{
  "schema_version": 1,
  "fixture_version": "1.0.0",
  "started_at": "2026-11-10T22:47:02.265615+00:00",
  "method": "Real curl subprocesses against two locally spawned fixture modes",
  "scope": {
    "hosts": [
      "127.0.0.1"
    ],
    "methods": [
      "GET",
      "PATCH"
    ],
    "paths": [
      "/profile",
      "/users/<id>"
    ],
    "data": "Three synthetic users; all tokens and the password_hash values are public demo strings"
  },
  "versions": {
    "python": "3.15.2",
    "os": "Darwin",
    "architecture": "arm64",
    "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0"
  },
  "sha256": {
    "fixture.py": "65f43ccefd3b69ebf3cee35c437ef6c4e368720d724ef22379762dc9e5cfe363",
    "verify.py": "9c695dad16c34ecd2c616d8baf3ed97d64ce45b357bad4328bef475dd64c6a79"
  },
  "reproduction_command": "python3 verify.py --output recorded-run",
  "agent_execution": {
    "executed": false,
    "note": "HTTP verification was scripted; no model or agent ran"
  },
  "cases": [
    {
      "id": "vulnerable/alice-get-before",
      "started_at": "2026-11-10T22:47:02.305487+00:00",
      "elapsed_ms": 7.475,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "GET",
      "path": "/profile",
      "identity": "alice",
      "request_body": null,
      "secure_expected": "200, no password_hash",
      "demonstration_expected": "200, record includes password_hash",
      "observed_status": 200,
      "observed_body": {
        "bio": "",
        "credit": 0,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-get-before.http",
      "response_sha256": "10bb54b2f191e618bccc0124047bb032f2d7dd215f83fca2ec8d5289f608f3a9"
    },
    {
      "id": "vulnerable/alice-legit-update",
      "started_at": "2026-11-10T22:47:02.313237+00:00",
      "elapsed_ms": 6.497,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"name\":\"Alice Example\",\"bio\":\"Synthetic bio\"}",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "name": "Alice Example",
        "bio": "Synthetic bio"
      },
      "secure_expected": "200, name and bio updated, no password_hash",
      "demonstration_expected": "200, name and bio updated",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 0,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice Example",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-legit-update.http",
      "response_sha256": "5988ddca34df4c78209c3ada28779f14632b2c429e570d414a09d83ddda043c4"
    },
    {
      "id": "vulnerable/alice-mass-assign",
      "started_at": "2026-11-10T22:47:02.319786+00:00",
      "elapsed_ms": 6.188,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"role\":\"admin\",\"credit\":9999}",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "role": "admin",
        "credit": 9999
      },
      "secure_expected": "400, fields rejected",
      "demonstration_expected": "200, role admin and credit 9999 applied",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 9999,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice Example",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "admin"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-mass-assign.http",
      "response_sha256": "4006805f3418d57787ff00cedc1860d127f5b935c04110c7b246d27f592f7b3d"
    },
    {
      "id": "vulnerable/alice-get-after",
      "started_at": "2026-11-10T22:47:02.326013+00:00",
      "elapsed_ms": 5.794,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "GET",
      "path": "/profile",
      "identity": "alice",
      "request_body": null,
      "secure_expected": "200, role user and credit 0 unchanged",
      "demonstration_expected": "200, escalation persisted",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 9999,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice Example",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "admin"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-get-after.http",
      "response_sha256": "4006805f3418d57787ff00cedc1860d127f5b935c04110c7b246d27f592f7b3d"
    },
    {
      "id": "vulnerable/alice-unknown-field",
      "started_at": "2026-11-10T22:47:02.331857+00:00",
      "elapsed_ms": 6.051,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"is_admin\":true}",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "is_admin": true
      },
      "secure_expected": "400, unknown field rejected",
      "demonstration_expected": "200, unknown field stored",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 9999,
        "email": "alice@example.test",
        "id": "alice",
        "is_admin": true,
        "name": "Alice Example",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "admin"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-unknown-field.http",
      "response_sha256": "dd199c8d04d5aeb93c0336bb1ffca81798483fadc579f7f8a7c5a47bffa74edd"
    },
    {
      "id": "vulnerable/alice-mixed",
      "started_at": "2026-11-10T22:47:02.337956+00:00",
      "elapsed_ms": 5.524,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"bio\":\"Mixed attempt\",\"role\":\"admin\"}",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "bio": "Mixed attempt",
        "role": "admin"
      },
      "secure_expected": "400, whole request rejected",
      "demonstration_expected": "200, whole payload applied",
      "observed_status": 200,
      "observed_body": {
        "bio": "Mixed attempt",
        "credit": 9999,
        "email": "alice@example.test",
        "id": "alice",
        "is_admin": true,
        "name": "Alice Example",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "admin"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-mixed.http",
      "response_sha256": "453d35c31e70f5253b781bbb84b47a59975430940997309e251b247a9f9f3d14"
    },
    {
      "id": "vulnerable/alice-uses-role",
      "started_at": "2026-11-10T22:47:02.343522+00:00",
      "elapsed_ms": 5.93,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"credit\":1}",
        "http://127.0.0.1:53348/users/bob"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/users/bob",
      "identity": "alice",
      "request_body": {
        "credit": 1
      },
      "secure_expected": "403, admin endpoint denied",
      "demonstration_expected": "200, escalated role edits another user",
      "observed_status": 200,
      "observed_body": {
        "bio": "",
        "credit": 1,
        "email": "bob@example.test",
        "id": "bob",
        "name": "Bob",
        "password_hash": "demo-hash-not-a-real-hash-bob",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-uses-role.http",
      "response_sha256": "70b6d4ddc2aa2d8e97f8d298e1253f6668c8f162fbf04bb392110bdbbfba4ed2"
    },
    {
      "id": "vulnerable/admin-sets-credit",
      "started_at": "2026-11-10T22:47:02.349498+00:00",
      "elapsed_ms": 6.1,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-admin-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"credit\":50}",
        "http://127.0.0.1:53348/users/alice"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/users/alice",
      "identity": "admin",
      "request_body": {
        "credit": 50
      },
      "secure_expected": "200, credit 50, no password_hash",
      "demonstration_expected": "200, credit 50",
      "observed_status": 200,
      "observed_body": {
        "bio": "Mixed attempt",
        "credit": 50,
        "email": "alice@example.test",
        "id": "alice",
        "is_admin": true,
        "name": "Alice Example",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "admin"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-admin-sets-credit.http",
      "response_sha256": "14249a9dd2d155c0ea828a45f437d8caedd536aa65b0f1487f8d2036f76495e0"
    },
    {
      "id": "vulnerable/alice-get-final",
      "started_at": "2026-11-10T22:47:02.355641+00:00",
      "elapsed_ms": 6.653,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "GET",
      "path": "/profile",
      "identity": "alice",
      "request_body": null,
      "secure_expected": "200, legitimate edits kept, nothing else changed",
      "demonstration_expected": "200, role admin, bio and is_admin from attacker input",
      "observed_status": 200,
      "observed_body": {
        "bio": "Mixed attempt",
        "credit": 50,
        "email": "alice@example.test",
        "id": "alice",
        "is_admin": true,
        "name": "Alice Example",
        "password_hash": "demo-hash-not-a-real-hash-alice",
        "role": "admin"
      },
      "matches_demonstration": true,
      "secure_policy_holds": false,
      "response_file": "vulnerable-alice-get-final.http",
      "response_sha256": "14249a9dd2d155c0ea828a45f437d8caedd536aa65b0f1487f8d2036f76495e0"
    },
    {
      "id": "vulnerable/anonymous-patch",
      "started_at": "2026-11-10T22:47:02.362344+00:00",
      "elapsed_ms": 5.73,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:53348"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"bio\":\"x\"}",
        "http://127.0.0.1:53348/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": null,
      "request_body": {
        "bio": "x"
      },
      "secure_expected": "401",
      "demonstration_expected": "401",
      "observed_status": 401,
      "observed_body": {
        "error": "authentication_required"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "vulnerable-anonymous-patch.http",
      "response_sha256": "336b987289273aa9d262fecba20af481b810a3ee447d2625b5fd588dc8586263"
    },
    {
      "id": "fixed/alice-get-before",
      "started_at": "2026-11-10T22:47:02.403542+00:00",
      "elapsed_ms": 8.224,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "GET",
      "path": "/profile",
      "identity": "alice",
      "request_body": null,
      "secure_expected": "200, no password_hash",
      "demonstration_expected": "200, no password_hash",
      "observed_status": 200,
      "observed_body": {
        "bio": "",
        "credit": 0,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-get-before.http",
      "response_sha256": "3a7e6f712eedd16063aa437e57f0c49010ee909910c1f26943f494bf9fe10c45"
    },
    {
      "id": "fixed/alice-legit-update",
      "started_at": "2026-11-10T22:47:02.411832+00:00",
      "elapsed_ms": 7.041,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"name\":\"Alice Example\",\"bio\":\"Synthetic bio\"}",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "name": "Alice Example",
        "bio": "Synthetic bio"
      },
      "secure_expected": "200, name and bio updated, no password_hash",
      "demonstration_expected": "200, name and bio updated, no password_hash",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 0,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice Example",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-legit-update.http",
      "response_sha256": "de3fc8184686a5224bc6935268bec46fb9f149edafa74b71001b31a0272e235c"
    },
    {
      "id": "fixed/alice-mass-assign",
      "started_at": "2026-11-10T22:47:02.418929+00:00",
      "elapsed_ms": 6.316,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"role\":\"admin\",\"credit\":9999}",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "role": "admin",
        "credit": 9999
      },
      "secure_expected": "400, fields rejected",
      "demonstration_expected": "400, fields rejected",
      "observed_status": 400,
      "observed_body": {
        "error": "fields_not_writable",
        "fields": [
          "credit",
          "role"
        ]
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-mass-assign.http",
      "response_sha256": "15e1130a4913dbf6043426de1b700fde899cd9fbf99b2bada55fc8e3a9908e7e"
    },
    {
      "id": "fixed/alice-get-after",
      "started_at": "2026-11-10T22:47:02.425291+00:00",
      "elapsed_ms": 8.005,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "GET",
      "path": "/profile",
      "identity": "alice",
      "request_body": null,
      "secure_expected": "200, role user and credit 0 unchanged",
      "demonstration_expected": "200, role user and credit 0 unchanged",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 0,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice Example",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-get-after.http",
      "response_sha256": "de3fc8184686a5224bc6935268bec46fb9f149edafa74b71001b31a0272e235c"
    },
    {
      "id": "fixed/alice-unknown-field",
      "started_at": "2026-11-10T22:47:02.433376+00:00",
      "elapsed_ms": 7.887,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"is_admin\":true}",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "is_admin": true
      },
      "secure_expected": "400, unknown field rejected",
      "demonstration_expected": "400, unknown field rejected",
      "observed_status": 400,
      "observed_body": {
        "error": "fields_not_writable",
        "fields": [
          "is_admin"
        ]
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-unknown-field.http",
      "response_sha256": "c5022e8f3690f39442ab3d358728434d60afce21f9c1b957005c0237b975ffdd"
    },
    {
      "id": "fixed/alice-mixed",
      "started_at": "2026-11-10T22:47:02.441323+00:00",
      "elapsed_ms": 7.465,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"bio\":\"Mixed attempt\",\"role\":\"admin\"}",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": "alice",
      "request_body": {
        "bio": "Mixed attempt",
        "role": "admin"
      },
      "secure_expected": "400, whole request rejected",
      "demonstration_expected": "400, whole request rejected",
      "observed_status": 400,
      "observed_body": {
        "error": "fields_not_writable",
        "fields": [
          "role"
        ]
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-mixed.http",
      "response_sha256": "3abea70a228f8a974a9351ddc4ccb6b0ce0822e0e1a65ae5c624ab27b255d89a"
    },
    {
      "id": "fixed/alice-uses-role",
      "started_at": "2026-11-10T22:47:02.448850+00:00",
      "elapsed_ms": 6.541,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"credit\":1}",
        "http://127.0.0.1:53359/users/bob"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/users/bob",
      "identity": "alice",
      "request_body": {
        "credit": 1
      },
      "secure_expected": "403, admin endpoint denied",
      "demonstration_expected": "403, admin endpoint denied",
      "observed_status": 403,
      "observed_body": {
        "error": "forbidden"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-uses-role.http",
      "response_sha256": "5939d42d4c43537b2150ae1fa34ec519066cdfa26b8443663bc4d61dc3585c2f"
    },
    {
      "id": "fixed/admin-sets-credit",
      "started_at": "2026-11-10T22:47:02.455453+00:00",
      "elapsed_ms": 6.225,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-admin-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"credit\":50}",
        "http://127.0.0.1:53359/users/alice"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/users/alice",
      "identity": "admin",
      "request_body": {
        "credit": 50
      },
      "secure_expected": "200, credit 50, no password_hash",
      "demonstration_expected": "200, credit 50, no password_hash",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 50,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice Example",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-admin-sets-credit.http",
      "response_sha256": "6b9868defbebbc5c4115e0b73402e27ab25f7de88284d9e51f9ba454d87d89cf"
    },
    {
      "id": "fixed/alice-get-final",
      "started_at": "2026-11-10T22:47:02.461722+00:00",
      "elapsed_ms": 6.549,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "GET",
      "path": "/profile",
      "identity": "alice",
      "request_body": null,
      "secure_expected": "200, legitimate edits kept, nothing else changed",
      "demonstration_expected": "200, legitimate edits kept, nothing else changed",
      "observed_status": 200,
      "observed_body": {
        "bio": "Synthetic bio",
        "credit": 50,
        "email": "alice@example.test",
        "id": "alice",
        "name": "Alice Example",
        "role": "user"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-alice-get-final.http",
      "response_sha256": "6b9868defbebbc5c4115e0b73402e27ab25f7de88284d9e51f9ba454d87d89cf"
    },
    {
      "id": "fixed/anonymous-patch",
      "started_at": "2026-11-10T22:47:02.468325+00:00",
      "elapsed_ms": 6.858,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:53359"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"bio\":\"x\"}",
        "http://127.0.0.1:53359/profile"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "method": "PATCH",
      "path": "/profile",
      "identity": null,
      "request_body": {
        "bio": "x"
      },
      "secure_expected": "401",
      "demonstration_expected": "401",
      "observed_status": 401,
      "observed_body": {
        "error": "authentication_required"
      },
      "matches_demonstration": true,
      "secure_policy_holds": true,
      "response_file": "fixed-anonymous-patch.http",
      "response_sha256": "336b987289273aa9d262fecba20af481b810a3ee447d2625b5fd588dc8586263"
    }
  ],
  "failures": [],
  "finished_at": "2026-11-10T22:47:02.476509+00:00",
  "policy_violations_in_vulnerable_mode": [
    "vulnerable/admin-sets-credit",
    "vulnerable/alice-get-after",
    "vulnerable/alice-get-before",
    "vulnerable/alice-get-final",
    "vulnerable/alice-legit-update",
    "vulnerable/alice-mass-assign",
    "vulnerable/alice-mixed",
    "vulnerable/alice-unknown-field",
    "vulnerable/alice-uses-role"
  ],
  "policy_violations_in_fixed_mode": [],
  "all_demonstration_checks_passed": true
}