcab13e-0ef7-40e4-96ab-60d679e4bb31" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/cfcab13e-0ef7-40e4-96ab-60d679e4bb31", "secure_expected_status": 403, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "deleted": "cfcab13e-0ef7-40e4-96ab-60d679e4bb31" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "uuid-none-bob-deletes-alice.http", "response_sha256": "8269e1a764fa0c71768f736aca412832651480548dbcd670364d9d9c5ce6591c" }, { "id": "uuid-none/alice-reads-after-delete", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.967759+00:00", "elapsed_ms": 6.498, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52929/invoices/cfcab13e-0ef7-40e4-96ab-60d679e4bb31" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/cfcab13e-0ef7-40e4-96ab-60d679e4bb31", "secure_expected_status": 200, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": false, "note": null, "response_file": "uuid-none-alice-reads-after-delete.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "uuid-none/alice-updates-own", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.974310+00:00", "elapsed_ms": 6.265, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-alice-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 12500, \"status\": \"paid\"}", "http://127.0.0.1:52929/invoices/be29ac11-01ad-48dc-b414-481312e18f87" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "PUT", "path": "/invoices/be29ac11-01ad-48dc-b414-481312e18f87", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "be29ac11-01ad-48dc-b414-481312e18f87", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-none-alice-updates-own.http", "response_sha256": "c5a1afa412594f38b62f0f4c2a2bd6059284c4117307fd5b9867da1d97b78356" }, { "id": "uuid-none/bob-deletes-own", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.980629+00:00", "elapsed_ms": 6.021, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/352711e1-9dae-450d-abe7-f2cc9b668f10" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/352711e1-9dae-450d-abe7-f2cc9b668f10", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "deleted": "352711e1-9dae-450d-abe7-f2cc9b668f10" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-none-bob-deletes-own.http", "response_sha256": "b560cc313ec1018e1be86d965ba27e202f8bc0c1a6530dbe93341f584076d3a8" }, { "id": "uuid-none/bob-reads-own-after-delete", "config": { "ids": "uuid", "authz": "none" }, "started_at": "2026-11-10T22:46:38.986691+00:00", "elapsed_ms": 5.817, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "none", "base_url": "http://127.0.0.1:52929" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52929/invoices/352711e1-9dae-450d-abe7-f2cc9b668f10" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/352711e1-9dae-450d-abe7-f2cc9b668f10", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-none-bob-reads-own-after-delete.http", "response_sha256": "27d191032f07d872c509f6540123fe495b3bec2c4e812cce1a13c81d39631196" }, { "id": "sequential-owner/alice-lists", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.026133+00:00", "elapsed_ms": 7.083, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52948/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "1002", "owner": "alice", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Alice's own list", "response_file": "sequential-owner-alice-lists.http", "response_sha256": "4364601e78298b6997220d190af1d0e983b903a0771cab50be9a338d3b9bc0c5" }, { "id": "sequential-owner/bob-lists", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.033271+00:00", "elapsed_ms": 5.885, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "1003", "owner": "bob", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Policy: Bob sees only his invoice", "response_file": "sequential-owner-bob-lists.http", "response_sha256": "20983b666b0394f0f59df4cc76547d603382afb555b73b0461040a122f9ce2ea" }, { "id": "sequential-owner/alice-reads-own", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.039203+00:00", "elapsed_ms": 6.044, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52948/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-alice-reads-own.http", "response_sha256": "ba65f74ffd1e895047926b2466419ae2d91218d391000c0e4ff21a0acda4c4b7" }, { "id": "sequential-owner/bob-reads-own", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.045288+00:00", "elapsed_ms": 5.508, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1003" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1003", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "1003", "owner": "bob", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-bob-reads-own.http", "response_sha256": "81a3bf4b87847587e2281ae015f7549ba807c08bdb13c7b8892ebc310b6f1a42" }, { "id": "sequential-owner/unauthenticated", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.050832+00:00", "elapsed_ms": 5.824, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "http://127.0.0.1:52948/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": null, "method": "GET", "path": "/invoices/1001", "secure_expected_status": 401, "demonstration_expected_status": 401, "observed_status": 401, "observed_body": { "error": "authentication_required" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-unauthenticated.http", "response_sha256": "6e398a5763811e5bff807438b05c02e824ce141727380a3b14e435d1c8b05ed4" }, { "id": "sequential-owner/bob-guesses-1001", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.056699+00:00", "elapsed_ms": 7.537, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "sequential-owner-bob-guesses-1001.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "sequential-owner/bob-guesses-1002", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.064285+00:00", "elapsed_ms": 6.407, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1002", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "sequential-owner-bob-guesses-1002.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "sequential-owner/bob-guesses-1004", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.070738+00:00", "elapsed_ms": 6.932, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1004" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1004", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "sequential-owner-bob-guesses-1004.http", "response_sha256": "ce6aeaa7a80d430d549ca4bb3802276f178a9414be7172376564471f6fc04374" }, { "id": "sequential-owner/bob-reads-alice", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.077727+00:00", "elapsed_ms": 7.37, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-bob-reads-alice.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "sequential-owner/bob-updates-alice", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.085159+00:00", "elapsed_ms": 7.205, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-bob-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 1, \"status\": \"paid\"}", "http://127.0.0.1:52948/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "PUT", "path": "/invoices/1001", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-bob-updates-alice.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "sequential-owner/alice-reads-after-update", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.092420+00:00", "elapsed_ms": 7.265, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52948/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-alice-reads-after-update.http", "response_sha256": "ba65f74ffd1e895047926b2466419ae2d91218d391000c0e4ff21a0acda4c4b7" }, { "id": "sequential-owner/bob-deletes-alice", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.099739+00:00", "elapsed_ms": 6.709, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/1002", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-bob-deletes-alice.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "sequential-owner/alice-reads-after-delete", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.106501+00:00", "elapsed_ms": 7.505, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52948/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/1002", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "1002", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-alice-reads-after-delete.http", "response_sha256": "4eb8d1d60914210c9884bb1a92bbb1e352eae3f30ee2048d821504c659fe0bb7" }, { "id": "sequential-owner/alice-updates-own", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.114061+00:00", "elapsed_ms": 6.493, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-alice-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 12500, \"status\": \"paid\"}", "http://127.0.0.1:52948/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "PUT", "path": "/invoices/1001", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "1001", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-alice-updates-own.http", "response_sha256": "d599e576caf415a231d2aef1d06a4a83245a3b1fceb9710ee73ffc8e9236923d" }, { "id": "sequential-owner/bob-deletes-own", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.120599+00:00", "elapsed_ms": 5.813, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1003" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/1003", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "deleted": "1003" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-bob-deletes-own.http", "response_sha256": "9c344c8cc5ab53e6ea7d0428bb0c1f988772bd8dd8bdefa7bb5b47e60e762952" }, { "id": "sequential-owner/bob-reads-own-after-delete", "config": { "ids": "sequential", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.126454+00:00", "elapsed_ms": 5.674, "server": { "fixture_version": "1.0.0", "ids": "sequential", "authz": "owner", "base_url": "http://127.0.0.1:52948" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52948/invoices/1003" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1003", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "sequential-owner-bob-reads-own-after-delete.http", "response_sha256": "ce6aeaa7a80d430d549ca4bb3802276f178a9414be7172376564471f6fc04374" }, { "id": "uuid-owner/alice-lists", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.165188+00:00", "elapsed_ms": 7.4, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52965/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "edbb9648-9a48-41b6-bcd9-1987155357f7", "owner": "alice", "status": "open" }, { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "83626556-22dd-4bb6-80f5-3f6e149ada5e", "owner": "alice", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Alice's own list", "response_file": "uuid-owner-alice-lists.http", "response_sha256": "73cb5d30453218f9aae97e0a4f633d8aeb377b912aa591fab2d133b5a71491bb" }, { "id": "uuid-owner/bob-lists", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.172646+00:00", "elapsed_ms": 5.847, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "invoices": [ { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "c075aea6-bd06-4aaf-8417-903fca815b91", "owner": "bob", "status": "open" } ] }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Policy: Bob sees only his invoice", "response_file": "uuid-owner-bob-lists.http", "response_sha256": "dc25806522dab650e2060f7abe5dcef60dedf4cb86a20aad2e2f4d4e67a81feb" }, { "id": "uuid-owner/alice-reads-own", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.178550+00:00", "elapsed_ms": 6.158, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52965/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "edbb9648-9a48-41b6-bcd9-1987155357f7", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-alice-reads-own.http", "response_sha256": "67637f13c07a100ea3deae5608b3bd579882b69e8896f829b1285d8d3f4982e7" }, { "id": "uuid-owner/bob-reads-own", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.184757+00:00", "elapsed_ms": 6.235, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/c075aea6-bd06-4aaf-8417-903fca815b91" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/c075aea6-bd06-4aaf-8417-903fca815b91", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 3100, "customer": "Bobs Example Shop", "id": "c075aea6-bd06-4aaf-8417-903fca815b91", "owner": "bob", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-bob-reads-own.http", "response_sha256": "eb1b518556b9bb5cb5366c8af0e51e9479856d4c1dd149403755d32b3b62f7e3" }, { "id": "uuid-owner/unauthenticated", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.191045+00:00", "elapsed_ms": 6.251, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "http://127.0.0.1:52965/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7" ], "curl_exit_code": 0, "stderr": "", "identity": null, "method": "GET", "path": "/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7", "secure_expected_status": 401, "demonstration_expected_status": 401, "observed_status": 401, "observed_body": { "error": "authentication_required" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-unauthenticated.http", "response_sha256": "6e398a5763811e5bff807438b05c02e824ce141727380a3b14e435d1c8b05ed4" }, { "id": "uuid-owner/bob-guesses-1001", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.197345+00:00", "elapsed_ms": 6.094, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/1001" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1001", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "uuid-owner-bob-guesses-1001.http", "response_sha256": "ce6aeaa7a80d430d549ca4bb3802276f178a9414be7172376564471f6fc04374" }, { "id": "uuid-owner/bob-guesses-1002", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.203490+00:00", "elapsed_ms": 6.701, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/1002" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1002", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "uuid-owner-bob-guesses-1002.http", "response_sha256": "ce6aeaa7a80d430d549ca4bb3802276f178a9414be7172376564471f6fc04374" }, { "id": "uuid-owner/bob-guesses-1004", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.210246+00:00", "elapsed_ms": 6.989, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/1004" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/1004", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": "Numeric guess, not taken from any response", "response_file": "uuid-owner-bob-guesses-1004.http", "response_sha256": "ce6aeaa7a80d430d549ca4bb3802276f178a9414be7172376564471f6fc04374" }, { "id": "uuid-owner/bob-reads-alice", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.217295+00:00", "elapsed_ms": 6.249, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-bob-reads-alice.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "uuid-owner/bob-updates-alice", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.223597+00:00", "elapsed_ms": 6.885, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-bob-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 1, \"status\": \"paid\"}", "http://127.0.0.1:52965/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "PUT", "path": "/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-bob-updates-alice.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "uuid-owner/alice-reads-after-update", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.230535+00:00", "elapsed_ms": 6.482, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52965/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "edbb9648-9a48-41b6-bcd9-1987155357f7", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-alice-reads-after-update.http", "response_sha256": "67637f13c07a100ea3deae5608b3bd579882b69e8896f829b1285d8d3f4982e7" }, { "id": "uuid-owner/bob-deletes-alice", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.237066+00:00", "elapsed_ms": 6.451, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/83626556-22dd-4bb6-80f5-3f6e149ada5e" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/83626556-22dd-4bb6-80f5-3f6e149ada5e", "secure_expected_status": 403, "demonstration_expected_status": 403, "observed_status": 403, "observed_body": { "error": "forbidden" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-bob-deletes-alice.http", "response_sha256": "596558059fa71f953786fed495911b1553cfec56e5e0ca9bf4a86fbd0b57ad5c" }, { "id": "uuid-owner/alice-reads-after-delete", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.243564+00:00", "elapsed_ms": 6.102, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-alice-token", "http://127.0.0.1:52965/invoices/83626556-22dd-4bb6-80f5-3f6e149ada5e" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "GET", "path": "/invoices/83626556-22dd-4bb6-80f5-3f6e149ada5e", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 8400, "customer": "Acme Synthetic Ltd", "id": "83626556-22dd-4bb6-80f5-3f6e149ada5e", "owner": "alice", "status": "open" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-alice-reads-after-delete.http", "response_sha256": "8295716933d6ab42fb523982e909b3099151e1d880d33991a7eb3f4271f35329" }, { "id": "uuid-owner/alice-updates-own", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.249725+00:00", "elapsed_ms": 6.176, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "PUT", "--header", "Authorization: Bearer demo-alice-token", "--header", "Content-Type: application/json", "--data", "{\"amount_cents\": 12500, \"status\": \"paid\"}", "http://127.0.0.1:52965/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7" ], "curl_exit_code": 0, "stderr": "", "identity": "alice", "method": "PUT", "path": "/invoices/edbb9648-9a48-41b6-bcd9-1987155357f7", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "amount_cents": 12500, "customer": "Acme Synthetic Ltd", "id": "edbb9648-9a48-41b6-bcd9-1987155357f7", "owner": "alice", "status": "paid" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-alice-updates-own.http", "response_sha256": "57b0d1317115c702b59b9d6a2ef2a1e62b8bbc1cb46d8966255d6d2e9603b98c" }, { "id": "uuid-owner/bob-deletes-own", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.255947+00:00", "elapsed_ms": 6.324, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "DELETE", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/c075aea6-bd06-4aaf-8417-903fca815b91" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "DELETE", "path": "/invoices/c075aea6-bd06-4aaf-8417-903fca815b91", "secure_expected_status": 200, "demonstration_expected_status": 200, "observed_status": 200, "observed_body": { "deleted": "c075aea6-bd06-4aaf-8417-903fca815b91" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-bob-deletes-own.http", "response_sha256": "08ea3fb40fae200eab865717eebb2b83e9942c07dac8a19f6b01a26d73cdea35" }, { "id": "uuid-owner/bob-reads-own-after-delete", "config": { "ids": "uuid", "authz": "owner" }, "started_at": "2026-11-10T22:46:39.262319+00:00", "elapsed_ms": 6.149, "server": { "fixture_version": "1.0.0", "ids": "uuid", "authz": "owner", "base_url": "http://127.0.0.1:52965" }, "command": [ "curl", "--noproxy", "*", "--silent", "--show-error", "--include", "--http1.1", "--connect-timeout", "1", "--max-time", "3", "--request", "GET", "--header", "Authorization: Bearer demo-bob-token", "http://127.0.0.1:52965/invoices/c075aea6-bd06-4aaf-8417-903fca815b91" ], "curl_exit_code": 0, "stderr": "", "identity": "bob", "method": "GET", "path": "/invoices/c075aea6-bd06-4aaf-8417-903fca815b91", "secure_expected_status": 404, "demonstration_expected_status": 404, "observed_status": 404, "observed_body": { "error": "not_found" }, "matches_demonstration": true, "authorization_boundary_holds": true, "note": null, "response_file": "uuid-owner-bob-reads-own-after-delete.http", "response_sha256": "ce6aeaa7a80d430d549ca4bb3802276f178a9414be7172376564471f6fc04374" } ], "failures": [], "id_sources": { "sequential-none": { "bob_list_contains_alice_ids": 2, "target_ids_taken_from": "bob-list", "alice_invoice_ids": [ "1001", "1002" ] }, "uuid-none": { "bob_list_contains_alice_ids": 2, "target_ids_taken_from": "bob-list", "alice_invoice_ids": [ "be29ac11-01ad-48dc-b414-481312e18f87", "cfcab13e-0ef7-40e4-96ab-60d679e4bb31" ], "alice_ids_are_uuids": true }, "sequential-owner": { "bob_list_contains_alice_ids": 0, "target_ids_taken_from": "alice-list", "alice_invoice_ids": [ "1001", "1002" ] }, "uuid-owner": { "bob_list_contains_alice_ids": 0, "target_ids_taken_from": "alice-list", "alice_invoice_ids": [ "edbb9648-9a48-41b6-bcd9-1987155357f7", "83626556-22dd-4bb6-80f5-3f6e149ada5e" ], "alice_ids_are_uuids": true } }, "finished_at": "2026-11-10T22:46:39.269849+00:00", "boundary_failures": [ "sequential-none/alice-lists", "sequential-none/bob-lists", "sequential-none/bob-guesses-1001", "sequential-none/bob-guesses-1002", "sequential-none/bob-reads-alice", "sequential-none/bob-updates-alice", "sequential-none/alice-reads-after-update", "sequential-none/bob-deletes-alice", "sequential-none/alice-reads-after-delete", "uuid-none/alice-lists", "uuid-none/bob-lists", "uuid-none/bob-reads-alice", "uuid-none/bob-updates-alice", "uuid-none/alice-reads-after-update", "uuid-none/bob-deletes-alice", "uuid-none/alice-reads-after-delete" ], "all_demonstration_checks_passed": true }