{
  "schema_version": 1,
  "frozen_at": "2026-10-24T10:30:20.540872+00:00",
  "protocol": "HTTP/1.0 with JSON over two separate loopback TCP listeners; not MCP",
  "repetitions_per_case": 3,
  "cases": [
    {
      "id": "01-no-auth",
      "question": "Does an unauthenticated connector read fail?",
      "statuses": [
        401
      ],
      "drafts": 0,
      "outbox": 0
    },
    {
      "id": "02-read",
      "question": "Can read scope retrieve the synthetic ticket without a write?",
      "statuses": [
        200
      ],
      "drafts": 0,
      "outbox": 0
    },
    {
      "id": "03-read-cannot-send",
      "question": "Can read scope invoke send?",
      "statuses": [
        403
      ],
      "drafts": 0,
      "outbox": 0
    },
    {
      "id": "04-draft-cannot-send",
      "question": "Can draft scope save a draft but not send?",
      "statuses": [
        201,
        403
      ],
      "drafts": 1,
      "outbox": 0
    },
    {
      "id": "05-send-without-approval",
      "question": "Does send scope alone bypass the backend approval boundary?",
      "statuses": [
        403
      ],
      "drafts": 0,
      "outbox": 0
    },
    {
      "id": "06-exact-approval-and-replay",
      "question": "Does a separately issued exact approval allow one send and reject replay?",
      "statuses": [
        201,
        201,
        409
      ],
      "drafts": 0,
      "outbox": 1
    },
    {
      "id": "07-changed-payload",
      "question": "Does changed content fail without consuming the exact approved capability?",
      "statuses": [
        201,
        403,
        201
      ],
      "drafts": 0,
      "outbox": 1
    },
    {
      "id": "08-direct-backend-bypass",
      "question": "Do connector client credentials fail against direct backend read/write?",
      "statuses": [
        401,
        401
      ],
      "drafts": 0,
      "outbox": 0
    },
    {
      "id": "09-ticket-content-is-not-authority",
      "question": "Does constructed instruction text itself grant the read client send scope? No model interpretation is tested.",
      "statuses": [
        200,
        403
      ],
      "drafts": 0,
      "outbox": 0
    },
    {
      "id": "10-client-cannot-approve",
      "question": "Can a send client issue its own backend approval or forge a capability?",
      "statuses": [
        401,
        403
      ],
      "drafts": 0,
      "outbox": 0
    }
  ],
  "source_sha256": "77402331ecdf08023a893f04202aed0b2ded15c93898ab1707caf0c6bd56657c",
  "fixtures_sha256": "25de329df1dfecfc610248c15c449d6808e090e8b8cb075c0e17fa9440d8a264",
  "reset": "Before each case: clear active drafts/outbox and all in-memory capabilities; append reset counts. Preserve separate append-only draft/outbox archives.",
  "observation": "Actual HTTP status/body plus SQLite state before and after every request and persistent action archives.",
  "approval": "Separate reviewer bearer credential, server-created single-use random capability, bound to exact canonical ticket_id/recipient/body digest; reviewer action is scripted, not a real human participant.",
  "invariants": [
    "No external network destinations or email delivery",
    "Bind both listeners to127.0.0.1 with OS-assigned ports",
    "Generate authorization and approval secrets in memory, never write or print values",
    "No model, model API, MCP conformance or prompt-injection efficacy claim",
    "Stop both owned servers in finally; preserve unrelated processes"
  ],
  "expected_per_run": {
    "case_executions": 30,
    "driver_http_requests": 54,
    "accepted_http": 21,
    "denied_http": 33,
    "outbox_archive_rows": 6,
    "draft_archive_rows": 3,
    "approval_issued": 6,
    "approval_consumed": 6
  }
}