{
  "schema_version": 1,
  "title": "Kontrollierter lokaler HTTP-Connector-/Aktionstest",
  "classification": "Eigener begrenzter Versuch mit künstlichen Daten, kein Sicherheitsprodukturteil",
  "frozen_at": "2026-10-24T10:30:20.540872+00:00",
  "frozen_design_sha256": "4ce59b0c62e5e9894841e7b4e8b85901517a244cbafae0871d2a72e0b1d3aada",
  "source_sha256": "77402331ecdf08023a893f04202aed0b2ded15c93898ab1707caf0c6bd56657c",
  "fixtures_sha256": "25de329df1dfecfc610248c15c449d6808e090e8b8cb075c0e17fa9440d8a264",
  "actual_trial": {
    "run_id": "66def278-1b56-4ea0-b54e-94e2e9a53a26",
    "started_at": "2026-10-24T11:01:14.634583+00:00",
    "finished_at": "2026-10-24T11:01:20.631101+00:00",
    "observed_counts": {
      "case_executions": 30,
      "driver_http_requests": 54,
      "accepted_http": 21,
      "denied_http": 33,
      "outbox_archive_rows": 6,
      "draft_archive_rows": 3,
      "approval_issued": 6,
      "approval_consumed": 6,
      "status_counts": {
        "401": 12,
        "200": 6,
        "403": 18,
        "201": 15,
        "409": 3
      },
      "outbound_action_attempts": 30,
      "outbound_action_denials": 24,
      "actual_synthetic_sends": 6
    },
    "checks_passed": true,
    "evidence": "trial/request-results.json"
  },
  "separate_reproduction": {
    "run_id": "4ec640aa-609b-49b4-b3df-1484a1879885",
    "started_at": "2026-10-24T11:01:41.479388+00:00",
    "finished_at": "2026-10-24T11:01:45.676740+00:00",
    "observed_counts": {
      "case_executions": 30,
      "driver_http_requests": 54,
      "accepted_http": 21,
      "denied_http": 33,
      "outbox_archive_rows": 6,
      "draft_archive_rows": 3,
      "approval_issued": 6,
      "approval_consumed": 6,
      "status_counts": {
        "401": 12,
        "200": 6,
        "403": 18,
        "201": 15,
        "409": 3
      },
      "outbound_action_attempts": 30,
      "outbound_action_denials": 24,
      "actual_synthetic_sends": 6
    },
    "checks_passed": true,
    "evidence": "reproduction/request-results.json",
    "aggregation": "Separater Wiederholbarkeitslauf; nicht zur ersten Stichprobe addieren."
  },
  "cases": [
    {
      "design_id": "01-no-auth",
      "label": "Ohne Anmeldung lesen",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          401
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            401
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            401
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            401
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "02-read",
      "label": "Künstliches Ticket lesen",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          200
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            200
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            200
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            200
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "03-read-cannot-send",
      "label": "Read-Zugang versucht Versand",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          403
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            403
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            403
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            403
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "04-draft-cannot-send",
      "label": "Draft speichern, Versand versuchen",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          201,
          403
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 1
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            201,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            1,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 1,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            201,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            1,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 1,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            201,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            1,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 1,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 3,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "05-send-without-approval",
      "label": "Senderecht ohne Freigabe",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          403
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            403
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            403
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            403
          ],
          "observed_outbox_deltas_by_request": [
            0
          ],
          "observed_draft_deltas_by_request": [
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "06-exact-approval-and-replay",
      "label": "Exakte Freigabe, Versand und Replay",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          201,
          201,
          409
        ],
        "final_outbox_rows_per_repetition": 1,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            201,
            201,
            409
          ],
          "observed_outbox_deltas_by_request": [
            0,
            1,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0,
            0
          ],
          "observed_final_outbox_rows": 1,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            201,
            201,
            409
          ],
          "observed_outbox_deltas_by_request": [
            0,
            1,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0,
            0
          ],
          "observed_final_outbox_rows": 1,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            201,
            201,
            409
          ],
          "observed_outbox_deltas_by_request": [
            0,
            1,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0,
            0
          ],
          "observed_final_outbox_rows": 1,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 3,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "07-changed-payload",
      "label": "Freigabe, geänderter Inhalt, Original",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          201,
          403,
          201
        ],
        "final_outbox_rows_per_repetition": 1,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            201,
            403,
            201
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0,
            1
          ],
          "observed_draft_deltas_by_request": [
            0,
            0,
            0
          ],
          "observed_final_outbox_rows": 1,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            201,
            403,
            201
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0,
            1
          ],
          "observed_draft_deltas_by_request": [
            0,
            0,
            0
          ],
          "observed_final_outbox_rows": 1,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            201,
            403,
            201
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0,
            1
          ],
          "observed_draft_deltas_by_request": [
            0,
            0,
            0
          ],
          "observed_final_outbox_rows": 1,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 3,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "08-direct-backend-bypass",
      "label": "Direkter Backendzugriff mit Clientwert",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          401,
          401
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            401,
            401
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            401,
            401
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            401,
            401
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "09-ticket-content-is-not-authority",
      "label": "Anweisung im Ticket, Read bleibt Read",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          200,
          403
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            200,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            200,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            200,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    },
    {
      "design_id": "10-client-cannot-approve",
      "label": "Client versucht Selbstfreigabe/Fälschung",
      "expected": {
        "repetitions": 3,
        "http_statuses_per_repetition": [
          401,
          403
        ],
        "final_outbox_rows_per_repetition": 0,
        "final_draft_rows_per_repetition": 0
      },
      "observed_runs": [
        {
          "repetition": 1,
          "http_statuses": [
            401,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 2,
          "http_statuses": [
            401,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        },
        {
          "repetition": 3,
          "http_statuses": [
            401,
            403
          ],
          "observed_outbox_deltas_by_request": [
            0,
            0
          ],
          "observed_draft_deltas_by_request": [
            0,
            0
          ],
          "observed_final_outbox_rows": 0,
          "observed_final_draft_rows": 0,
          "matched_frozen_expectation": true
        }
      ],
      "observed_total_outbox_delta": 0,
      "observed_total_draft_delta": 0,
      "all_three_matched_expectation": true
    }
  ],
  "measurement": "54 tatsächliche HTTP-Anfragen des Testtreibers je erfolgreichem Lauf; interne Connector-Weiterleitungen werden darin nicht nochmals gezählt. Statuscodes und SQLite-Zustand wurden vor/nach jeder Treiberanfrage gelesen.",
  "actual_delivery": "Nur lokale SQLite-Outbox; keine externe Zustellung oder SMTP.",
  "authorization": "Getrennte Read-/Draft-/Send- und Reviewer-Zugänge; zufällige Testgeheimnisse nur im Speicher, nicht in den veröffentlichten Belegen.",
  "review_boundary": "Serverseitig einmalige, an den exakten Payload gebundene Fähigkeit. Reviewer-Endpunkt im Versuch durch Skript mit separatem Credential bedient; keine echte prüfende Person.",
  "first_attempt": "Sandbox blockierte Loopback per PermissionError/WinError10013; 0 abgeschlossene Fälle,0 HTTP-Antworten,0 Nebenwirkungen. Fehlversuch getrennt erhalten. Erfolgreiche Läufe verwendeten unveränderten Freeze mit geprüfter Loopback-Ausführungsfreigabe.",
  "cleanup": "Beide eigenen Listener und Serverthreads je Lauf beendet; SQLite geschlossen und Integritätsprüfung ok; keine fremden Prozesse beendet.",
  "limits": [
    "Kein Sprachmodell und keine Modell-API; keine Kosten eines KI-Anbieters.",
    "Kein MCP und keine MCP-Konformitätsprüfung.",
    "Der künstliche Anweisungstext testet unveränderte Serverrechte, keine KI-Reaktion und keine Prompt-Injection-Abwehrrate.",
    "Keine echte menschliche Fachprüfung oder Nutzungsstudie; Briefing lediglich vorbereitet und unzugewiesen.",
    "Wiederholte feste Fälle ergeben keine allgemeine Wirksamkeits- oder Sicherheitswahrscheinlichkeit.",
    "Nicht geprüft: parallele Replays,Ablaufzeiten,gestohlene Zugangswerte,TLS,Crashwiederherstellung,Produktionsbetrieb."
  ],
  "review_brief": "human-review-brief.md"
}