{
  "schema_version": 1,
  "fixture_version": "1.0.0",
  "started_at": "2026-11-10T22:47:13.703500+00:00",
  "method": "Real curl subprocesses against two locally spawned fixture modes",
  "scope": {
    "hosts": [
      "127.0.0.1"
    ],
    "data": "Synthetic identities, notes and rows; demo tokens only"
  },
  "versions": {
    "python": "3.15.2",
    "os": "Darwin",
    "architecture": "arm64",
    "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0"
  },
  "sha256": {
    "fixture.py": "7880cf11cfeefde043e218373e36dcf8e707d0fa90aa382599033f70b7598c5e",
    "verify.py": "dff8661f0350a649305a87f59c0e893fee80c605fd62679434650d50f3278c36"
  },
  "reproduction_command": "python3 verify.py --output recorded-run",
  "agent_execution": {
    "executed": false,
    "note": "HTTP verification was scripted; no model ran"
  },
  "cases": [
    {
      "id": "vulnerable/alice-reads-own-note",
      "risk": "API1 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53529/notes/alice-note"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "body names alice-note",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "vulnerable-alice-reads-own-note.http",
      "response_sha256": "eef0df471ce2babe524f9d54211e3e0282162a1f830df245c54168a5590c395a"
    },
    {
      "id": "vulnerable/bob-reads-alice-note",
      "risk": "API1",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "http://127.0.0.1:53529/notes/alice-note"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 403,
      "secure_body_check": "body has no note text",
      "observed_status": 200,
      "passes_secure_expectation": false,
      "response_file": "vulnerable-bob-reads-alice-note.http",
      "response_sha256": "eef0df471ce2babe524f9d54211e3e0282162a1f830df245c54168a5590c395a"
    },
    {
      "id": "vulnerable/anonymous-reads-note",
      "risk": "API1 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:53529/notes/alice-note"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 401,
      "secure_body_check": "body has no note text",
      "observed_status": 401,
      "passes_secure_expectation": true,
      "response_file": "vulnerable-anonymous-reads-note.http",
      "response_sha256": "d9004c9d18bb5866c416067375fcfbd65dbbd6dfbd4a0f4164ac8bd70113ab9c"
    },
    {
      "id": "vulnerable/bob-edits-display-name",
      "risk": "API3 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"display_name\": \"Bobby\"}",
        "http://127.0.0.1:53529/profile"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "display_name is Bobby",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "vulnerable-bob-edits-display-name.http",
      "response_sha256": "db787b182933afcef054ff6dcf1364d0b8411db055926e6ce385a600217b1019"
    },
    {
      "id": "vulnerable/bob-sets-own-role",
      "risk": "API3",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"role\": \"admin\"}",
        "http://127.0.0.1:53529/profile"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 400,
      "secure_body_check": "role is not changed to admin",
      "observed_status": 200,
      "passes_secure_expectation": false,
      "response_file": "vulnerable-bob-sets-own-role.http",
      "response_sha256": "d4a07650e275ba5d2a883dcea27e5e5e7ec5117d24e6d060ff58427fdc245a32"
    },
    {
      "id": "vulnerable/bob-reads-own-profile",
      "risk": "API3",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "http://127.0.0.1:53529/profile"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "role is still user",
      "observed_status": 200,
      "passes_secure_expectation": false,
      "response_file": "vulnerable-bob-reads-own-profile.http",
      "response_sha256": "d4a07650e275ba5d2a883dcea27e5e5e7ec5117d24e6d060ff58427fdc245a32"
    },
    {
      "id": "vulnerable/carol-lists-admin-users",
      "risk": "API5",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-carol-token",
        "http://127.0.0.1:53529/admin/users"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 403,
      "secure_body_check": "body has no user list",
      "observed_status": 200,
      "passes_secure_expectation": false,
      "response_file": "vulnerable-carol-lists-admin-users.http",
      "response_sha256": "0ff1843209df0f78ca523d62b8fa5d4fd5c4fddd379f5ed602c856f7c47683e9"
    },
    {
      "id": "vulnerable/admin-lists-admin-users",
      "risk": "API5 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-admin-token",
        "http://127.0.0.1:53529/admin/users"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "body lists 4 users",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "vulnerable-admin-lists-admin-users.http",
      "response_sha256": "0ff1843209df0f78ca523d62b8fa5d4fd5c4fddd379f5ed602c856f7c47683e9"
    },
    {
      "id": "vulnerable/anonymous-lists-admin-users",
      "risk": "API5 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:53529/admin/users"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 401,
      "secure_body_check": "body has no user list",
      "observed_status": 401,
      "passes_secure_expectation": true,
      "response_file": "vulnerable-anonymous-lists-admin-users.http",
      "response_sha256": "d9004c9d18bb5866c416067375fcfbd65dbbd6dfbd4a0f4164ac8bd70113ab9c"
    },
    {
      "id": "vulnerable/alice-search-limit-50",
      "risk": "API4 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53529/search?limit=50"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "50 rows returned",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "vulnerable-alice-search-limit-50.http",
      "response_sha256": "dce04839cbd87a53df0bb2263f422880fec40c58f1959a1f11a83b479c31372c"
    },
    {
      "id": "vulnerable/alice-search-limit-100000",
      "risk": "API4",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53529/search?limit=100000"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 400,
      "secure_body_check": "fewer than 51 rows returned",
      "observed_status": 200,
      "passes_secure_expectation": false,
      "response_file": "vulnerable-alice-search-limit-100000.http",
      "response_sha256": "9a2c2b2427e5f7e319d40a6bf819da5373cebe8a06db9c79423aade61917c90f"
    },
    {
      "id": "vulnerable/alice-search-bad-limit",
      "risk": "API4 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53529/search?limit=abc"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 400,
      "secure_body_check": "body is invalid_limit",
      "observed_status": 400,
      "passes_secure_expectation": true,
      "response_file": "vulnerable-alice-search-bad-limit.http",
      "response_sha256": "ea70dc2a4f465716e8c1ea415377901da03e8a5b8552ec80398dea2a72eb1b8a"
    },
    {
      "id": "fixed/alice-reads-own-note",
      "risk": "API1 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53542/notes/alice-note"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "body names alice-note",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "fixed-alice-reads-own-note.http",
      "response_sha256": "eef0df471ce2babe524f9d54211e3e0282162a1f830df245c54168a5590c395a"
    },
    {
      "id": "fixed/bob-reads-alice-note",
      "risk": "API1",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "http://127.0.0.1:53542/notes/alice-note"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 403,
      "secure_body_check": "body has no note text",
      "observed_status": 403,
      "passes_secure_expectation": true,
      "response_file": "fixed-bob-reads-alice-note.http",
      "response_sha256": "6bbca37fa5b8c08ccc20db05ad40049d9da076a074031462503a4db199897211"
    },
    {
      "id": "fixed/anonymous-reads-note",
      "risk": "API1 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:53542/notes/alice-note"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 401,
      "secure_body_check": "body has no note text",
      "observed_status": 401,
      "passes_secure_expectation": true,
      "response_file": "fixed-anonymous-reads-note.http",
      "response_sha256": "4f6839c731264e4c84d3b0871feffd8944c4c185edbef9f077a98e8326d19850"
    },
    {
      "id": "fixed/bob-edits-display-name",
      "risk": "API3 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"display_name\": \"Bobby\"}",
        "http://127.0.0.1:53542/profile"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "display_name is Bobby",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "fixed-bob-edits-display-name.http",
      "response_sha256": "a5b8f8ed4b012f9852ba5f17a287b045a815c83628bd11cc8176581eeb262ce0"
    },
    {
      "id": "fixed/bob-sets-own-role",
      "risk": "API3",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "PATCH",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "--header",
        "Content-Type: application/json",
        "--data",
        "{\"role\": \"admin\"}",
        "http://127.0.0.1:53542/profile"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 400,
      "secure_body_check": "role is not changed to admin",
      "observed_status": 400,
      "passes_secure_expectation": true,
      "response_file": "fixed-bob-sets-own-role.http",
      "response_sha256": "b0015b3b427aa4abf47ccbcb2ded62faf070e8ba8ff0d59cbe20d4650e08f974"
    },
    {
      "id": "fixed/bob-reads-own-profile",
      "risk": "API3",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-bob-token",
        "http://127.0.0.1:53542/profile"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "role is still user",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "fixed-bob-reads-own-profile.http",
      "response_sha256": "a5b8f8ed4b012f9852ba5f17a287b045a815c83628bd11cc8176581eeb262ce0"
    },
    {
      "id": "fixed/carol-lists-admin-users",
      "risk": "API5",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-carol-token",
        "http://127.0.0.1:53542/admin/users"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 403,
      "secure_body_check": "body has no user list",
      "observed_status": 403,
      "passes_secure_expectation": true,
      "response_file": "fixed-carol-lists-admin-users.http",
      "response_sha256": "6bbca37fa5b8c08ccc20db05ad40049d9da076a074031462503a4db199897211"
    },
    {
      "id": "fixed/admin-lists-admin-users",
      "risk": "API5 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-admin-token",
        "http://127.0.0.1:53542/admin/users"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "body lists 4 users",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "fixed-admin-lists-admin-users.http",
      "response_sha256": "e65a5be9550cc9886a30b30ff1837c20789e8d735d839b8c884772009f682790"
    },
    {
      "id": "fixed/anonymous-lists-admin-users",
      "risk": "API5 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:53542/admin/users"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 401,
      "secure_body_check": "body has no user list",
      "observed_status": 401,
      "passes_secure_expectation": true,
      "response_file": "fixed-anonymous-lists-admin-users.http",
      "response_sha256": "4f6839c731264e4c84d3b0871feffd8944c4c185edbef9f077a98e8326d19850"
    },
    {
      "id": "fixed/alice-search-limit-50",
      "risk": "API4 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53542/search?limit=50"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 200,
      "secure_body_check": "50 rows returned",
      "observed_status": 200,
      "passes_secure_expectation": true,
      "response_file": "fixed-alice-search-limit-50.http",
      "response_sha256": "6f581cba43841a0ac06828696d3dfac6cd27a599f70d9a30d3f2ab965fc5ed9b"
    },
    {
      "id": "fixed/alice-search-limit-100000",
      "risk": "API4",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53542/search?limit=100000"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 400,
      "secure_body_check": "fewer than 51 rows returned",
      "observed_status": 400,
      "passes_secure_expectation": true,
      "response_file": "fixed-alice-search-limit-100000.http",
      "response_sha256": "cf0a96bdbf2f17bd95a9a49472a02f2ad7d41c17cd26c648b291db4b21cdef61"
    },
    {
      "id": "fixed/alice-search-bad-limit",
      "risk": "API4 control",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "--header",
        "Authorization: Bearer demo-alice-token",
        "http://127.0.0.1:53542/search?limit=abc"
      ],
      "curl_exit_code": 0,
      "secure_expected_status": 400,
      "secure_body_check": "body is invalid_limit",
      "observed_status": 400,
      "passes_secure_expectation": true,
      "response_file": "fixed-alice-search-bad-limit.http",
      "response_sha256": "f5fd80ba797198bf6387a6d40328019b93d168889877caff16f52277dac15190"
    }
  ],
  "failures": [],
  "summary": {
    "vulnerable_pass": 7,
    "vulnerable_fail": 5,
    "fixed_pass": 12,
    "fixed_fail": 0
  },
  "finished_at": "2026-11-10T22:47:14.119023+00:00",
  "all_demonstration_checks_passed": true
}