diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/cli-attempts.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/cli-attempts.json
new file mode 100644
index 00000000..78b0c95b
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/cli-attempts.json
@@ -0,0 +1,708 @@
+[
+ {
+ "operation": [
+ "migrate"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused-debug-logging",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/CLIENT_SECRET"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "synthetic-oauth",
+ "--provider",
+ "github",
+ "--key",
+ "synthetic-public-id",
+ "--secret-file",
+ "/run/forgejo-oidc/CLIENT_SECRET",
+ "--group-claim-name",
+ "groups",
+ "--admin-group",
+ "unchanged-admin",
+ "--scopes",
+ "read:user,user:email"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--icon-url",
+ "https://synthetic.invalid/icon"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--secret-file",
+ "/run/forgejo-oidc/replacement"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "synthetic-guarded"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--secret-file",
+ "/run/forgejo-oidc/good"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/newline"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/newline"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/short"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/short"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/long"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/long"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/badbyte"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/badbyte"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/world"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/world"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/writable"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/writable"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/executable"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/executable"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/empty"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/empty"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/symlink"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/symlink"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/fifo"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/fifo"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/directory"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/directory"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/missing"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/missing"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/badparent/value"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/badparent/value"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/parentlink/value"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/parentlink/value"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "relative"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "relative"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ ""
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ ""
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/../forgejo-oidc/good"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/forgejo-oidc/../forgejo-oidc/good"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/writable-input/good"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--name",
+ "refused",
+ "--secret-file",
+ "/run/writable-input/good"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused",
+ "--secret",
+ "",
+ "--secret-file",
+ "/run/forgejo-oidc/good"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--secret",
+ "",
+ "--secret-file",
+ "/run/forgejo-oidc/good"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--required-claim-values",
+ ""
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--secret-file",
+ "/run/forgejo-oidc/replacement"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "update-oauth",
+ "--id",
+ "1",
+ "--secret",
+ "synthetic-legacy-literal"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ }
+]
\ No newline at end of file
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-download-attempt1.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-download-attempt1.json
new file mode 100644
index 00000000..3ddaf675
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-download-attempt1.json
@@ -0,0 +1,97 @@
+{
+ "returncode": 0,
+ "seconds": 32.57,
+ "argv": [
+ "bwrap",
+ "--unshare-pid",
+ "--die-with-parent",
+ "--new-session",
+ "--ro-bind",
+ "/usr",
+ "/usr",
+ "--ro-bind",
+ "/lib",
+ "/lib",
+ "--ro-bind",
+ "/lib64",
+ "/lib64",
+ "--symlink",
+ "usr/bin",
+ "/bin",
+ "--proc",
+ "/proc",
+ "--dev",
+ "/dev",
+ "--tmpfs",
+ "/tmp",
+ "--bind",
+ "/tmp/custodian-forgejo-successor-attempt2",
+ "/work",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod/cache/download",
+ "/cached",
+ "--ro-bind",
+ "/etc/ssl/certs",
+ "/etc/ssl/certs",
+ "--ro-bind",
+ "/etc/resolv.conf",
+ "/etc/resolv.conf",
+ "--chdir",
+ "/work/source",
+ "--clearenv",
+ "--setenv",
+ "PATH",
+ "/work/go/bin:/usr/bin:/bin",
+ "--setenv",
+ "HOME",
+ "/work/home",
+ "--setenv",
+ "GOPATH",
+ "/work/gopath",
+ "--setenv",
+ "GOTOOLCHAIN",
+ "local",
+ "--setenv",
+ "GOPROXY",
+ "file:///cached,https://proxy.golang.org",
+ "--setenv",
+ "GOSUMDB",
+ "sum.golang.org",
+ "--setenv",
+ "GOVCS",
+ "*:off",
+ "--setenv",
+ "GOMODCACHE",
+ "/work/modules",
+ "--setenv",
+ "GOCACHE",
+ "/work/gocache",
+ "--setenv",
+ "GOMAXPROCS",
+ "4",
+ "--setenv",
+ "CGO_ENABLED",
+ "1",
+ "--setenv",
+ "GIT_CONFIG_NOSYSTEM",
+ "1",
+ "--setenv",
+ "GIT_CONFIG_GLOBAL",
+ "/dev/null",
+ "--setenv",
+ "GIT_TERMINAL_PROMPT",
+ "0",
+ "--",
+ "go",
+ "mod",
+ "download"
+ ],
+ "workspace": "/tmp/custodian-forgejo-successor-attempt2",
+ "module_hashes": {
+ "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
+ "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf"
+ },
+ "network": "public module download only",
+ "pid_namespace": "private",
+ "real_credentials": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-reconstruction.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-reconstruction.json
new file mode 100644
index 00000000..e0e57d52
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-reconstruction.json
@@ -0,0 +1,156 @@
+{
+ "workspace": "/tmp/custodian-forgejo-successor-attempt2",
+ "inputs_verified": true,
+ "paths": [
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "go.mod",
+ "sha256": "652162a4a95c6d1c349d2a8c0b514def5abd837f001137b77b7b3f4a0f162d00"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "cmd/admin_auth_oauth.go",
+ "sha256": "1dd03f0bd23889a340a10fcc18d2e3a49270b79056aafd1b3baf01b18559b37f"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "services/forms/auth_form.go",
+ "sha256": "026720f23cbdb5e54f8c594109c2dc306b87e323cc649df5fa3194f609cd7737"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "services/auth/source/oauth2/required_claim_values_test.go",
+ "sha256": "54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "services/auth/source/oauth2/required_claim_values.go",
+ "sha256": "29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "services/auth/source/oauth2/providers_openid.go",
+ "sha256": "5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "services/auth/source/oauth2/source.go",
+ "sha256": "44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "routers/web/admin/auths.go",
+ "sha256": "3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923"
+ },
+ {
+ "packet": "forgejo-required-claim-values-r1",
+ "path": "routers/web/auth/oauth.go",
+ "sha256": "081bcb94023d6e27289196bbe518bebba0a8a6082ea1a32d2794c5562075907b"
+ },
+ {
+ "packet": "forgejo-private-input-r1",
+ "path": "cmd/admin_auth_oauth.go",
+ "sha256": "c01084dd631937e3cd1d08593e7090d44661c6cba2838e217bdadbbc5f3c29d9"
+ },
+ {
+ "packet": "forgejo-private-input-r1",
+ "path": "cmd/admin_auth_oauth_secret_linux.go",
+ "sha256": "6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b"
+ },
+ {
+ "packet": "forgejo-private-input-r1",
+ "path": "cmd/admin_auth_oauth_secret_other.go",
+ "sha256": "54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d"
+ },
+ {
+ "packet": "forgejo-private-input-r1",
+ "path": "cmd/admin_auth_oauth_secret_linux_test.go",
+ "sha256": "b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2"
+ },
+ {
+ "packet": "forgejo-private-input-r1",
+ "path": "models/db/engine.go",
+ "sha256": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96"
+ },
+ {
+ "packet": "forgejo-private-input-r1",
+ "path": "models/db/sensitive_sql.go",
+ "sha256": "8d4e6b3f08e9fdd919e97e47bd857cbd8935fdcbf367d20b5b8c545f279e796e"
+ },
+ {
+ "packet": "forgejo-private-input-r1",
+ "path": "models/db/sensitive_sql_test.go",
+ "sha256": "f0f74c09a9e96a6529db7b9ce459a2ea37e204de38c5ad01855b80c9a992a769"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/db/engine.go",
+ "sha256": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/db/context.go",
+ "sha256": "d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/db/sensitive_sql.go",
+ "sha256": "8d4e6b3f08e9fdd919e97e47bd857cbd8935fdcbf367d20b5b8c545f279e796e"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/db/sensitive_sql_test.go",
+ "sha256": "de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/auth/source_operation_internal_test.go",
+ "sha256": "af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/auth/source_operation_test.go",
+ "sha256": "77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/auth/source_operation.go",
+ "sha256": "ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31"
+ },
+ {
+ "packet": "apps-operation-backend-r1",
+ "path": "models/auth/source_operation_process_test.go",
+ "sha256": "40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd"
+ },
+ {
+ "packet": "apps-access-engine-integration-r2",
+ "path": "go.mod",
+ "sha256": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a"
+ },
+ {
+ "packet": "apps-access-engine-integration-r2",
+ "path": "services/auth/source/oauth2/access_engine_test.go",
+ "sha256": "1bbc4a823cdf93005d72a6db2eb77e0096c80903fbdf247a385431d70b9620da"
+ },
+ {
+ "packet": "apps-access-engine-integration-r2",
+ "path": "services/auth/source/oauth2/source_callout.go",
+ "sha256": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c"
+ },
+ {
+ "packet": "apps-access-engine-integration-r2",
+ "path": "services/auth/source/oauth2/access_engine_callback_test.go",
+ "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+ },
+ {
+ "packet": "apps-access-engine-integration-r2",
+ "path": "services/auth/source/oauth2/access_engine.go",
+ "sha256": "c1f2b4c76d09687b9b66dd13b3ba671ba92ae72f26751f8c273607ab9be65b07"
+ },
+ {
+ "packet": "apps-access-engine-integration-r2",
+ "path": "routers/web/auth/oauth.go",
+ "sha256": "58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17"
+ }
+ ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt1.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt1.json
new file mode 100644
index 00000000..e4da3935
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt1.json
@@ -0,0 +1,109 @@
+{
+ "returncode": 1,
+ "seconds": 500.05,
+ "argv": [
+ "bwrap",
+ "--unshare-pid",
+ "--die-with-parent",
+ "--new-session",
+ "--unshare-net",
+ "--ro-bind",
+ "/usr",
+ "/usr",
+ "--ro-bind",
+ "/lib",
+ "/lib",
+ "--ro-bind",
+ "/lib64",
+ "/lib64",
+ "--symlink",
+ "usr/bin",
+ "/bin",
+ "--proc",
+ "/proc",
+ "--dev",
+ "/dev",
+ "--tmpfs",
+ "/tmp",
+ "--bind",
+ "/tmp/custodian-forgejo-successor-attempt2",
+ "/work",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod/cache/download",
+ "/cached",
+ "--ro-bind",
+ "/etc/ssl/certs",
+ "/etc/ssl/certs",
+ "--ro-bind",
+ "/etc/resolv.conf",
+ "/etc/resolv.conf",
+ "--chdir",
+ "/work/source",
+ "--clearenv",
+ "--setenv",
+ "PATH",
+ "/work/go/bin:/usr/bin:/bin",
+ "--setenv",
+ "HOME",
+ "/work/home",
+ "--setenv",
+ "GOPATH",
+ "/work/gopath",
+ "--setenv",
+ "GOTOOLCHAIN",
+ "local",
+ "--setenv",
+ "GOPROXY",
+ "off",
+ "--setenv",
+ "GOSUMDB",
+ "off",
+ "--setenv",
+ "GOVCS",
+ "*:off",
+ "--setenv",
+ "GOMODCACHE",
+ "/work/modules",
+ "--setenv",
+ "GOCACHE",
+ "/work/gocache",
+ "--setenv",
+ "GOMAXPROCS",
+ "4",
+ "--setenv",
+ "CGO_ENABLED",
+ "1",
+ "--setenv",
+ "GIT_CONFIG_NOSYSTEM",
+ "1",
+ "--setenv",
+ "GIT_CONFIG_GLOBAL",
+ "/dev/null",
+ "--setenv",
+ "GIT_TERMINAL_PROMPT",
+ "0",
+ "--",
+ "go",
+ "test",
+ "-p",
+ "4",
+ "-json",
+ "-tags",
+ "sqlite sqlite_unlock_notify",
+ "./services/auth/source/oauth2",
+ "./cmd",
+ "./models/auth",
+ "./models/db",
+ "-run",
+ "TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQLHooks",
+ "-count=1"
+ ],
+ "workspace": "/tmp/custodian-forgejo-successor-attempt2",
+ "module_hashes": {
+ "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
+ "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf"
+ },
+ "network": "disabled",
+ "pid_namespace": "private",
+ "real_credentials": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt2.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt2.json
new file mode 100644
index 00000000..c5391a12
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt2.json
@@ -0,0 +1,117 @@
+{
+ "returncode": 0,
+ "seconds": 21.03,
+ "argv": [
+ "bwrap",
+ "--unshare-pid",
+ "--die-with-parent",
+ "--new-session",
+ "--unshare-net",
+ "--ro-bind",
+ "/usr",
+ "/usr",
+ "--ro-bind",
+ "/lib",
+ "/lib",
+ "--ro-bind",
+ "/lib64",
+ "/lib64",
+ "--symlink",
+ "usr/bin",
+ "/bin",
+ "--proc",
+ "/proc",
+ "--dev",
+ "/dev",
+ "--tmpfs",
+ "/tmp",
+ "--bind",
+ "/tmp/custodian-forgejo-successor-attempt2",
+ "/work",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod/cache/download",
+ "/cached",
+ "--ro-bind",
+ "/etc/ssl/certs",
+ "/etc/ssl/certs",
+ "--ro-bind",
+ "/etc/resolv.conf",
+ "/etc/resolv.conf",
+ "--chdir",
+ "/work/source",
+ "--clearenv",
+ "--dir",
+ "/run",
+ "--ro-bind",
+ "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
+ "/run/forgejo-oidc",
+ "--bind",
+ "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
+ "/run/writable-input",
+ "--setenv",
+ "PATH",
+ "/work/go/bin:/usr/bin:/bin",
+ "--setenv",
+ "HOME",
+ "/work/home",
+ "--setenv",
+ "GOPATH",
+ "/work/gopath",
+ "--setenv",
+ "GOTOOLCHAIN",
+ "local",
+ "--setenv",
+ "GOPROXY",
+ "off",
+ "--setenv",
+ "GOSUMDB",
+ "off",
+ "--setenv",
+ "GOVCS",
+ "*:off",
+ "--setenv",
+ "GOMODCACHE",
+ "/work/modules",
+ "--setenv",
+ "GOCACHE",
+ "/work/gocache",
+ "--setenv",
+ "GOMAXPROCS",
+ "4",
+ "--setenv",
+ "CGO_ENABLED",
+ "1",
+ "--setenv",
+ "GIT_CONFIG_NOSYSTEM",
+ "1",
+ "--setenv",
+ "GIT_CONFIG_GLOBAL",
+ "/work/home/test.gitconfig",
+ "--setenv",
+ "GIT_TERMINAL_PROMPT",
+ "0",
+ "--",
+ "go",
+ "test",
+ "-p",
+ "1",
+ "-json",
+ "-tags",
+ "sqlite sqlite_unlock_notify",
+ "./services/auth/source/oauth2",
+ "./cmd",
+ "./models/auth",
+ "./models/db",
+ "-run",
+ "TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQLHooks",
+ "-count=1"
+ ],
+ "workspace": "/tmp/custodian-forgejo-successor-attempt2",
+ "module_hashes": {
+ "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
+ "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf"
+ },
+ "network": "disabled",
+ "pid_namespace": "private",
+ "real_credentials": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/before-shape-guards/policy.md b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/before-shape-guards/policy.md
new file mode 100644
index 00000000..899af665
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/before-shape-guards/policy.md
@@ -0,0 +1,193 @@
+---
+id: forgejo.application-access
+name: Forgejo authenticated application access
+namespace: forgejo:application
+version: v1
+status: draft
+package: flexauth.forgejo.application
+allow_ttl: 10s
+actions: [application.access]
+owner: railiance-apps
+caring:
+ profile: caring-0.4.0-rc2
+ enforce: false
+---
+
+This source policy enforces the original three-group any-of in the sole PDP.
+The registry identifies the application tenant and admitted issuer. Fresh identity
+and UserInfo facts arrive only in request context from the admitted Forgejo caller,
+which verifies issuer JOSE and current UserInfo before this request. They are not
+static subject registry attributes. This policy requires aal2 assurance.
+The PEP independently verifies the ID token and supplies fresh UserInfo groups;
+the authenticated workload caller may represent only the Forgejo system. A
+decision authorizes one login callback, never a later HTTP/Git/SSH/API operation.
+The accompanying registry is synthetic test data, not an estate admission.
+
+```rego
+import rego.v1
+
+default decision := {"effect": "deny", "reason": "application_access_refused"}
+
+original_groups := {"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}
+
+decision := {"effect": "allow", "reason": "current_authenticated_application_access"} if {
+ input.action == "application.access"
+ object.get(input, "purpose", "") == ""
+ input.resource.id == "application:forgejo"
+ input.resource.type == "application"
+ input.resource.system == "forgejo"
+ input.tenant == input.resource.tenant
+ input.tenant == input.resource.attributes.tenant
+ input.subject.tenant == input.tenant
+ input.context.identity_tenant == input.tenant
+ input.subject.id == input.context.identity_subject
+ input.subject.type == input.context.identity_principal_type
+ input.subject.type == "human"
+ input.context.identity_issuer == input.resource.attributes.identity_issuer
+ input.context.identity_assurance == "aal2"
+ count(input.context.required_groups_any_of) == 3
+ {g | g := input.context.required_groups_any_of[_]} == original_groups
+ some group in input.context.current_userinfo_groups
+ group in original_groups
+ is_string(input.context.decisionpep_request_nonce)
+ count(input.context.decisionpep_request_nonce) == 64
+}
+```
+
+```rego test
+package flexauth.forgejo.application_test
+import rego.v1
+import data.flexauth.forgejo.application
+
+valid_request := {
+ "tenant": "tenant:synthetic",
+ "subject": {
+ "id": "user:synthetic",
+ "type": "human",
+ "tenant": "tenant:synthetic"
+ },
+ "action": "application.access",
+ "resource": {
+ "id": "application:forgejo",
+ "type": "application",
+ "system": "forgejo",
+ "tenant": "tenant:synthetic",
+ "attributes": {
+ "tenant": "tenant:synthetic",
+ "identity_issuer": "https://issuer.invalid"
+ }
+ },
+ "context": {
+ "identity_tenant": "tenant:synthetic",
+ "identity_subject": "user:synthetic",
+ "identity_principal_type": "human",
+ "identity_issuer": "https://issuer.invalid",
+ "identity_assurance": "aal2",
+ "current_userinfo_groups": [
+ "forge-admins"
+ ],
+ "required_groups_any_of": [
+ "forge-admins",
+ "forge-coulomb-owners",
+ "forge-coulomb-readers"
+ ],
+ "decisionpep_request_nonce": "0000000000000000000000000000000000000000000000000000000000000000"
+ }
+}
+
+test_original_groups_allow if {
+ every group in ["forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"] {
+ application.decision.effect == "allow" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"current_userinfo_groups": [group]})})
+ }
+}
+
+test_outsider_denied if {
+ application.decision.effect == "deny" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"current_userinfo_groups": ["outsider"]})})
+}
+
+test_missing_identity_denied if {
+ application.decision.effect == "deny" with input as object.union(object.remove(valid_request, ["context"]), {"context": object.remove(valid_request.context, ["identity_issuer"])})
+}
+
+test_low_assurance_denied if {
+ application.decision.effect == "deny" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"identity_assurance": "aal1"})})
+}
+
+test_changed_group_contract_denied if {
+ application.decision.effect == "deny" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"required_groups_any_of": ["outsider"]})})
+}
+```
+
+```yaml fixture
+[
+ {
+ "id": "allowed-original-group",
+ "request": {
+ "tenant": "tenant:synthetic",
+ "subject": {
+ "id": "user:synthetic",
+ "type": "human",
+ "tenant": "tenant:synthetic"
+ },
+ "action": "application.access",
+ "resource": {
+ "id": "application:forgejo",
+ "type": "application",
+ "system": "forgejo",
+ "tenant": "tenant:synthetic",
+ "attributes": {
+ "tenant": "tenant:synthetic",
+ "identity_issuer": "https://issuer.invalid"
+ }
+ },
+ "context": {
+ "identity_tenant": "tenant:synthetic",
+ "identity_subject": "user:synthetic",
+ "identity_principal_type": "human",
+ "identity_issuer": "https://issuer.invalid",
+ "identity_assurance": "aal2",
+ "current_userinfo_groups": [
+ "forge-admins"
+ ],
+ "required_groups_any_of": [
+ "forge-admins",
+ "forge-coulomb-owners",
+ "forge-coulomb-readers"
+ ],
+ "decisionpep_request_nonce": "0000000000000000000000000000000000000000000000000000000000000000"
+ }
+ },
+ "expect": {
+ "effect": "allow",
+ "reason": "current_authenticated_application_access"
+ }
+ },
+ {
+ "id": "missing-identity-context",
+ "request": {
+ "tenant": "tenant:synthetic",
+ "subject": {
+ "id": "user:synthetic",
+ "type": "human",
+ "tenant": "tenant:synthetic"
+ },
+ "action": "application.access",
+ "resource": {
+ "id": "application:forgejo",
+ "type": "application",
+ "system": "forgejo",
+ "tenant": "tenant:synthetic",
+ "attributes": {
+ "tenant": "tenant:synthetic",
+ "identity_issuer": "https://issuer.invalid"
+ }
+ },
+ "context": {}
+ },
+ "expect": {
+ "effect": "deny",
+ "reason": "application_access_refused"
+ }
+ }
+]
+```
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/cli-attempt1/cli-attempts.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/cli-attempt1/cli-attempts.json
new file mode 100644
index 00000000..9c4736bf
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/cli-attempt1/cli-attempts.json
@@ -0,0 +1,47 @@
+[
+ {
+ "operation": [
+ "migrate"
+ ],
+ "returncode": 0,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "refused-debug-logging",
+ "--provider",
+ "github",
+ "--secret-file",
+ "/run/forgejo-oidc/CLIENT_SECRET"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ },
+ {
+ "operation": [
+ "admin",
+ "auth",
+ "add-oauth",
+ "--name",
+ "synthetic-oauth",
+ "--provider",
+ "github",
+ "--key",
+ "synthetic-public-id",
+ "--secret-file",
+ "/run/forgejo-oidc/CLIENT_SECRET",
+ "--group-claim-name",
+ "groups",
+ "--admin-group",
+ "unchanged-admin",
+ "--scopes",
+ "read:user,user:email"
+ ],
+ "returncode": 1,
+ "stdout_stderr_secret_absent": true
+ }
+]
\ No newline at end of file
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/cli-attempt1/test_composed_cli.py b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/cli-attempt1/test_composed_cli.py
new file mode 100644
index 00000000..7c1dfe8f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/cli-attempt1/test_composed_cli.py
@@ -0,0 +1,99 @@
+import pathlib,subprocess,json,sqlite3,os,shlex,time
+w=pathlib.Path('/tmp/custodian-forgejo-successor-attempt2/cli-work');s='/tmp/forgejo-private-input-r1';r='/tmp/forgejo-independent-r1'
+fixtures=w/'fixtures'; fixtures.mkdir(exist_ok=True)
+A='AbCdEf012345678-'*4;B='ZyXwVu_987654321'*4 # synthetic exact64
+assert len(A)==64 and len(B)==64
+for name,data,mode in [('good',A,0o400),('replacement',B,0o440),('newline',A+'\n',0o400),('short',A[:-1],0o400),('long',A+'A',0o400),('badbyte',A[:-1]+'=',0o400),('world',A,0o444),('writable',A,0o600),('executable',A,0o500),('empty','',0o400),('CLIENT_SECRET','',0o400)]:
+ p=fixtures/name
+ if p.exists():p.chmod(0o600)
+ p.write_text(data);p.chmod(mode)
+for name in ['symlink']:
+ p=fixtures/name
+ if not p.exists():p.symlink_to('good')
+if not (fixtures/'fifo').exists():os.mkfifo(fixtures/'fifo',0o400)
+(fixtures/'directory').mkdir(exist_ok=True)
+(fixtures/'badparent').mkdir(exist_ok=True);(fixtures/'badparent').chmod(0o777)
+if (fixtures/'badparent/value').exists():(fixtures/'badparent/value').chmod(0o600)
+(fixtures/'badparent/value').write_text(A);(fixtures/'badparent/value').chmod(0o400)
+if not (fixtures/'parentlink').exists():(fixtures/'parentlink').symlink_to('directory',target_is_directory=True)
+(w/'runtime').mkdir(exist_ok=True)
+dbfile=w/'runtime/test.db'
+if dbfile.exists():dbfile.unlink() # isolated synthetic test database only
+ini=w/'runtime/app.ini';ini.write_text('''APP_NAME = synthetic-private-input-test
+RUN_USER = worsch
+WORK_PATH = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = SYNTHETIC-TEST-KEY
+[database]
+DB_TYPE = sqlite3
+SLOW_QUERY_THRESHOLD = 1ns
+PATH = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime/test.db
+[server]
+APP_DATA_PATH = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime/data
+OFFLINE_MODE = true
+[repository]
+ROOT = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime/repos
+[log]
+MODE = console
+LEVEL = Error
+''')
+env={'PATH':'/usr/bin:/bin','HOME':str(w/'home'),'GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':str(w/'home/test.gitconfig'),'GIT_TERMINAL_PROMPT':'0','USER':'worsch','GITEA_WORK_DIR':str(w/'runtime')}
+base=['bwrap','--unshare-pid','--unshare-net','--ro-bind','/usr','/usr','--ro-bind','/lib','/lib','--ro-bind','/lib64','/lib64','--symlink','usr/bin','/bin','--proc','/proc','--dev','/dev','--tmpfs','/tmp','--bind',str(w),str(w),'--dir','/run','--ro-bind',str(fixtures),'/run/forgejo-oidc','--ro-bind',str(fixtures/'good'),'/run/forgejo-oidc/CLIENT_SECRET','--bind',str(fixtures),'/run/writable-input','--chdir',str(w/'runtime'),'--','env','-i']+[k+'='+v for k,v in env.items()]+[str(w/'forgejo'),'--config',str(ini)]
+results=[]
+def run(args,ok=True,reason=None):
+ p=subprocess.run(base+args,capture_output=True,text=True,timeout=60); output=p.stdout+p.stderr
+ assert A not in output and B not in output, 'synthetic input leaked in output'
+ assert all(A not in arg and B not in arg for arg in base+args), 'synthetic input in argv'
+ assert all(A not in v and B not in v for v in env.values()), 'synthetic input in env'
+ results.append({'operation':args,'returncode':p.returncode,'stdout_stderr_secret_absent':True})
+ (w/'cli-attempts.json').write_text(json.dumps(results,indent=2))
+ if (p.returncode==0)!=ok:raise AssertionError('CLI unexpected status: '+repr(args)+'\n'+output[-5000:])
+ if reason:assert reason in output,output[-2000:]
+ return p
+run(['migrate'])
+clean_ini=ini.read_text()
+ini.write_text(clean_ini.replace('DB_TYPE = sqlite3', 'DB_TYPE = sqlite3\nLOG_SQL = true'))
+run(['admin','auth','add-oauth','--name','refused-debug-logging','--provider','github','--secret-file','/run/forgejo-oidc/CLIENT_SECRET'],False,'OAuth configuration requires SQL logging disabled')
+ini.write_text(clean_ini)
+def rows():
+ with sqlite3.connect(w/'runtime/test.db') as db:return db.execute('select id,name,cfg from login_source order by id').fetchall()
+def cfg():return json.loads(rows()[0][2])
+run(['admin','auth','add-oauth','--name','synthetic-oauth','--provider','github','--key','synthetic-public-id','--secret-file','/run/forgejo-oidc/CLIENT_SECRET','--group-claim-name','groups','--admin-group','unchanged-admin','--scopes','read:user,user:email'])
+assert len(rows())==1 and cfg()['ClientSecret']==A
+id=str(rows()[0][0]); before=cfg()
+run(['admin','auth','update-oauth','--id',id,'--icon-url','https://synthetic.invalid/icon'])
+assert cfg()['ClientSecret']==A
+preserved=cfg()
+run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/replacement'])
+after=cfg();assert after['ClientSecret']==B
+assert {k:v for k,v in after.items() if k!='ClientSecret'}=={k:v for k,v in preserved.items() if k!='ClientSecret'},'secret replacement changed unrelated config'
+# Guarded inactive source exercises actual update omission and strict list semantics
+# without discovery/network or claiming a browser login.
+with sqlite3.connect(w/'runtime/test.db') as db:
+ guarded=after|{'Provider':'openidConnect','OpenIDConnectAutoDiscoveryURL':'https://synthetic.invalid/.well-known/openid-configuration','RequiredClaimName':'groups','RequiredClaimValues':['forge-admins','forge-coulomb-owners','forge-coulomb-readers']}
+ db.execute('update login_source set is_active=0,cfg=? where id=?',(json.dumps(guarded),id))
+run(['admin','auth','update-oauth','--id',id,'--name','synthetic-guarded'])
+assert cfg()['RequiredClaimValues']==guarded['RequiredClaimValues'] and cfg()['ClientSecret']==B
+run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/good'])
+assert cfg()['ClientSecret']==A and cfg()['RequiredClaimValues']==guarded['RequiredClaimValues']
+for path in ['/run/forgejo-oidc/'+n for n in ['newline','short','long','badbyte','world','writable','executable','empty','symlink','fifo','directory','missing','badparent/value','parentlink/value']]+['relative','','/run/forgejo-oidc/../forgejo-oidc/good','/run/writable-input/good']:
+ before=rows()
+ for cmd in [['admin','auth','add-oauth','--name','refused','--provider','github'],['admin','auth','update-oauth','--id',id,'--name','refused']]:
+ run(cmd+['--secret-file',path],False,'secret-file input refused')
+ assert rows()==before,'failure changed DB'
+for action in [['add-oauth','--name','refused'],['update-oauth','--id',id]]:
+ before=rows();run(['admin','auth']+action+['--secret','','--secret-file','/run/forgejo-oidc/good'],False,'mutually exclusive');assert rows()==before
+# Failure to clear/ambiguously replace gate keeps stored application bytes unchanged.
+before=rows();run(['admin','auth','update-oauth','--id',id,'--required-claim-values',''],False);assert rows()==before
+# Actual XORM error hook under a failing SQLite trigger must not disclose cfg.
+before=rows()
+with sqlite3.connect(w/'runtime/test.db') as database:
+ database.execute("create trigger synthetic_private_error before update on login_source begin select raise(abort, 'synthetic-db-failure'); end")
+run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/replacement'],False,'OAuth source update failed')
+assert rows()==before
+with sqlite3.connect(w/'runtime/test.db') as database:database.execute('drop trigger synthetic_private_error')
+# Legacy explicit secret remains supported; synthetic legacy string is not private input.
+run(['admin','auth','update-oauth','--id',id,'--secret','synthetic-legacy-literal'])
+assert cfg()['ClientSecret']=='synthetic-legacy-literal' and cfg()['RequiredClaimValues']==guarded['RequiredClaimValues']
+(w/'cli-results.json').write_text(json.dumps({'passed':True,'subprocesses':len(results),'real_backend_cli_and_sqlite':True,'network':'disabled by bwrap','secret_inputs':'synthetic only','values_never_in_argv_env_output':True,'actual_browser_login':False,'actual_readonly_file_bind':True,'replacement_preserves_other_config':True,'unsafe_SQL_logging_refused':True,'actual_error_and_slow_hooks_no_leak':True},indent=2));print('CLI integrations passed:',len(results))
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/producer-attempt1/policy.md b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/producer-attempt1/policy.md
new file mode 100644
index 00000000..2c5b0d70
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/evidence/producer-attempt1/policy.md
@@ -0,0 +1,193 @@
+---
+id: forgejo.application-access
+name: Forgejo authenticated application access
+namespace: forgejo:application
+version: v1
+status: draft
+package: flexauth.forgejo.application
+allow_ttl: 10s
+actions: [application.access]
+owner: railiance-apps
+caring:
+ profile: caring-0.4.0-rc2
+ enforce: false
+---
+
+This source policy enforces the original three-group any-of in the sole PDP.
+The registry identifies the application tenant and admitted issuer. Fresh identity
+and UserInfo facts arrive only in request context from the admitted Forgejo caller,
+which verifies issuer JOSE and current UserInfo before this request. They are not
+static subject registry attributes. This policy requires aal2 assurance.
+The PEP independently verifies the ID token and supplies fresh UserInfo groups;
+the authenticated workload caller may represent only the Forgejo system. A
+decision authorizes one login callback, never a later HTTP/Git/SSH/API operation.
+The accompanying registry is synthetic test data, not an estate admission.
+
+```rego
+import rego.v1
+
+default decision := {"effect": "deny", "reason": "application_access_refused"}
+
+original_groups := {"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}
+
+decision := {"effect": "allow", "reason": "current_authenticated_application_access"} if {
+ input.action == "application.access"
+ object.get(input, "purpose", "") == ""
+ input.resource.id == "application:forgejo"
+ input.resource.type == "application"
+ input.resource.system == "forgejo"
+ input.tenant == input.resource.tenant
+ input.tenant == input.resource.attributes.tenant
+ input.subject.tenant == input.tenant
+ input.context.identity_tenant == input.tenant
+ input.subject.id == input.context.identity_subject
+ input.subject.type == input.context.identity_principal_type
+ input.subject.type == "human"
+ input.context.identity_issuer == input.resource.attributes.identity_issuer
+ input.context.identity_assurance == "aal2"
+ count(input.context.required_groups_any_of) == 3
+ {g | g := input.context.required_groups_any_of[_]} == original_groups
+ some group in input.context.current_userinfo_groups
+ group in original_groups
+ is_string(input.context.decisionpep_request_nonce)
+ count(input.context.decisionpep_request_nonce) == 64
+}
+```
+
+```rego test
+package flexauth.forgejo.application_test
+import rego.v1
+import data.flexauth.forgejo.application
+
+valid_request := {
+ "tenant": "tenant:synthetic",
+ "subject": {
+ "id": "user:synthetic",
+ "type": "human",
+ "tenant": "tenant:synthetic"
+ },
+ "action": "application.access",
+ "resource": {
+ "id": "application:forgejo",
+ "type": "application",
+ "system": "forgejo",
+ "tenant": "tenant:synthetic",
+ "attributes": {
+ "tenant": "tenant:synthetic",
+ "identity_issuer": "https://issuer.invalid"
+ }
+ },
+ "context": {
+ "identity_tenant": "tenant:synthetic",
+ "identity_subject": "user:synthetic",
+ "identity_principal_type": "human",
+ "identity_issuer": "https://issuer.invalid",
+ "identity_assurance": "aal2",
+ "current_userinfo_groups": [
+ "forge-admins"
+ ],
+ "required_groups_any_of": [
+ "forge-admins",
+ "forge-coulomb-owners",
+ "forge-coulomb-readers"
+ ],
+ "decisionpep_request_nonce": "0000000000000000000000000000000000000000000000000000000000000000"
+ }
+}
+
+test_original_groups_allow if {
+ every group in ["forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"] {
+ application.decision.effect == "allow" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"current_userinfo_groups": [group]})})
+ }
+}
+
+test_outsider_denied if {
+ application.decision.effect == "deny" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"current_userinfo_groups": ["outsider"]})})
+}
+
+test_missing_identity_denied if {
+ application.decision.effect == "deny" with input as object.union(valid_request, {"context": object.remove(valid_request.context, ["identity_issuer"])})
+}
+
+test_low_assurance_denied if {
+ application.decision.effect == "deny" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"identity_assurance": "aal1"})})
+}
+
+test_changed_group_contract_denied if {
+ application.decision.effect == "deny" with input as object.union(valid_request, {"context": object.union(valid_request.context, {"required_groups_any_of": ["outsider"]})})
+}
+```
+
+```yaml fixture
+[
+ {
+ "id": "allowed-original-group",
+ "request": {
+ "tenant": "tenant:synthetic",
+ "subject": {
+ "id": "user:synthetic",
+ "type": "human",
+ "tenant": "tenant:synthetic"
+ },
+ "action": "application.access",
+ "resource": {
+ "id": "application:forgejo",
+ "type": "application",
+ "system": "forgejo",
+ "tenant": "tenant:synthetic",
+ "attributes": {
+ "tenant": "tenant:synthetic",
+ "identity_issuer": "https://issuer.invalid"
+ }
+ },
+ "context": {
+ "identity_tenant": "tenant:synthetic",
+ "identity_subject": "user:synthetic",
+ "identity_principal_type": "human",
+ "identity_issuer": "https://issuer.invalid",
+ "identity_assurance": "aal2",
+ "current_userinfo_groups": [
+ "forge-admins"
+ ],
+ "required_groups_any_of": [
+ "forge-admins",
+ "forge-coulomb-owners",
+ "forge-coulomb-readers"
+ ],
+ "decisionpep_request_nonce": "0000000000000000000000000000000000000000000000000000000000000000"
+ }
+ },
+ "expect": {
+ "effect": "allow",
+ "reason": "current_authenticated_application_access"
+ }
+ },
+ {
+ "id": "missing-identity-context",
+ "request": {
+ "tenant": "tenant:synthetic",
+ "subject": {
+ "id": "user:synthetic",
+ "type": "human",
+ "tenant": "tenant:synthetic"
+ },
+ "action": "application.access",
+ "resource": {
+ "id": "application:forgejo",
+ "type": "application",
+ "system": "forgejo",
+ "tenant": "tenant:synthetic",
+ "attributes": {
+ "tenant": "tenant:synthetic",
+ "identity_issuer": "https://issuer.invalid"
+ }
+ },
+ "context": {}
+ },
+ "expect": {
+ "effect": "deny",
+ "reason": "application_access_refused"
+ }
+ }
+]
+```
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/cmd/admin_auth_oauth.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/cmd/admin_auth_oauth.go
new file mode 100644
index 00000000..83e15f6d
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/cmd/admin_auth_oauth.go
@@ -0,0 +1,368 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+ "errors"
+ "fmt"
+ "net/url"
+
+ auth_model "forgejo.org/models/auth"
+ "forgejo.org/models/db"
+ "forgejo.org/services/auth/source/oauth2"
+
+ "github.com/urfave/cli/v2"
+)
+
+var (
+ oauthCLIFlags = []cli.Flag{
+ &cli.StringFlag{
+ Name: "name",
+ Value: "",
+ Usage: "Application Name",
+ },
+ &cli.StringFlag{
+ Name: "provider",
+ Value: "",
+ Usage: "OAuth2 Provider",
+ },
+ &cli.StringFlag{
+ Name: "key",
+ Value: "",
+ Usage: "Client ID (Key)",
+ },
+ &cli.StringFlag{
+ Name: "secret",
+ Value: "",
+ Usage: "Client Secret",
+ },
+ &cli.StringFlag{
+ Name: "secret-file",
+ Usage: "Read a 64-byte base64url client secret from an admitted read-only regular file",
+ },
+ &cli.StringFlag{
+ Name: "auto-discover-url",
+ Value: "",
+ Usage: "OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider)",
+ },
+ &cli.StringFlag{
+ Name: "use-custom-urls",
+ Value: "false",
+ Usage: "Use custom URLs for GitLab/GitHub OAuth endpoints",
+ },
+ &cli.StringFlag{
+ Name: "custom-tenant-id",
+ Value: "",
+ Usage: "Use custom Tenant ID for OAuth endpoints",
+ },
+ &cli.StringFlag{
+ Name: "custom-auth-url",
+ Value: "",
+ Usage: "Use a custom Authorization URL (option for GitLab/GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "custom-token-url",
+ Value: "",
+ Usage: "Use a custom Token URL (option for GitLab/GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "custom-profile-url",
+ Value: "",
+ Usage: "Use a custom Profile URL (option for GitLab/GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "custom-email-url",
+ Value: "",
+ Usage: "Use a custom Email URL (option for GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "icon-url",
+ Value: "",
+ Usage: "Custom icon URL for OAuth2 login source",
+ },
+ &cli.BoolFlag{
+ Name: "skip-local-2fa",
+ Usage: "Set to true to skip local 2fa for users authenticated by this source",
+ },
+ &cli.StringSliceFlag{
+ Name: "scopes",
+ Value: nil,
+ Usage: "Scopes to request when to authenticate against this OAuth2 source",
+ },
+ &cli.StringFlag{
+ Name: "required-claim-name",
+ Value: "",
+ Usage: "Claim name that has to be set to allow users to login with this source",
+ },
+ &cli.StringFlag{
+ Name: "required-claim-value",
+ Value: "",
+ Usage: "Claim value that has to be set to allow users to login with this source",
+ },
+ &cli.StringSliceFlag{
+ Name: "required-claim-values",
+ Usage: "Require any one exact array value from current OpenID Connect UserInfo (cannot combine with required-claim-value)",
+ },
+ &cli.StringFlag{
+ Name: "group-claim-name",
+ Value: "",
+ Usage: "Claim name providing group names for this source",
+ },
+ &cli.StringFlag{
+ Name: "admin-group",
+ Value: "",
+ Usage: "Group Claim value for administrator users",
+ },
+ &cli.StringFlag{
+ Name: "restricted-group",
+ Value: "",
+ Usage: "Group Claim value for restricted users",
+ },
+ &cli.StringFlag{
+ Name: "group-team-map",
+ Value: "",
+ Usage: "JSON mapping between groups and org teams",
+ },
+ &cli.BoolFlag{
+ Name: "group-team-map-removal",
+ Usage: "Activate automatic team membership removal depending on groups",
+ },
+ }
+
+ microcmdAuthAddOauth = &cli.Command{
+ Name: "add-oauth",
+ Usage: "Add new Oauth authentication source",
+ Action: runAddOauth,
+ Flags: oauthCLIFlags,
+ }
+
+ microcmdAuthUpdateOauth = &cli.Command{
+ Name: "update-oauth",
+ Usage: "Update existing Oauth authentication source",
+ Action: runUpdateOauth,
+ Flags: append(oauthCLIFlags[:1], append([]cli.Flag{idFlag}, oauthCLIFlags[1:]...)...),
+ }
+)
+
+func parseOAuth2Config(c *cli.Context) *oauth2.Source {
+ var customURLMapping *oauth2.CustomURLMapping
+ if c.IsSet("use-custom-urls") {
+ customURLMapping = &oauth2.CustomURLMapping{
+ TokenURL: c.String("custom-token-url"),
+ AuthURL: c.String("custom-auth-url"),
+ ProfileURL: c.String("custom-profile-url"),
+ EmailURL: c.String("custom-email-url"),
+ Tenant: c.String("custom-tenant-id"),
+ }
+ } else {
+ customURLMapping = nil
+ }
+ return &oauth2.Source{
+ Provider: c.String("provider"),
+ ClientID: c.String("key"),
+ ClientSecret: c.String("secret"),
+ OpenIDConnectAutoDiscoveryURL: c.String("auto-discover-url"),
+ CustomURLMapping: customURLMapping,
+ IconURL: c.String("icon-url"),
+ SkipLocalTwoFA: c.Bool("skip-local-2fa"),
+ Scopes: c.StringSlice("scopes"),
+ RequiredClaimName: c.String("required-claim-name"),
+ RequiredClaimValue: c.String("required-claim-value"),
+ RequiredClaimValues: c.StringSlice("required-claim-values"),
+ GroupClaimName: c.String("group-claim-name"),
+ AdminGroup: c.String("admin-group"),
+ RestrictedGroup: c.String("restricted-group"),
+ GroupTeamMap: c.String("group-team-map"),
+ GroupTeamMapRemoval: c.Bool("group-team-map-removal"),
+ }
+}
+
+func runAddOauth(c *cli.Context) error {
+ secret, selected, err := oauthSecretInput(c)
+ if err != nil {
+ return err
+ }
+ ctx, cancel := installSignals()
+ defer cancel()
+ ctx = db.WithSensitiveSQL(ctx)
+
+ if err := initDB(ctx); err != nil {
+ return err
+ }
+ if db.SQLLoggingEnabled(ctx) {
+ return errors.New("OAuth configuration requires SQL logging disabled")
+ }
+
+ config := parseOAuth2Config(c)
+ if selected {
+ config.ClientSecret = secret
+ }
+ if err := oauth2.ValidateRequiredClaimValues(config.RequiredClaimName, config.RequiredClaimValue, config.RequiredClaimValues); err != nil {
+ return err
+ }
+ if config.RequiredClaimValues != nil && config.Provider != "openidConnect" {
+ return errors.New("required-claim-values requires openidConnect")
+ }
+ if config.Provider == "openidConnect" {
+ discoveryURL, err := url.Parse(config.OpenIDConnectAutoDiscoveryURL)
+ if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
+ return fmt.Errorf("invalid Auto Discovery URL: %s (this must be a valid URL starting with http:// or https://)", config.OpenIDConnectAutoDiscoveryURL)
+ }
+ }
+
+ err = auth_model.CreateSource(ctx, &auth_model.Source{
+ Type: auth_model.OAuth2,
+ Name: c.String("name"),
+ IsActive: true,
+ Cfg: config,
+ })
+ if err != nil && c.IsSet("secret-file") {
+ return errors.New("OAuth source creation failed")
+ }
+ return err
+}
+
+func runUpdateOauth(c *cli.Context) error {
+ secret, selected, err := oauthSecretInput(c)
+ if err != nil {
+ return err
+ }
+ if !c.IsSet("id") {
+ return errors.New("--id flag is missing")
+ }
+
+ ctx, cancel := installSignals()
+ defer cancel()
+ ctx = db.WithSensitiveSQL(ctx)
+
+ if err := initDB(ctx); err != nil {
+ return err
+ }
+ if db.SQLLoggingEnabled(ctx) {
+ return errors.New("OAuth configuration requires SQL logging disabled")
+ }
+
+ source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
+ if err != nil {
+ return err
+ }
+
+ oAuth2Config, ok := source.Cfg.(*oauth2.Source)
+ if !ok {
+ return errors.New("authentication source is not OAuth2")
+ }
+
+ if c.IsSet("name") {
+ source.Name = c.String("name")
+ }
+
+ if c.IsSet("provider") {
+ oAuth2Config.Provider = c.String("provider")
+ }
+
+ if c.IsSet("key") {
+ oAuth2Config.ClientID = c.String("key")
+ }
+
+ if selected {
+ oAuth2Config.ClientSecret = secret
+ }
+
+ if c.IsSet("auto-discover-url") {
+ oAuth2Config.OpenIDConnectAutoDiscoveryURL = c.String("auto-discover-url")
+ }
+
+ if c.IsSet("icon-url") {
+ oAuth2Config.IconURL = c.String("icon-url")
+ }
+
+ if c.IsSet("scopes") {
+ oAuth2Config.Scopes = c.StringSlice("scopes")
+ }
+
+ if c.IsSet("required-claim-name") {
+ oAuth2Config.RequiredClaimName = c.String("required-claim-name")
+ }
+ if c.IsSet("required-claim-value") {
+ oAuth2Config.RequiredClaimValue = c.String("required-claim-value")
+ }
+
+ if c.IsSet("required-claim-values") {
+ oAuth2Config.RequiredClaimValues = c.StringSlice("required-claim-values")
+ }
+
+ if c.IsSet("group-claim-name") {
+ oAuth2Config.GroupClaimName = c.String("group-claim-name")
+ }
+ if c.IsSet("admin-group") {
+ oAuth2Config.AdminGroup = c.String("admin-group")
+ }
+ if c.IsSet("restricted-group") {
+ oAuth2Config.RestrictedGroup = c.String("restricted-group")
+ }
+ if c.IsSet("group-team-map") {
+ oAuth2Config.GroupTeamMap = c.String("group-team-map")
+ }
+ if c.IsSet("group-team-map-removal") {
+ oAuth2Config.GroupTeamMapRemoval = c.Bool("group-team-map-removal")
+ }
+
+ // update custom URL mapping
+ customURLMapping := &oauth2.CustomURLMapping{}
+
+ if oAuth2Config.CustomURLMapping != nil {
+ customURLMapping.TokenURL = oAuth2Config.CustomURLMapping.TokenURL
+ customURLMapping.AuthURL = oAuth2Config.CustomURLMapping.AuthURL
+ customURLMapping.ProfileURL = oAuth2Config.CustomURLMapping.ProfileURL
+ customURLMapping.EmailURL = oAuth2Config.CustomURLMapping.EmailURL
+ customURLMapping.Tenant = oAuth2Config.CustomURLMapping.Tenant
+ }
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-token-url") {
+ customURLMapping.TokenURL = c.String("custom-token-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-auth-url") {
+ customURLMapping.AuthURL = c.String("custom-auth-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-profile-url") {
+ customURLMapping.ProfileURL = c.String("custom-profile-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-email-url") {
+ customURLMapping.EmailURL = c.String("custom-email-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-tenant-id") {
+ customURLMapping.Tenant = c.String("custom-tenant-id")
+ }
+
+ oAuth2Config.CustomURLMapping = customURLMapping
+ if err := oauth2.ValidateRequiredClaimValues(oAuth2Config.RequiredClaimName, oAuth2Config.RequiredClaimValue, oAuth2Config.RequiredClaimValues); err != nil {
+ return err
+ }
+ if oAuth2Config.RequiredClaimValues != nil && oAuth2Config.Provider != "openidConnect" {
+ return errors.New("required-claim-values requires openidConnect")
+ }
+ source.Cfg = oAuth2Config
+
+ err = auth_model.UpdateSource(ctx, source)
+ if err != nil && c.IsSet("secret-file") {
+ return errors.New("OAuth source update failed")
+ }
+ return err
+}
+
+// Resolve before opening the DB or mutating a loaded source. Never store the
+// resolved bytes in the CLI context: they must not become flag/argv diagnostics.
+func oauthSecretInput(c *cli.Context) (string, bool, error) {
+ if c.IsSet("secret-file") {
+ if c.IsSet("secret") {
+ return "", false, errors.New("secret and secret-file are mutually exclusive")
+ }
+ value, err := readOAuthSecretFile(c.String("secret-file"))
+ return value, true, err
+ }
+ return c.String("secret"), c.IsSet("secret"), nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/go.mod b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/go.mod
new file mode 100644
index 00000000..28ac2c88
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/go.mod
@@ -0,0 +1,261 @@
+module forgejo.org
+
+go 1.24
+
+toolchain go1.24.3
+
+require (
+ code.forgejo.org/f3/gof3/v3 v3.10.6
+ code.forgejo.org/forgejo-contrib/go-libravatar v0.0.0-20191008002943-06d1c002b251
+ code.forgejo.org/forgejo/levelqueue v1.0.0
+ code.forgejo.org/forgejo/reply v1.0.2
+ code.forgejo.org/go-chi/binding v1.0.0
+ code.forgejo.org/go-chi/cache v1.0.0
+ code.forgejo.org/go-chi/captcha v1.0.1
+ code.forgejo.org/go-chi/session v1.0.1
+ code.gitea.io/actions-proto-go v0.4.0
+ code.gitea.io/sdk/gitea v0.20.0
+ codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
+ connectrpc.com/connect v1.17.0
+ github.com/42wim/httpsig v1.2.2
+ github.com/42wim/sshsig v0.0.0-20211121163825-841cf5bbc121
+ github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358
+ github.com/ProtonMail/go-crypto v1.1.6
+ github.com/PuerkitoBio/goquery v1.10.2
+ github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.7.2
+ github.com/alecthomas/chroma/v2 v2.15.0
+ github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
+ github.com/blevesearch/bleve/v2 v2.5.2
+ github.com/buildkite/terminal-to-html/v3 v3.16.8
+ github.com/caddyserver/certmagic v0.22.2
+ github.com/chi-middleware/proxy v1.1.1
+ github.com/djherbis/buffer v1.2.0
+ github.com/djherbis/nio/v3 v3.0.1
+ github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
+ github.com/dustin/go-humanize v1.0.1
+ github.com/editorconfig/editorconfig-core-go/v2 v2.6.3
+ github.com/emersion/go-imap v1.2.1
+ github.com/felixge/fgprof v0.9.5
+ github.com/fsnotify/fsnotify v1.8.0
+ github.com/gliderlabs/ssh v0.3.8
+ github.com/go-ap/activitypub v0.0.0-20231114162308-e219254dc5c9
+ github.com/go-ap/jsonld v0.0.0-20221030091449-f2a191312c73
+ github.com/go-chi/chi/v5 v5.2.0
+ github.com/go-chi/cors v1.2.1
+ github.com/go-co-op/gocron v1.37.0
+ github.com/go-enry/go-enry/v2 v2.9.2
+ github.com/go-git/go-git/v5 v5.13.2
+ github.com/go-ldap/ldap/v3 v3.4.6
+ github.com/go-openapi/spec v0.20.14
+ github.com/go-sql-driver/mysql v1.9.1
+ github.com/go-webauthn/webauthn v0.12.2
+ github.com/gobwas/glob v0.2.3
+ github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
+ github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
+ github.com/golang-jwt/jwt/v5 v5.2.2
+ github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0
+ github.com/google/go-github/v64 v64.0.0
+ github.com/google/pprof v0.0.0-20241017200806-017d972448fc
+ github.com/google/uuid v1.6.0
+ github.com/gorilla/feeds v1.2.0
+ github.com/gorilla/sessions v1.4.0
+ github.com/hashicorp/go-version v1.7.0
+ github.com/hashicorp/golang-lru/v2 v2.0.7
+ github.com/huandu/xstrings v1.5.0
+ github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056
+ github.com/jhillyerd/enmime/v2 v2.1.0
+ github.com/json-iterator/go v1.1.12
+ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
+ github.com/klauspost/compress v1.17.11
+ github.com/klauspost/cpuid/v2 v2.2.10
+ github.com/lib/pq v1.10.9
+ github.com/markbates/goth v1.80.0
+ github.com/mattn/go-isatty v0.0.20
+ github.com/mattn/go-sqlite3 v1.14.28
+ github.com/meilisearch/meilisearch-go v0.31.0
+ github.com/mholt/archiver/v3 v3.5.1
+ github.com/microcosm-cc/bluemonday v1.0.27
+ github.com/minio/minio-go/v7 v7.0.88
+ github.com/msteinert/pam/v2 v2.1.0
+ github.com/nektos/act v0.2.52
+ github.com/niklasfasching/go-org v1.7.0
+ github.com/olivere/elastic/v7 v7.0.32
+ github.com/opencontainers/go-digest v1.0.0
+ github.com/opencontainers/image-spec v1.1.1
+ github.com/pquerna/otp v1.4.0
+ github.com/prometheus/client_golang v1.21.1
+ github.com/redis/go-redis/v9 v9.7.3
+ github.com/robfig/cron/v3 v3.0.1
+ github.com/santhosh-tekuri/jsonschema/v6 v6.0.1
+ github.com/sassoftware/go-rpmutils v0.4.0
+ github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
+ github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92
+ github.com/stretchr/testify v1.10.0
+ github.com/syndtr/goleveldb v1.0.0
+ github.com/ulikunitz/xz v0.5.12
+ github.com/urfave/cli/v2 v2.27.6
+ github.com/valyala/fastjson v1.6.4
+ github.com/yohcop/openid-go v1.0.1
+ github.com/yuin/goldmark v1.7.8
+ github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
+ gitlab.com/gitlab-org/api/client-go v0.126.0
+ go.uber.org/mock v0.5.0
+ golang.org/x/crypto v0.36.0
+ golang.org/x/image v0.25.0
+ golang.org/x/net v0.38.0
+ golang.org/x/oauth2 v0.28.0
+ golang.org/x/sync v0.12.0
+ golang.org/x/sys v0.31.0
+ golang.org/x/text v0.23.0
+ google.golang.org/protobuf v1.36.4
+ gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
+ gopkg.in/ini.v1 v1.67.0
+ gopkg.in/yaml.v3 v3.0.1
+ mvdan.cc/xurls/v2 v2.5.0
+ xorm.io/builder v0.3.13
+ xorm.io/xorm v1.3.9
+)
+
+require (
+ cloud.google.com/go/compute/metadata v0.6.0 // indirect
+ dario.cat/mergo v1.0.0 // indirect
+ filippo.io/edwards25519 v1.1.0 // indirect
+ git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078 // indirect
+ github.com/DataDog/zstd v1.5.5 // indirect
+ github.com/Microsoft/go-winio v0.6.2 // indirect
+ github.com/RoaringBitmap/roaring/v2 v2.4.5 // indirect
+ github.com/andybalholm/brotli v1.1.1 // indirect
+ github.com/andybalholm/cascadia v1.3.3 // indirect
+ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
+ github.com/aymerick/douceur v0.2.0 // indirect
+ github.com/beorn7/perks v1.0.1 // indirect
+ github.com/bits-and-blooms/bitset v1.22.0 // indirect
+ github.com/blevesearch/bleve_index_api v1.2.8 // indirect
+ github.com/blevesearch/geo v0.2.3 // indirect
+ github.com/blevesearch/go-faiss v1.0.25 // indirect
+ github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
+ github.com/blevesearch/gtreap v0.1.1 // indirect
+ github.com/blevesearch/mmap-go v1.0.4 // indirect
+ github.com/blevesearch/scorch_segment_api/v2 v2.3.10 // indirect
+ github.com/blevesearch/segment v0.9.1 // indirect
+ github.com/blevesearch/snowballstem v0.9.0 // indirect
+ github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
+ github.com/blevesearch/vellum v1.1.0 // indirect
+ github.com/blevesearch/zapx/v11 v11.4.2 // indirect
+ github.com/blevesearch/zapx/v12 v12.4.2 // indirect
+ github.com/blevesearch/zapx/v13 v13.4.2 // indirect
+ github.com/blevesearch/zapx/v14 v14.4.2 // indirect
+ github.com/blevesearch/zapx/v15 v15.4.2 // indirect
+ github.com/blevesearch/zapx/v16 v16.2.4 // indirect
+ github.com/boombuler/barcode v1.0.1 // indirect
+ github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 // indirect
+ github.com/caddyserver/zerossl v0.1.3 // indirect
+ github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
+ github.com/cespare/xxhash/v2 v2.3.0 // indirect
+ github.com/cloudflare/circl v1.6.1 // indirect
+ github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+ github.com/cyphar/filepath-securejoin v0.3.6 // indirect
+ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+ github.com/davidmz/go-pageant v1.0.2 // indirect
+ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+ github.com/dlclark/regexp2 v1.11.4 // indirect
+ github.com/emersion/go-sasl v0.0.0-20231106173351-e73c9f7bad43 // indirect
+ github.com/emirpasic/gods v1.18.1 // indirect
+ github.com/fatih/color v1.16.0 // indirect
+ github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+ github.com/go-ap/errors v0.0.0-20231003111023-183eef4b31b7 // indirect
+ github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
+ github.com/go-enry/go-oniguruma v1.2.1 // indirect
+ github.com/go-fed/httpsig v1.1.0 // indirect
+ github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+ github.com/go-git/go-billy/v5 v5.6.2 // indirect
+ github.com/go-ini/ini v1.67.0 // indirect
+ github.com/go-openapi/jsonpointer v0.20.2 // indirect
+ github.com/go-openapi/jsonreference v0.20.4 // indirect
+ github.com/go-openapi/swag v0.22.7 // indirect
+ github.com/go-webauthn/x v0.1.20 // indirect
+ github.com/goccy/go-json v0.10.5 // indirect
+ github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
+ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+ github.com/golang/protobuf v1.5.4 // indirect
+ github.com/golang/snappy v0.0.4 // indirect
+ github.com/google/btree v1.1.2 // indirect
+ github.com/google/go-cmp v0.7.0 // indirect
+ github.com/google/go-querystring v1.1.0 // indirect
+ github.com/google/go-tpm v0.9.3 // indirect
+ github.com/gorilla/css v1.0.1 // indirect
+ github.com/gorilla/mux v1.8.1 // indirect
+ github.com/gorilla/securecookie v1.1.2 // indirect
+ github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+ github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+ github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+ github.com/josharian/intern v1.0.0 // indirect
+ github.com/kevinburke/ssh_config v1.2.0 // indirect
+ github.com/klauspost/pgzip v1.2.6 // indirect
+ github.com/libdns/libdns v0.2.3 // indirect
+ github.com/mailru/easyjson v0.9.0 // indirect
+ github.com/markbates/going v1.0.3 // indirect
+ github.com/mattn/go-colorable v0.1.13 // indirect
+ github.com/mattn/go-runewidth v0.0.16 // indirect
+ github.com/mholt/acmez/v3 v3.1.1 // indirect
+ github.com/miekg/dns v1.1.63 // indirect
+ github.com/minio/crc64nvme v1.0.1 // indirect
+ github.com/minio/md5-simd v1.1.2 // indirect
+ github.com/mitchellh/mapstructure v1.5.0 // indirect
+ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+ github.com/modern-go/reflect2 v1.0.2 // indirect
+ github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 // indirect
+ github.com/mschoch/smat v0.2.0 // indirect
+ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+ github.com/nwaples/rardecode v1.1.3 // indirect
+ github.com/olekukonko/tablewriter v0.0.5 // indirect
+ github.com/onsi/ginkgo v1.16.5 // indirect
+ github.com/pierrec/lz4/v4 v4.1.21 // indirect
+ github.com/pjbgf/sha1cd v0.3.2 // indirect
+ github.com/pkg/errors v0.9.1 // indirect
+ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+ github.com/prometheus/client_model v0.6.1 // indirect
+ github.com/prometheus/common v0.62.0 // indirect
+ github.com/prometheus/procfs v0.15.1 // indirect
+ github.com/rhysd/actionlint v1.6.27 // indirect
+ github.com/rivo/uniseg v0.4.7 // indirect
+ github.com/rogpeppe/go-internal v1.13.1 // indirect
+ github.com/rs/xid v1.6.0 // indirect
+ github.com/russross/blackfriday/v2 v2.1.0 // indirect
+ github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
+ github.com/sirupsen/logrus v1.9.3 // indirect
+ github.com/skeema/knownhosts v1.3.0 // indirect
+ github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
+ github.com/x448/float16 v0.8.4 // indirect
+ github.com/xanzy/ssh-agent v0.3.3 // indirect
+ github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
+ github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+ github.com/zeebo/assert v1.3.0 // indirect
+ github.com/zeebo/blake3 v0.2.4 // indirect
+ go.etcd.io/bbolt v1.4.0 // indirect
+ go.uber.org/atomic v1.11.0 // indirect
+ go.uber.org/multierr v1.11.0 // indirect
+ go.uber.org/zap v1.27.0 // indirect
+ go.uber.org/zap/exp v0.3.0 // indirect
+ golang.org/x/mod v0.24.0 // indirect
+ golang.org/x/time v0.10.0 // indirect
+ golang.org/x/tools v0.31.0 // indirect
+ gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
+ gopkg.in/warnings.v0 v0.1.2 // indirect
+)
+
+replace github.com/hashicorp/go-version => github.com/6543/go-version v1.3.1
+
+replace github.com/shurcooL/vfsgen => github.com/lunny/vfsgen v0.0.0-20220105142115-2c99e1ffdfa0
+
+replace github.com/nektos/act => code.forgejo.org/forgejo/act v1.25.1
+
+replace github.com/mholt/archiver/v3 => code.forgejo.org/forgejo/archiver/v3 v3.5.1
+
+replace github.com/gliderlabs/ssh => code.forgejo.org/forgejo/ssh v0.0.0-20241211213324-5fc306ca0616
+
+replace git.sr.ht/~mariusor/go-xsd-duration => code.forgejo.org/forgejo/go-xsd-duration v0.0.0-20220703122237-02e73435a078
+
+require github.com/netkingdom/access-engine v0.0.0
+
+replace github.com/netkingdom/access-engine => ./third_party/access-engine-pep
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/models/db/sensitive_sql.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/models/db/sensitive_sql.go
new file mode 100644
index 00000000..12816072
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/models/db/sensitive_sql.go
@@ -0,0 +1,47 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package db
+
+import (
+ "context"
+ "forgejo.org/modules/setting"
+ "xorm.io/xorm"
+)
+
+type sensitiveSQLKey struct{}
+
+// WithSensitiveSQL suppresses argument, statement and driver-error disclosure
+// in the application's query hooks. The caller must separately refuse raw XORM
+// SQL logging; custom driver/server auditing remains an owner custody concern.
+func WithSensitiveSQL(ctx context.Context) context.Context {
+ return context.WithValue(ctx, sensitiveSQLKey{}, true)
+}
+func isSensitiveSQL(ctx context.Context) bool {
+ sensitive, _ := ctx.Value(sensitiveSQLKey{}).(bool)
+ return sensitive
+}
+
+// SQLLoggingEnabled checks the underlying engine without changing the context or
+// assuming that a sensitive context still exposes an Engine rather than Session.
+// Unknown/uninitialized backends refuse, and query redaction never permits raw
+// XORM logging. It neither creates a transaction nor closes an existing one.
+func SQLLoggingEnabled(ctx context.Context) bool {
+ if setting.Database.LogSQL {
+ return true
+ }
+ engine := getEngine(ctx)
+ if engine == nil {
+ if x == nil {
+ return true
+ }
+ engine = x
+ }
+ switch current := engine.(type) {
+ case *xorm.Engine:
+ return current == nil || current.Logger() == nil || current.Logger().IsShowSQL()
+ case *xorm.Session:
+ return current == nil || current.Engine() == nil || current.Engine().Logger() == nil || current.Engine().Logger().IsShowSQL()
+ default:
+ return true
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/models/db/sensitive_sql_logging_test.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/models/db/sensitive_sql_logging_test.go
new file mode 100644
index 00000000..81b63fd3
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/models/db/sensitive_sql_logging_test.go
@@ -0,0 +1,41 @@
+package db
+
+import (
+ "context"
+ "testing"
+
+ "forgejo.org/modules/setting"
+ "xorm.io/xorm"
+)
+
+func TestSensitiveSQLLoggingChecksUnderlyingEngine(t *testing.T) {
+ engine, err := xorm.NewEngine("sqlite3", "file::memory:?cache=shared")
+ if err != nil {
+ t.Fatal(err)
+ }
+ defer engine.Close()
+ engine.SetLogger(NewXORMLogger(false))
+ session := engine.NewSession()
+ defer session.Close()
+ previous := setting.Database.LogSQL
+ defer func() { setting.Database.LogSQL = previous }()
+ for name, backend := range map[string]Engine{"engine": engine, "session": session} {
+ t.Run(name, func(t *testing.T) {
+ ctx := WithSensitiveSQL(newContext(context.Background(), backend, false))
+ setting.Database.LogSQL = false
+ engine.ShowSQL(false)
+ if SQLLoggingEnabled(ctx) {
+ t.Fatal("private context with disabled actual SQL logger refused")
+ }
+ engine.ShowSQL(true)
+ if !SQLLoggingEnabled(ctx) {
+ t.Fatal("actual raw SQL logger escaped refusal")
+ }
+ engine.ShowSQL(false)
+ setting.Database.LogSQL = true
+ if !SQLLoggingEnabled(ctx) {
+ t.Fatal("configured raw SQL logger escaped refusal")
+ }
+ })
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/routers/web/auth/oauth.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/routers/web/auth/oauth.go
new file mode 100644
index 00000000..5e7f8fe9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/routers/web/auth/oauth.go
@@ -0,0 +1,1487 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+ go_context "context"
+ "crypto/sha256"
+ "encoding/base64"
+ "errors"
+ "fmt"
+ "html"
+ "html/template"
+ "io"
+ "net/http"
+ "net/url"
+ "sort"
+ "strings"
+
+ asymkey_model "forgejo.org/models/asymkey"
+ "forgejo.org/models/auth"
+ org_model "forgejo.org/models/organization"
+ user_model "forgejo.org/models/user"
+ auth_module "forgejo.org/modules/auth"
+ "forgejo.org/modules/base"
+ "forgejo.org/modules/container"
+ "forgejo.org/modules/json"
+ "forgejo.org/modules/log"
+ "forgejo.org/modules/optional"
+ "forgejo.org/modules/setting"
+ "forgejo.org/modules/timeutil"
+ "forgejo.org/modules/util"
+ "forgejo.org/modules/web"
+ "forgejo.org/modules/web/middleware"
+ auth_service "forgejo.org/services/auth"
+ source_service "forgejo.org/services/auth/source"
+ "forgejo.org/services/auth/source/oauth2"
+ "forgejo.org/services/context"
+ "forgejo.org/services/externalaccount"
+ "forgejo.org/services/forms"
+ remote_service "forgejo.org/services/remote"
+ user_service "forgejo.org/services/user"
+
+ "code.forgejo.org/go-chi/binding"
+ "github.com/golang-jwt/jwt/v5"
+ "github.com/markbates/goth"
+ "github.com/markbates/goth/gothic"
+ "github.com/markbates/goth/providers/fitbit"
+ "github.com/markbates/goth/providers/openidConnect"
+ "github.com/markbates/goth/providers/zoom"
+ go_oauth2 "golang.org/x/oauth2"
+)
+
+const (
+ tplGrantAccess base.TplName = "user/auth/grant"
+ tplGrantError base.TplName = "user/auth/grant_error"
+)
+
+// TODO move error and responses to SDK or models
+
+// AuthorizeErrorCode represents an error code specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1
+type AuthorizeErrorCode string
+
+const (
+ // ErrorCodeInvalidRequest represents the according error in RFC 6749
+ ErrorCodeInvalidRequest AuthorizeErrorCode = "invalid_request"
+ // ErrorCodeUnauthorizedClient represents the according error in RFC 6749
+ ErrorCodeUnauthorizedClient AuthorizeErrorCode = "unauthorized_client"
+ // ErrorCodeAccessDenied represents the according error in RFC 6749
+ ErrorCodeAccessDenied AuthorizeErrorCode = "access_denied"
+ // ErrorCodeUnsupportedResponseType represents the according error in RFC 6749
+ ErrorCodeUnsupportedResponseType AuthorizeErrorCode = "unsupported_response_type"
+ // ErrorCodeInvalidScope represents the according error in RFC 6749
+ ErrorCodeInvalidScope AuthorizeErrorCode = "invalid_scope"
+ // ErrorCodeServerError represents the according error in RFC 6749
+ ErrorCodeServerError AuthorizeErrorCode = "server_error"
+ // ErrorCodeTemporaryUnavailable represents the according error in RFC 6749
+ ErrorCodeTemporaryUnavailable AuthorizeErrorCode = "temporarily_unavailable"
+)
+
+// AuthorizeError represents an error type specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1
+type AuthorizeError struct {
+ ErrorCode AuthorizeErrorCode `json:"error" form:"error"`
+ ErrorDescription string
+ State string
+}
+
+// Error returns the error message
+func (err AuthorizeError) Error() string {
+ return fmt.Sprintf("%s: %s", err.ErrorCode, err.ErrorDescription)
+}
+
+// AccessTokenErrorCode represents an error code specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+type AccessTokenErrorCode string
+
+const (
+ // AccessTokenErrorCodeInvalidRequest represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidRequest AccessTokenErrorCode = "invalid_request"
+ // AccessTokenErrorCodeInvalidClient represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidClient = "invalid_client"
+ // AccessTokenErrorCodeInvalidGrant represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidGrant = "invalid_grant"
+ // AccessTokenErrorCodeUnauthorizedClient represents an error code specified in RFC 6749
+ AccessTokenErrorCodeUnauthorizedClient = "unauthorized_client"
+ // AccessTokenErrorCodeUnsupportedGrantType represents an error code specified in RFC 6749
+ AccessTokenErrorCodeUnsupportedGrantType = "unsupported_grant_type"
+ // AccessTokenErrorCodeInvalidScope represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidScope = "invalid_scope"
+)
+
+// AccessTokenError represents an error response specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+type AccessTokenError struct {
+ ErrorCode AccessTokenErrorCode `json:"error" form:"error"`
+ ErrorDescription string `json:"error_description"`
+}
+
+// Error returns the error message
+func (err AccessTokenError) Error() string {
+ return fmt.Sprintf("%s: %s", err.ErrorCode, err.ErrorDescription)
+}
+
+// errCallback represents a oauth2 callback error
+type errCallback struct {
+ Code string
+ Description string
+}
+
+func (err errCallback) Error() string {
+ return err.Description
+}
+
+// TokenType specifies the kind of token
+type TokenType string
+
+const (
+ // TokenTypeBearer represents a token type specified in RFC 6749
+ TokenTypeBearer TokenType = "bearer"
+ // TokenTypeMAC represents a token type specified in RFC 6749
+ TokenTypeMAC = "mac"
+)
+
+// AccessTokenResponse represents a successful access token response
+// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2
+type AccessTokenResponse struct {
+ AccessToken string `json:"access_token"`
+ TokenType TokenType `json:"token_type"`
+ ExpiresIn int64 `json:"expires_in"`
+ RefreshToken string `json:"refresh_token"`
+ IDToken string `json:"id_token,omitempty"`
+}
+
+func newAccessTokenResponse(ctx go_context.Context, grant *auth.OAuth2Grant, serverKey, clientKey oauth2.JWTSigningKey) (*AccessTokenResponse, *AccessTokenError) {
+ if setting.OAuth2.InvalidateRefreshTokens {
+ if err := grant.IncreaseCounter(ctx); err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidGrant,
+ ErrorDescription: "cannot increase the grant counter",
+ }
+ }
+ }
+ // generate access token to access the API
+ expirationDate := timeutil.TimeStampNow().Add(setting.OAuth2.AccessTokenExpirationTime)
+ accessToken := &oauth2.Token{
+ GrantID: grant.ID,
+ Type: oauth2.TypeAccessToken,
+ RegisteredClaims: jwt.RegisteredClaims{
+ ExpiresAt: jwt.NewNumericDate(expirationDate.AsTime()),
+ },
+ }
+ signedAccessToken, err := accessToken.SignToken(serverKey)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot sign token",
+ }
+ }
+
+ // generate refresh token to request an access token after it expired later
+ refreshExpirationDate := timeutil.TimeStampNow().Add(setting.OAuth2.RefreshTokenExpirationTime * 60 * 60).AsTime()
+ refreshToken := &oauth2.Token{
+ GrantID: grant.ID,
+ Counter: grant.Counter,
+ Type: oauth2.TypeRefreshToken,
+ RegisteredClaims: jwt.RegisteredClaims{
+ ExpiresAt: jwt.NewNumericDate(refreshExpirationDate),
+ },
+ }
+ signedRefreshToken, err := refreshToken.SignToken(serverKey)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot sign token",
+ }
+ }
+
+ // generate OpenID Connect id_token
+ signedIDToken := ""
+ if grant.ScopeContains("openid") {
+ app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot find application",
+ }
+ }
+ user, err := user_model.GetUserByID(ctx, grant.UserID)
+ if err != nil {
+ if user_model.IsErrUserNotExist(err) {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot find user",
+ }
+ }
+ log.Error("Error loading user: %v", err)
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "server error",
+ }
+ }
+
+ idToken := &oauth2.OIDCToken{
+ RegisteredClaims: jwt.RegisteredClaims{
+ ExpiresAt: jwt.NewNumericDate(expirationDate.AsTime()),
+ Issuer: setting.AppURL,
+ Audience: []string{app.ClientID},
+ Subject: fmt.Sprint(grant.UserID),
+ },
+ Nonce: grant.Nonce,
+ }
+ if grant.ScopeContains("profile") {
+ idToken.Name = user.DisplayName()
+ idToken.PreferredUsername = user.Name
+ idToken.Profile = user.HTMLURL()
+ idToken.Picture = user.AvatarLink(ctx)
+ idToken.Website = user.Website
+ idToken.Locale = user.Language
+ idToken.UpdatedAt = user.UpdatedUnix
+ }
+ if grant.ScopeContains("email") {
+ idToken.Email = user.Email
+ idToken.EmailVerified = user.IsActive
+ }
+ if grant.ScopeContains("groups") {
+ onlyPublicGroups := ifOnlyPublicGroups(grant.Scope)
+
+ groups, err := getOAuthGroupsForUser(ctx, user, onlyPublicGroups)
+ if err != nil {
+ log.Error("Error getting groups: %v", err)
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "server error",
+ }
+ }
+ idToken.Groups = groups
+ }
+
+ signedIDToken, err = idToken.SignToken(clientKey)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot sign token",
+ }
+ }
+ }
+
+ return &AccessTokenResponse{
+ AccessToken: signedAccessToken,
+ TokenType: TokenTypeBearer,
+ ExpiresIn: setting.OAuth2.AccessTokenExpirationTime,
+ RefreshToken: signedRefreshToken,
+ IDToken: signedIDToken,
+ }, nil
+}
+
+type userInfoResponse struct {
+ Sub string `json:"sub"`
+ Name string `json:"name"`
+ Username string `json:"preferred_username"`
+ Email string `json:"email"`
+ Picture string `json:"picture"`
+ Groups []string `json:"groups,omitempty"`
+}
+
+func ifOnlyPublicGroups(scopes string) bool {
+ scopes = strings.ReplaceAll(scopes, ",", " ")
+ scopesList := strings.Fields(scopes)
+ for _, scope := range scopesList {
+ if scope == "all" || scope == "read:organization" || scope == "read:admin" {
+ return false
+ }
+ }
+ return true
+}
+
+// InfoOAuth manages request for userinfo endpoint
+func InfoOAuth(ctx *context.Context) {
+ if ctx.Doer == nil || ctx.Data["AuthedMethod"] != (&auth_service.OAuth2{}).Name() {
+ ctx.Resp.Header().Set("WWW-Authenticate", `Bearer realm=""`)
+ ctx.PlainText(http.StatusUnauthorized, "no valid authorization")
+ return
+ }
+
+ response := &userInfoResponse{
+ Sub: fmt.Sprint(ctx.Doer.ID),
+ Name: ctx.Doer.DisplayName(),
+ Username: ctx.Doer.Name,
+ Email: ctx.Doer.Email,
+ Picture: ctx.Doer.AvatarLink(ctx),
+ }
+
+ var token string
+ if auHead := ctx.Req.Header.Get("Authorization"); auHead != "" {
+ auths := strings.Fields(auHead)
+ if len(auths) == 2 && (auths[0] == "token" || strings.ToLower(auths[0]) == "bearer") {
+ token = auths[1]
+ }
+ }
+
+ _, grantScopes := auth_service.CheckOAuthAccessToken(ctx, token)
+ onlyPublicGroups := ifOnlyPublicGroups(grantScopes)
+
+ groups, err := getOAuthGroupsForUser(ctx, ctx.Doer, onlyPublicGroups)
+ if err != nil {
+ ctx.ServerError("Oauth groups for user", err)
+ return
+ }
+ response.Groups = groups
+
+ ctx.JSON(http.StatusOK, response)
+}
+
+// returns a list of "org" and "org:team" strings,
+// that the given user is a part of.
+func getOAuthGroupsForUser(ctx go_context.Context, user *user_model.User, onlyPublicGroups bool) ([]string, error) {
+ orgs, err := org_model.GetUserOrgsList(ctx, user)
+ if err != nil {
+ return nil, fmt.Errorf("GetUserOrgList: %w", err)
+ }
+
+ var groups []string
+ for _, org := range orgs {
+ if setting.OAuth2.EnableAdditionalGrantScopes {
+ if onlyPublicGroups {
+ public, err := org_model.IsPublicMembership(ctx, org.ID, user.ID)
+ if !public && err == nil {
+ continue
+ }
+ }
+ }
+
+ groups = append(groups, org.Name)
+ teams, err := org.LoadTeams(ctx)
+ if err != nil {
+ return nil, fmt.Errorf("LoadTeams: %w", err)
+ }
+ for _, team := range teams {
+ if team.IsMember(ctx, user.ID) {
+ groups = append(groups, org.Name+":"+team.LowerName)
+ }
+ }
+ }
+ return groups, nil
+}
+
+func parseBasicAuth(ctx *context.Context) (username, password string, err error) {
+ authHeader := ctx.Req.Header.Get("Authorization")
+ if authType, authData, ok := strings.Cut(authHeader, " "); ok && strings.EqualFold(authType, "Basic") {
+ return base.BasicAuthDecode(authData)
+ }
+ return "", "", errors.New("invalid basic authentication")
+}
+
+// IntrospectOAuth introspects an oauth token
+func IntrospectOAuth(ctx *context.Context) {
+ clientIDValid := false
+ if clientID, clientSecret, err := parseBasicAuth(ctx); err == nil {
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, clientID)
+ if err != nil && !auth.IsErrOauthClientIDInvalid(err) {
+ // this is likely a database error; log it and respond without details
+ log.Error("Error retrieving client_id: %v", err)
+ ctx.Error(http.StatusInternalServerError)
+ return
+ }
+ clientIDValid = err == nil && app.ValidateClientSecret([]byte(clientSecret))
+ }
+ if !clientIDValid {
+ ctx.Resp.Header().Set("WWW-Authenticate", `Basic realm=""`)
+ ctx.PlainText(http.StatusUnauthorized, "no valid authorization")
+ return
+ }
+
+ var response struct {
+ Active bool `json:"active"`
+ Scope string `json:"scope,omitempty"`
+ Username string `json:"username,omitempty"`
+ jwt.RegisteredClaims
+ }
+
+ form := web.GetForm(ctx).(*forms.IntrospectTokenForm)
+ token, err := oauth2.ParseToken(form.Token, oauth2.DefaultSigningKey)
+ if err == nil {
+ grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
+ if err == nil && grant != nil {
+ app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
+ if err == nil && app != nil {
+ response.Active = true
+ response.Scope = grant.Scope
+ response.Issuer = setting.AppURL
+ response.Audience = []string{app.ClientID}
+ response.Subject = fmt.Sprint(grant.UserID)
+ }
+ if user, err := user_model.GetUserByID(ctx, grant.UserID); err == nil {
+ response.Username = user.Name
+ }
+ }
+ }
+
+ ctx.JSON(http.StatusOK, response)
+}
+
+// AuthorizeOAuth manages authorize requests
+func AuthorizeOAuth(ctx *context.Context) {
+ form := web.GetForm(ctx).(*forms.AuthorizationForm)
+ errs := binding.Errors{}
+ errs = form.Validate(ctx.Req, errs)
+ if len(errs) > 0 {
+ errstring := ""
+ for _, e := range errs {
+ errstring += e.Error() + "\n"
+ }
+ ctx.ServerError("AuthorizeOAuth: Validate: ", fmt.Errorf("errors occurred during validation: %s", errstring))
+ return
+ }
+
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ if auth.IsErrOauthClientIDInvalid(err) {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeUnauthorizedClient,
+ ErrorDescription: "Client ID not registered",
+ State: form.State,
+ }, "")
+ return
+ }
+ ctx.ServerError("GetOAuth2ApplicationByClientID", err)
+ return
+ }
+
+ var user *user_model.User
+ if app.UID != 0 {
+ user, err = user_model.GetUserByID(ctx, app.UID)
+ if err != nil {
+ ctx.ServerError("GetUserByID", err)
+ return
+ }
+ }
+
+ if !app.ContainsRedirectURI(form.RedirectURI) {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeInvalidRequest,
+ ErrorDescription: "Unregistered Redirect URI",
+ State: form.State,
+ }, "")
+ return
+ }
+
+ if form.ResponseType != "code" {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeUnsupportedResponseType,
+ ErrorDescription: "Only code response type is supported.",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+
+ // pkce support
+ switch form.CodeChallengeMethod {
+ case "S256":
+ case "plain":
+ if err := ctx.Session.Set("CodeChallengeMethod", form.CodeChallengeMethod); err != nil {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeServerError,
+ ErrorDescription: "cannot set code challenge method",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+ if err := ctx.Session.Set("CodeChallengeMethod", form.CodeChallenge); err != nil {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeServerError,
+ ErrorDescription: "cannot set code challenge",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+ // Here we're just going to try to release the session early
+ if err := ctx.Session.Release(); err != nil {
+ // we'll tolerate errors here as they *should* get saved elsewhere
+ log.Error("Unable to save changes to the session: %v", err)
+ }
+ case "":
+ // "Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message"
+ // https://datatracker.ietf.org/doc/html/rfc8252#section-8.1
+ if !app.ConfidentialClient {
+ // "the authorization endpoint MUST return the authorization error response with the "error" value set to "invalid_request""
+ // https://datatracker.ietf.org/doc/html/rfc7636#section-4.4.1
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeInvalidRequest,
+ ErrorDescription: "PKCE is required for public clients",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+ default:
+ // "If the server supporting PKCE does not support the requested transformation, the authorization endpoint MUST return the authorization error response with "error" value set to "invalid_request"."
+ // https://www.rfc-editor.org/rfc/rfc7636#section-4.4.1
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeInvalidRequest,
+ ErrorDescription: "unsupported code challenge method",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+
+ grant, err := app.GetGrantByUserID(ctx, ctx.Doer.ID)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+
+ // Redirect if user already granted access and the application is confidential.
+ // I.e. always require authorization for public clients as recommended by RFC 6749 Section 10.2
+ if app.ConfidentialClient && grant != nil {
+ code, err := grant.GenerateNewAuthorizationCode(ctx, form.RedirectURI, form.CodeChallenge, form.CodeChallengeMethod)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ redirect, err := code.GenerateRedirectURI(form.State)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ // Update nonce to reflect the new session
+ if len(form.Nonce) > 0 {
+ err := grant.SetNonce(ctx, form.Nonce)
+ if err != nil {
+ log.Error("Unable to update nonce: %v", err)
+ }
+ }
+ ctx.Redirect(redirect.String())
+ return
+ }
+
+ // show authorize page to grant access
+ ctx.Data["Application"] = app
+ ctx.Data["RedirectURI"] = form.RedirectURI
+ ctx.Data["State"] = form.State
+ ctx.Data["Scope"] = form.Scope
+ ctx.Data["Nonce"] = form.Nonce
+ if user != nil {
+ ctx.Data["ApplicationCreatorLinkHTML"] = template.HTML(fmt.Sprintf(`@%s`, html.EscapeString(user.HomeLink()), html.EscapeString(user.Name)))
+ } else {
+ ctx.Data["ApplicationCreatorLinkHTML"] = template.HTML(fmt.Sprintf(`%s`, html.EscapeString(setting.AppSubURL+"/"), html.EscapeString(setting.AppName)))
+ }
+ ctx.Data["ApplicationRedirectDomainHTML"] = template.HTML("" + html.EscapeString(form.RedirectURI) + "")
+ // TODO document SESSION <=> FORM
+ err = ctx.Session.Set("client_id", app.ClientID)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ log.Error(err.Error())
+ return
+ }
+ err = ctx.Session.Set("redirect_uri", form.RedirectURI)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ log.Error(err.Error())
+ return
+ }
+ err = ctx.Session.Set("state", form.State)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ log.Error(err.Error())
+ return
+ }
+ // Here we're just going to try to release the session early
+ if err := ctx.Session.Release(); err != nil {
+ // we'll tolerate errors here as they *should* get saved elsewhere
+ log.Error("Unable to save changes to the session: %v", err)
+ }
+ ctx.HTML(http.StatusOK, tplGrantAccess)
+}
+
+// GrantApplicationOAuth manages the post request submitted when a user grants access to an application
+func GrantApplicationOAuth(ctx *context.Context) {
+ form := web.GetForm(ctx).(*forms.GrantApplicationForm)
+ if ctx.Session.Get("client_id") != form.ClientID || ctx.Session.Get("state") != form.State ||
+ ctx.Session.Get("redirect_uri") != form.RedirectURI {
+ ctx.Error(http.StatusBadRequest)
+ return
+ }
+
+ if !form.Granted {
+ handleAuthorizeError(ctx, AuthorizeError{
+ State: form.State,
+ ErrorDescription: "the request is denied",
+ ErrorCode: ErrorCodeAccessDenied,
+ }, form.RedirectURI)
+ return
+ }
+
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ ctx.ServerError("GetOAuth2ApplicationByClientID", err)
+ return
+ }
+ grant, err := app.GetGrantByUserID(ctx, ctx.Doer.ID)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ if grant == nil {
+ grant, err = app.CreateGrant(ctx, ctx.Doer.ID, form.Scope)
+ if err != nil {
+ handleAuthorizeError(ctx, AuthorizeError{
+ State: form.State,
+ ErrorDescription: "cannot create grant for user",
+ ErrorCode: ErrorCodeServerError,
+ }, form.RedirectURI)
+ return
+ }
+ } else if grant.Scope != form.Scope {
+ handleAuthorizeError(ctx, AuthorizeError{
+ State: form.State,
+ ErrorDescription: "a grant exists with different scope",
+ ErrorCode: ErrorCodeServerError,
+ }, form.RedirectURI)
+ return
+ }
+
+ if len(form.Nonce) > 0 {
+ err := grant.SetNonce(ctx, form.Nonce)
+ if err != nil {
+ log.Error("Unable to update nonce: %v", err)
+ }
+ }
+
+ var codeChallenge, codeChallengeMethod string
+ codeChallenge, _ = ctx.Session.Get("CodeChallenge").(string)
+ codeChallengeMethod, _ = ctx.Session.Get("CodeChallengeMethod").(string)
+
+ code, err := grant.GenerateNewAuthorizationCode(ctx, form.RedirectURI, codeChallenge, codeChallengeMethod)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ redirect, err := code.GenerateRedirectURI(form.State)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ ctx.Redirect(redirect.String(), http.StatusSeeOther)
+}
+
+// OIDCWellKnown generates JSON so OIDC clients know Gitea's capabilities
+func OIDCWellKnown(ctx *context.Context) {
+ ctx.Data["SigningKey"] = oauth2.DefaultSigningKey
+ ctx.JSONTemplate("user/auth/oidc_wellknown")
+}
+
+// OIDCKeys generates the JSON Web Key Set
+func OIDCKeys(ctx *context.Context) {
+ jwk, err := oauth2.DefaultSigningKey.ToJWK()
+ if err != nil {
+ log.Error("Error converting signing key to JWK: %v", err)
+ ctx.Error(http.StatusInternalServerError)
+ return
+ }
+
+ jwk["use"] = "sig"
+
+ jwks := map[string][]map[string]string{
+ "keys": {
+ jwk,
+ },
+ }
+
+ ctx.Resp.Header().Set("Content-Type", "application/json")
+ enc := json.NewEncoder(ctx.Resp)
+ if err := enc.Encode(jwks); err != nil {
+ log.Error("Failed to encode representation as json. Error: %v", err)
+ }
+}
+
+// AccessTokenOAuth manages all access token requests by the client
+func AccessTokenOAuth(ctx *context.Context) {
+ form := *web.GetForm(ctx).(*forms.AccessTokenForm)
+ // if there is no ClientID or ClientSecret in the request body, fill these fields by the Authorization header and ensure the provided field matches the Authorization header
+ if form.ClientID == "" || form.ClientSecret == "" {
+ authHeader := ctx.Req.Header.Get("Authorization")
+ if authType, authData, ok := strings.Cut(authHeader, " "); ok && strings.EqualFold(authType, "Basic") {
+ clientID, clientSecret, err := base.BasicAuthDecode(authData)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot parse basic auth header",
+ })
+ return
+ }
+ // validate that any fields present in the form match the Basic auth header
+ if form.ClientID != "" && form.ClientID != clientID {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "client_id in request body inconsistent with Authorization header",
+ })
+ return
+ }
+ form.ClientID = clientID
+ if form.ClientSecret != "" && form.ClientSecret != clientSecret {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "client_secret in request body inconsistent with Authorization header",
+ })
+ return
+ }
+ form.ClientSecret = clientSecret
+ }
+ }
+
+ serverKey := oauth2.DefaultSigningKey
+ clientKey := serverKey
+ if serverKey.IsSymmetric() {
+ var err error
+ clientKey, err = oauth2.CreateJWTSigningKey(serverKey.SigningMethod().Alg(), []byte(form.ClientSecret))
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "Error creating signing key",
+ })
+ return
+ }
+ }
+
+ switch form.GrantType {
+ case "refresh_token":
+ handleRefreshToken(ctx, form, serverKey, clientKey)
+ case "authorization_code":
+ handleAuthorizationCode(ctx, form, serverKey, clientKey)
+ default:
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnsupportedGrantType,
+ ErrorDescription: "Only refresh_token or authorization_code grant type is supported",
+ })
+ }
+}
+
+func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidClient,
+ ErrorDescription: fmt.Sprintf("cannot load client with client id: %q", form.ClientID),
+ })
+ return
+ }
+ // "The authorization server MUST ... require client authentication for confidential clients"
+ // https://datatracker.ietf.org/doc/html/rfc6749#section-6
+ if app.ConfidentialClient && !app.ValidateClientSecret([]byte(form.ClientSecret)) {
+ errorDescription := "invalid client secret"
+ if form.ClientSecret == "" {
+ errorDescription = "invalid empty client secret"
+ }
+ // "invalid_client ... Client authentication failed"
+ // https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidClient,
+ ErrorDescription: errorDescription,
+ })
+ return
+ }
+
+ token, err := oauth2.ParseToken(form.RefreshToken, serverKey)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "unable to parse refresh token",
+ })
+ return
+ }
+ // get grant before increasing counter
+ grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
+ if err != nil || grant == nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidGrant,
+ ErrorDescription: "grant does not exist",
+ })
+ return
+ }
+
+ // check if token got already used
+ if setting.OAuth2.InvalidateRefreshTokens && (grant.Counter != token.Counter || token.Counter == 0) {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "token was already used",
+ })
+ log.Warn("A client tried to use a refresh token for grant_id = %d was used twice!", grant.ID)
+ return
+ }
+ accessToken, tokenErr := newAccessTokenResponse(ctx, grant, serverKey, clientKey)
+ if tokenErr != nil {
+ handleAccessTokenError(ctx, *tokenErr)
+ return
+ }
+ ctx.JSON(http.StatusOK, accessToken)
+}
+
+func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidClient,
+ ErrorDescription: fmt.Sprintf("cannot load client with client id: '%s'", form.ClientID),
+ })
+ return
+ }
+ if app.ConfidentialClient && !app.ValidateClientSecret([]byte(form.ClientSecret)) {
+ errorDescription := "invalid client secret"
+ if form.ClientSecret == "" {
+ errorDescription = "invalid empty client secret"
+ }
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: errorDescription,
+ })
+ return
+ }
+ if form.RedirectURI != "" && !app.ContainsRedirectURI(form.RedirectURI) {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "unexpected redirect URI",
+ })
+ return
+ }
+ authorizationCode, err := auth.GetOAuth2AuthorizationByCode(ctx, form.Code)
+ if err != nil || authorizationCode == nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "client is not authorized",
+ })
+ return
+ }
+ // check if code verifier authorizes the client, PKCE support
+ if !authorizationCode.ValidateCodeChallenge(form.CodeVerifier) {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "failed PKCE code challenge",
+ })
+ return
+ }
+ // check if granted for this application
+ if authorizationCode.Grant.ApplicationID != app.ID {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidGrant,
+ ErrorDescription: "invalid grant",
+ })
+ return
+ }
+ // remove token from database to deny duplicate usage
+ if err := authorizationCode.Invalidate(ctx); err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot proceed your request",
+ })
+ }
+ resp, tokenErr := newAccessTokenResponse(ctx, authorizationCode.Grant, serverKey, clientKey)
+ if tokenErr != nil {
+ handleAccessTokenError(ctx, *tokenErr)
+ return
+ }
+ // send successful response
+ ctx.JSON(http.StatusOK, resp)
+}
+
+func handleAccessTokenError(ctx *context.Context, acErr AccessTokenError) {
+ ctx.JSON(http.StatusBadRequest, acErr)
+}
+
+func handleServerError(ctx *context.Context, state, redirectURI string, err error) {
+ log.Error("OAuth server error: %v", err)
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeServerError,
+ ErrorDescription: "A server error occurred",
+ State: state,
+ }, redirectURI)
+}
+
+func handleAuthorizeError(ctx *context.Context, authErr AuthorizeError, redirectURI string) {
+ if redirectURI == "" {
+ log.Warn("Authorization failed: %v", authErr.ErrorDescription)
+ ctx.Data["Error"] = authErr
+ ctx.HTML(http.StatusBadRequest, tplGrantError)
+ return
+ }
+ redirect, err := url.Parse(redirectURI)
+ if err != nil {
+ ctx.ServerError("url.Parse", err)
+ return
+ }
+ q := redirect.Query()
+ q.Set("error", string(authErr.ErrorCode))
+ q.Set("error_description", authErr.ErrorDescription)
+ q.Set("state", authErr.State)
+ redirect.RawQuery = q.Encode()
+ ctx.Redirect(redirect.String(), http.StatusSeeOther)
+}
+
+// SignInOAuth handles the OAuth2 login buttons
+func SignInOAuth(ctx *context.Context) {
+ provider := ctx.Params(":provider")
+
+ authSource, err := auth.GetActiveOAuth2SourceByName(ctx, provider)
+ if err != nil {
+ ctx.ServerError("SignIn", err)
+ return
+ }
+
+ redirectTo := ctx.FormString("redirect_to")
+ if len(redirectTo) > 0 {
+ middleware.SetRedirectToCookie(ctx.Resp, redirectTo)
+ }
+
+ // try to do a direct callback flow, so we don't authenticate the user again but use the valid accesstoken to get the user
+ user, gothUser, err := oAuth2UserLoginCallback(ctx, authSource, ctx.Req, ctx.Resp)
+ if err == nil && user != nil {
+ // we got the user without going through the whole OAuth2 authentication flow again
+ handleOAuth2SignIn(ctx, authSource, user, gothUser)
+ return
+ }
+
+ codeChallenge, err := generateCodeChallenge(ctx, provider)
+ if err != nil {
+ ctx.ServerError("SignIn", fmt.Errorf("could not generate code_challenge: %w", err))
+ return
+ }
+
+ if err = authSource.Cfg.(*oauth2.Source).Callout(ctx.Req, ctx.Resp, codeChallenge); err != nil {
+ if strings.Contains(err.Error(), "no provider for ") {
+ if err = oauth2.ResetOAuth2(ctx); err != nil {
+ ctx.ServerError("SignIn", err)
+ return
+ }
+ if err = authSource.Cfg.(*oauth2.Source).Callout(ctx.Req, ctx.Resp, codeChallenge); err != nil {
+ ctx.ServerError("SignIn", err)
+ }
+ return
+ }
+ ctx.ServerError("SignIn", err)
+ }
+ // redirect is done in oauth2.Auth
+}
+
+// SignInOAuthCallback handles the callback from the given provider
+func SignInOAuthCallback(ctx *context.Context) {
+ provider := ctx.Params(":provider")
+
+ if ctx.Req.FormValue("error") != "" {
+ var errorKeyValues []string
+ for k, vv := range ctx.Req.Form {
+ for _, v := range vv {
+ errorKeyValues = append(errorKeyValues, fmt.Sprintf("%s = %s", html.EscapeString(k), html.EscapeString(v)))
+ }
+ }
+ sort.Strings(errorKeyValues)
+ ctx.Flash.Error(strings.Join(errorKeyValues, "
"), true)
+ }
+
+ // first look if the provider is still active
+ authSource, err := auth.GetActiveOAuth2SourceByName(ctx, provider)
+ if err != nil {
+ ctx.ServerError("SignIn", err)
+ return
+ }
+
+ if authSource == nil {
+ ctx.ServerError("SignIn", errors.New("no valid provider found, check configured callback url in provider"))
+ return
+ }
+
+ u, gothUser, err := oAuth2UserLoginCallback(ctx, authSource, ctx.Req, ctx.Resp)
+ if err != nil {
+ if user_model.IsErrUserProhibitLogin(err) {
+ uplerr := err.(user_model.ErrUserProhibitLogin)
+ log.Info("Failed authentication attempt for %s from %s: %v", uplerr.Name, ctx.RemoteAddr(), err)
+ ctx.Data["Title"] = ctx.Tr("auth.prohibit_login")
+ ctx.HTML(http.StatusOK, "user/auth/prohibit_login")
+ return
+ }
+ if callbackErr, ok := err.(errCallback); ok {
+ log.Info("Failed OAuth callback: (%v) %v", callbackErr.Code, callbackErr.Description)
+ switch callbackErr.Code {
+ case "access_denied":
+ ctx.Flash.Error(ctx.Tr("auth.oauth.signin.error.access_denied"))
+ case "temporarily_unavailable":
+ ctx.Flash.Error(ctx.Tr("auth.oauth.signin.error.temporarily_unavailable"))
+ default:
+ ctx.Flash.Error(ctx.Tr("auth.oauth.signin.error"))
+ }
+ ctx.Redirect(setting.AppSubURL + "/user/login")
+ return
+ }
+ if err, ok := err.(*go_oauth2.RetrieveError); ok {
+ ctx.Flash.Error("OAuth2 RetrieveError: "+err.Error(), true)
+ ctx.Redirect(setting.AppSubURL + "/user/login")
+ return
+ }
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+
+ if u == nil {
+ if ctx.Doer != nil {
+ // attach user to already logged in user
+ err = externalaccount.LinkAccountToUser(ctx, ctx.Doer, gothUser)
+ if err != nil {
+ ctx.ServerError("UserLinkAccount", err)
+ return
+ }
+
+ ctx.Redirect(setting.AppSubURL + "/user/settings/security")
+ return
+ } else if !setting.Service.AllowOnlyInternalRegistration && setting.OAuth2Client.EnableAutoRegistration {
+ // create new user with details from oauth2 provider
+ if gothUser.UserID == "" {
+ log.Error("OAuth2 Provider %s returned empty or missing field: UserID", authSource.Name)
+ if authSource.IsOAuth2() && authSource.Cfg.(*oauth2.Source).Provider == "openidConnect" {
+ log.Error("You may need to change the 'OPENID_CONNECT_SCOPES' setting to request all required fields")
+ }
+ err = fmt.Errorf("OAuth2 Provider %s returned empty or missing field: UserID", authSource.Name)
+ ctx.ServerError("CreateUser", err)
+ return
+ }
+ var missingFields []string
+ if gothUser.Email == "" {
+ missingFields = append(missingFields, "email")
+ }
+ if setting.OAuth2Client.Username == setting.OAuth2UsernameNickname && gothUser.NickName == "" {
+ missingFields = append(missingFields, "nickname")
+ }
+ if len(missingFields) > 0 {
+ // we don't have enough information to create an account automatically,
+ // so we prompt the user for the remaining bits
+ log.Trace("OAuth2 Provider %s returned empty or missing fields: %s, prompting the user for them", authSource.Name, missingFields)
+ showLinkingLogin(ctx, gothUser)
+ return
+ }
+ uname, err := getUserName(&gothUser)
+ if err != nil {
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+ u = &user_model.User{
+ Name: uname,
+ FullName: gothUser.Name,
+ Email: gothUser.Email,
+ LoginType: auth.OAuth2,
+ LoginSource: authSource.ID,
+ LoginName: gothUser.UserID,
+ }
+
+ overwriteDefault := &user_model.CreateUserOverwriteOptions{
+ IsActive: optional.Some(!setting.OAuth2Client.RegisterEmailConfirm && !setting.Service.RegisterManualConfirm),
+ }
+
+ source := authSource.Cfg.(*oauth2.Source)
+
+ isAdmin, isRestricted := getUserAdminAndRestrictedFromGroupClaims(source, &gothUser)
+ u.IsAdmin = isAdmin.ValueOrDefault(false)
+ u.IsRestricted = isRestricted.ValueOrDefault(setting.Service.DefaultUserIsRestricted)
+
+ if !createAndHandleCreatedUser(ctx, base.TplName(""), nil, u, overwriteDefault, &gothUser, setting.OAuth2Client.AccountLinking != setting.OAuth2AccountLinkingDisabled) {
+ // error already handled
+ return
+ }
+
+ if err := syncGroupsToTeams(ctx, source, &gothUser, u); err != nil {
+ ctx.ServerError("SyncGroupsToTeams", err)
+ return
+ }
+ } else {
+ // no existing user is found, request attach or new account
+ showLinkingLogin(ctx, gothUser)
+ return
+ }
+ }
+
+ handleOAuth2SignIn(ctx, authSource, u, gothUser)
+}
+
+func claimValueToStringSet(claimValue any) container.Set[string] {
+ var groups []string
+
+ switch rawGroup := claimValue.(type) {
+ case []string:
+ groups = rawGroup
+ case []any:
+ for _, group := range rawGroup {
+ groups = append(groups, fmt.Sprintf("%s", group))
+ }
+ default:
+ str := fmt.Sprintf("%s", rawGroup)
+ groups = strings.Split(str, ",")
+ }
+ return container.SetOf(groups...)
+}
+
+func syncGroupsToTeams(ctx *context.Context, source *oauth2.Source, gothUser *goth.User, u *user_model.User) error {
+ if source.GroupTeamMap != "" || source.GroupTeamMapRemoval {
+ groupTeamMapping, err := auth_module.UnmarshalGroupTeamMapping(source.GroupTeamMap)
+ if err != nil {
+ return err
+ }
+
+ groups := getClaimedGroups(source, gothUser)
+
+ if err := source_service.SyncGroupsToTeams(ctx, u, groups, groupTeamMapping, source.GroupTeamMapRemoval); err != nil {
+ return err
+ }
+ }
+
+ return nil
+}
+
+func getClaimedGroups(source *oauth2.Source, gothUser *goth.User) container.Set[string] {
+ groupClaims, has := gothUser.RawData[source.GroupClaimName]
+ if !has {
+ return nil
+ }
+
+ return claimValueToStringSet(groupClaims)
+}
+
+func getUserAdminAndRestrictedFromGroupClaims(source *oauth2.Source, gothUser *goth.User) (isAdmin, isRestricted optional.Option[bool]) {
+ groups := getClaimedGroups(source, gothUser)
+
+ if source.AdminGroup != "" {
+ isAdmin = optional.Some(groups.Contains(source.AdminGroup))
+ }
+ if source.RestrictedGroup != "" {
+ isRestricted = optional.Some(groups.Contains(source.RestrictedGroup))
+ }
+
+ return isAdmin, isRestricted
+}
+
+func showLinkingLogin(ctx *context.Context, gothUser goth.User) {
+ if err := updateSession(ctx, nil, map[string]any{
+ "linkAccountGothUser": gothUser,
+ }); err != nil {
+ ctx.ServerError("updateSession", err)
+ return
+ }
+ ctx.Redirect(setting.AppSubURL + "/user/link_account")
+}
+
+func updateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {
+ if setting.OAuth2Client.UpdateAvatar && len(url) > 0 {
+ resp, err := http.Get(url)
+ if err == nil {
+ defer func() {
+ _ = resp.Body.Close()
+ }()
+ }
+ // ignore any error
+ if err == nil && resp.StatusCode == http.StatusOK {
+ data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1))
+ if err == nil && int64(len(data)) <= setting.Avatar.MaxFileSize {
+ _ = user_service.UploadAvatar(ctx, u, data)
+ }
+ }
+ }
+}
+
+func getSSHKeys(source *oauth2.Source, gothUser *goth.User) ([]string, error) {
+ key := source.AttributeSSHPublicKey
+ value, exists := gothUser.RawData[key]
+ if !exists {
+ return []string{}, nil
+ }
+
+ rawSlice, ok := value.([]any)
+ if !ok {
+ return nil, fmt.Errorf("unexpected type for SSH public key, expected []interface{} but got %T", value)
+ }
+
+ sshKeys := make([]string, 0, len(rawSlice))
+ for i, v := range rawSlice {
+ str, ok := v.(string)
+ if !ok {
+ return nil, fmt.Errorf("unexpected element type at index %d in SSH public key array, expected string but got %T", i, v)
+ }
+ sshKeys = append(sshKeys, str)
+ }
+
+ return sshKeys, nil
+}
+
+func updateSSHPubIfNeed(
+ ctx *context.Context,
+ authSource *auth.Source,
+ fetchedUser *goth.User,
+ user *user_model.User,
+) error {
+ oauth2Source := authSource.Cfg.(*oauth2.Source)
+
+ if oauth2Source.ProvidesSSHKeys() {
+ sshKeys, err := getSSHKeys(oauth2Source, fetchedUser)
+ if err != nil {
+ return err
+ }
+
+ if asymkey_model.SynchronizePublicKeys(ctx, user, authSource, sshKeys) {
+ err = asymkey_model.RewriteAllPublicKeys(ctx)
+ if err != nil {
+ return err
+ }
+ }
+ }
+
+ return nil
+}
+
+func handleOAuth2SignIn(ctx *context.Context, source *auth.Source, u *user_model.User, gothUser goth.User) {
+ updateAvatarIfNeed(ctx, gothUser.AvatarURL, u)
+ err := updateSSHPubIfNeed(ctx, source, &gothUser, u)
+ if err != nil {
+ ctx.ServerError("updateSSHPubIfNeed", err)
+ return
+ }
+
+ needs2FA := false
+ if !source.Cfg.(*oauth2.Source).SkipLocalTwoFA {
+ needs2FA, err = auth.HasTwoFactorByUID(ctx, u.ID)
+ if err != nil {
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+ }
+
+ oauth2Source := source.Cfg.(*oauth2.Source)
+ groupTeamMapping, err := auth_module.UnmarshalGroupTeamMapping(oauth2Source.GroupTeamMap)
+ if err != nil {
+ ctx.ServerError("UnmarshalGroupTeamMapping", err)
+ return
+ }
+
+ groups := getClaimedGroups(oauth2Source, &gothUser)
+
+ // If this user is enrolled in 2FA and this source doesn't override it,
+ // we can't sign the user in just yet. Instead, redirect them to the 2FA authentication page.
+ if !needs2FA {
+ if err := updateSession(ctx, nil, map[string]any{
+ "uid": u.ID,
+ }); err != nil {
+ ctx.ServerError("updateSession", err)
+ return
+ }
+
+ // Clear whatever CSRF cookie has right now, force to generate a new one
+ ctx.Csrf.DeleteCookie(ctx)
+
+ opts := &user_service.UpdateOptions{
+ SetLastLogin: true,
+ }
+ opts.IsAdmin, opts.IsRestricted = getUserAdminAndRestrictedFromGroupClaims(oauth2Source, &gothUser)
+ if err := user_service.UpdateUser(ctx, u, opts); err != nil {
+ ctx.ServerError("UpdateUser", err)
+ return
+ }
+
+ if oauth2Source.GroupTeamMap != "" || oauth2Source.GroupTeamMapRemoval {
+ if err := source_service.SyncGroupsToTeams(ctx, u, groups, groupTeamMapping, oauth2Source.GroupTeamMapRemoval); err != nil {
+ ctx.ServerError("SyncGroupsToTeams", err)
+ return
+ }
+ }
+
+ // update external user information
+ if err := externalaccount.UpdateExternalUser(ctx, u, gothUser); err != nil {
+ if !errors.Is(err, util.ErrNotExist) {
+ log.Error("UpdateExternalUser failed: %v", err)
+ }
+ }
+
+ if err := resetLocale(ctx, u); err != nil {
+ ctx.ServerError("resetLocale", err)
+ return
+ }
+
+ if redirectTo := ctx.GetSiteCookie("redirect_to"); len(redirectTo) > 0 {
+ middleware.DeleteRedirectToCookie(ctx.Resp)
+ ctx.RedirectToFirst(redirectTo)
+ return
+ }
+
+ ctx.Redirect(setting.AppSubURL + "/")
+ return
+ }
+
+ opts := &user_service.UpdateOptions{}
+ opts.IsAdmin, opts.IsRestricted = getUserAdminAndRestrictedFromGroupClaims(oauth2Source, &gothUser)
+ if opts.IsAdmin.Has() || opts.IsRestricted.Has() {
+ if err := user_service.UpdateUser(ctx, u, opts); err != nil {
+ ctx.ServerError("UpdateUser", err)
+ return
+ }
+ }
+
+ if oauth2Source.GroupTeamMap != "" || oauth2Source.GroupTeamMapRemoval {
+ if err := source_service.SyncGroupsToTeams(ctx, u, groups, groupTeamMapping, oauth2Source.GroupTeamMapRemoval); err != nil {
+ ctx.ServerError("SyncGroupsToTeams", err)
+ return
+ }
+ }
+
+ if err := updateSession(ctx, nil, map[string]any{
+ // User needs to use 2FA, save data and redirect to 2FA page.
+ "twofaUid": u.ID,
+ "twofaRemember": false,
+ }); err != nil {
+ ctx.ServerError("updateSession", err)
+ return
+ }
+
+ // If WebAuthn is enrolled -> Redirect to WebAuthn instead
+ regs, err := auth.GetWebAuthnCredentialsByUID(ctx, u.ID)
+ if err == nil && len(regs) > 0 {
+ ctx.Redirect(setting.AppSubURL + "/user/webauthn")
+ return
+ }
+
+ ctx.Redirect(setting.AppSubURL + "/user/two_factor")
+}
+
+// generateCodeChallenge stores a code verifier in the session and returns a S256 code challenge for PKCE
+func generateCodeChallenge(ctx *context.Context, provider string) (codeChallenge string, err error) {
+ // the `code_verifier` is only forwarded by specific providers
+ // https://codeberg.org/forgejo/forgejo/issues/4033
+ p, ok := goth.GetProviders()[provider]
+ if !ok {
+ return "", nil
+ }
+ switch p.(type) {
+ default:
+ return "", nil
+ case *openidConnect.Provider, *fitbit.Provider, *zoom.Provider:
+ // those providers forward the `code_verifier`
+ // a code_challenge can be generated
+ }
+
+ codeVerifier, err := util.CryptoRandomString(43) // 256/log2(62) = 256 bits of entropy (each char having log2(62) of randomness)
+ if err != nil {
+ return "", err
+ }
+ if err = ctx.Session.Set("CodeVerifier", codeVerifier); err != nil {
+ return "", err
+ }
+ return encodeCodeChallenge(codeVerifier)
+}
+
+func encodeCodeChallenge(codeVerifier string) (string, error) {
+ hasher := sha256.New()
+ _, err := io.WriteString(hasher, codeVerifier)
+ codeChallenge := base64.RawURLEncoding.EncodeToString(hasher.Sum(nil))
+ return codeChallenge, err
+}
+
+// OAuth2UserLoginCallback attempts to handle the callback from the OAuth2 provider and if successful
+// login the user
+func oAuth2UserLoginCallback(ctx *context.Context, authSource *auth.Source, request *http.Request, response http.ResponseWriter) (*user_model.User, goth.User, error) {
+ gothUser, err := oAuth2FetchUser(ctx, authSource, request, response)
+ if err != nil {
+ return nil, goth.User{}, err
+ }
+
+ if _, _, err := remote_service.MaybePromoteRemoteUser(ctx, authSource, gothUser.UserID, gothUser.Email); err != nil {
+ return nil, goth.User{}, err
+ }
+
+ u, err := oAuth2GothUserToUser(request.Context(), authSource, gothUser)
+ return u, gothUser, err
+}
+
+func oAuth2FetchUser(ctx *context.Context, authSource *auth.Source, request *http.Request, response http.ResponseWriter) (goth.User, error) {
+ oauth2Source := authSource.Cfg.(*oauth2.Source)
+
+ // Make sure that the response is not an error response.
+ errorName := request.FormValue("error")
+
+ if len(errorName) > 0 {
+ errorDescription := request.FormValue("error_description")
+
+ // Delete the goth session
+ err := gothic.Logout(response, request)
+ if err != nil {
+ return goth.User{}, err
+ }
+
+ return goth.User{}, errCallback{
+ Code: errorName,
+ Description: errorDescription,
+ }
+ }
+
+ // Proceed to authenticate through goth.
+ codeVerifier, _ := ctx.Session.Get("CodeVerifier").(string)
+ _ = ctx.Session.Delete("CodeVerifier")
+ gothUser, err := oauth2Source.Callback(request, response, codeVerifier)
+ if err != nil {
+ if err.Error() == "securecookie: the value is too long" || strings.Contains(err.Error(), "Data too long") {
+ log.Error("OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider", authSource.Name, setting.OAuth2.MaxTokenLength)
+ err = fmt.Errorf("OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider", authSource.Name, setting.OAuth2.MaxTokenLength)
+ }
+ return goth.User{}, err
+ }
+
+ if oauth2Source.RequiredClaimValues != nil {
+ // The exact callback has already authenticated and enforced the current
+ // Access Engine application.access decision. Group policy lives there.
+ if oauth2Source.Provider != "openidConnect" {
+ return goth.User{}, user_model.ErrUserProhibitLogin{Name: gothUser.UserID}
+ }
+ } else if oauth2Source.RequiredClaimName != "" {
+ claimInterface, has := gothUser.RawData[oauth2Source.RequiredClaimName]
+ if !has {
+ return goth.User{}, user_model.ErrUserProhibitLogin{Name: gothUser.UserID}
+ }
+
+ if oauth2Source.RequiredClaimValue != "" {
+ groups := claimValueToStringSet(claimInterface)
+
+ if !groups.Contains(oauth2Source.RequiredClaimValue) {
+ return goth.User{}, user_model.ErrUserProhibitLogin{Name: gothUser.UserID}
+ }
+ }
+ }
+
+ return gothUser, nil
+}
+
+func oAuth2GothUserToUser(ctx go_context.Context, authSource *auth.Source, gothUser goth.User) (*user_model.User, error) {
+ user := &user_model.User{
+ LoginName: gothUser.UserID,
+ LoginType: auth.OAuth2,
+ LoginSource: authSource.ID,
+ }
+
+ hasUser, err := user_model.GetUser(ctx, user)
+ if err != nil {
+ return nil, err
+ }
+
+ if hasUser {
+ return user, nil
+ }
+ log.Debug("no user found for LoginName %v, LoginSource %v, LoginType %v", user.LoginName, user.LoginSource, user.LoginType)
+
+ // search in external linked users
+ externalLoginUser := &user_model.ExternalLoginUser{
+ ExternalID: gothUser.UserID,
+ LoginSourceID: authSource.ID,
+ }
+ hasUser, err = user_model.GetExternalLogin(ctx, externalLoginUser)
+ if err != nil {
+ return nil, err
+ }
+ if hasUser {
+ user, err = user_model.GetUserByID(ctx, externalLoginUser.UserID)
+ return user, err
+ }
+
+ // no user found to login
+ return nil, nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine.go
new file mode 100644
index 00000000..9a776e97
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine.go
@@ -0,0 +1,205 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package oauth2
+
+import (
+ "context"
+ "crypto"
+ "crypto/x509"
+ "encoding/json"
+ "encoding/pem"
+ "errors"
+ "io"
+ "os"
+ "path/filepath"
+ "strings"
+ "time"
+
+ "github.com/golang-jwt/jwt/v5"
+ "github.com/markbates/goth"
+ "github.com/netkingdom/access-engine/pkg/api"
+ "github.com/netkingdom/access-engine/pkg/decisionpep"
+)
+
+var errApplicationDecision = errors.New("current authenticated application access refused")
+
+// AccessEngineAdmission contains owner-admitted public trust, with only a file
+// reference to the private PDP caller token. It is not persisted OAuth source
+// configuration and cannot be replaced by token claims or provider discovery.
+type AccessEngineAdmission struct {
+ SourceName string `json:"source_name"`
+ Issuer string `json:"issuer"`
+ Audience string `json:"audience"`
+ TokenType string `json:"token_type"`
+ Algorithms []string `json:"algorithms"`
+ IdentityKeys map[string]string `json:"identity_keys"`
+ TenantClaim string `json:"tenant_claim"`
+ PrincipalTypeClaim string `json:"principal_type_claim"`
+ AssuranceClaim string `json:"assurance_claim"`
+ MaxIdentityAge string `json:"max_identity_age"`
+ Decision decisionpep.Admission `json:"decision"`
+}
+
+// VerifiedApplicationIdentity is derived only by VerifyApplicationIdentity from
+// independently admitted JOSE keys. RawData and UserInfo never supply these
+// fields. This snapshot is an identity fact, never an authorization verdict.
+type VerifiedApplicationIdentity struct {
+ Issuer string
+ Subject string
+ Tenant string
+ PrincipalType api.SubjectType
+ Assurance string
+ NotAfter time.Time
+}
+
+func loadAccessEngineAdmission(path string) (AccessEngineAdmission, error) {
+ var a AccessEngineAdmission
+ if !filepath.IsAbs(path) {
+ return a, errApplicationDecision
+ }
+ f, e := os.Open(path)
+ if e != nil {
+ return a, errApplicationDecision
+ }
+ defer f.Close()
+ stat, e := f.Stat()
+ if e != nil || !stat.Mode().IsRegular() || stat.Mode().Perm()&0022 != 0 {
+ return a, errApplicationDecision
+ }
+ raw, e := io.ReadAll(io.LimitReader(f, 1<<20+1))
+ if e != nil || len(raw) > 1<<20 {
+ return a, errApplicationDecision
+ }
+ d := json.NewDecoder(strings.NewReader(string(raw)))
+ d.DisallowUnknownFields()
+ if d.Decode(&a) != nil {
+ return a, errApplicationDecision
+ }
+ if _, e = d.Token(); e != io.EOF {
+ return a, errApplicationDecision
+ }
+ return a, nil
+}
+
+// VerifyApplicationIdentity validates the ID token independently of Goth's
+// decode/claim checks and of the UserInfo merge. Keys and accepted algorithm,
+// issuer, audience and type are admitted separately; none come from the JWT URL.
+func VerifyApplicationIdentity(raw string, a AccessEngineAdmission, now time.Time) (VerifiedApplicationIdentity, error) {
+ var out VerifiedApplicationIdentity
+ age, e := time.ParseDuration(a.MaxIdentityAge)
+ if e != nil || age <= 0 || a.Issuer == "" || a.Audience == "" || a.TokenType == "" || len(a.Algorithms) == 0 || len(a.IdentityKeys) == 0 || a.TenantClaim == "" || a.PrincipalTypeClaim == "" || a.AssuranceClaim == "" {
+ return out, errApplicationDecision
+ }
+ for _, alg := range a.Algorithms {
+ if alg != "RS256" && alg != "RS384" && alg != "RS512" && alg != "ES256" && alg != "ES384" && alg != "ES512" && alg != "EdDSA" {
+ return out, errApplicationDecision
+ }
+ }
+ claims := jwt.MapClaims{}
+ token, e := jwt.ParseWithClaims(raw, claims, func(t *jwt.Token) (any, error) {
+ if typ, ok := t.Header["typ"].(string); !ok || typ != a.TokenType {
+ return nil, errApplicationDecision
+ }
+ kid, ok := t.Header["kid"].(string)
+ if !ok || kid == "" {
+ return nil, errApplicationDecision
+ }
+ text, ok := a.IdentityKeys[kid]
+ if !ok {
+ return nil, errApplicationDecision
+ }
+ block, rest := pem.Decode([]byte(text))
+ if block == nil || block.Type != "PUBLIC KEY" || len(strings.TrimSpace(string(rest))) != 0 {
+ return nil, errApplicationDecision
+ }
+ key, e := x509.ParsePKIXPublicKey(block.Bytes)
+ if e != nil {
+ return nil, errApplicationDecision
+ }
+ var pub crypto.PublicKey = key
+ return pub, nil
+ }, jwt.WithValidMethods(a.Algorithms), jwt.WithIssuer(a.Issuer), jwt.WithAudience(a.Audience), jwt.WithExpirationRequired(), jwt.WithIssuedAt(), jwt.WithJSONNumber(), jwt.WithTimeFunc(func() time.Time { return now }))
+ if e != nil || token == nil || !token.Valid {
+ return out, errApplicationDecision
+ }
+ subject, e := claims.GetSubject()
+ if e != nil || subject == "" {
+ return out, errApplicationDecision
+ }
+ issued, e := claims.GetIssuedAt()
+ if e != nil || issued == nil || issued.Time.After(now) || now.Sub(issued.Time) > age {
+ return out, errApplicationDecision
+ }
+ end, e := claims.GetExpirationTime()
+ if e != nil || end == nil || !now.Before(end.Time) {
+ return out, errApplicationDecision
+ }
+ aud, e := claims.GetAudience()
+ if e != nil {
+ return out, errApplicationDecision
+ }
+ if authorizedParty, present := claims["azp"]; present {
+ if azp, ok := authorizedParty.(string); !ok || azp != a.Audience {
+ return out, errApplicationDecision
+ }
+ } else if len(aud) > 1 {
+ return out, errApplicationDecision
+ }
+ value := func(name string) (string, bool) { v, ok := claims[name].(string); return v, ok && validClaimLiteral(v) }
+ tenant, ok := value(a.TenantClaim)
+ if !ok {
+ return out, errApplicationDecision
+ }
+ principal, ok := value(a.PrincipalTypeClaim)
+ if !ok {
+ return out, errApplicationDecision
+ }
+ assurance, ok := value(a.AssuranceClaim)
+ if !ok {
+ return out, errApplicationDecision
+ }
+ return VerifiedApplicationIdentity{Issuer: a.Issuer, Subject: subject, Tenant: tenant, PrincipalType: api.SubjectType(principal), Assurance: assurance, NotAfter: end.Time}, nil
+}
+
+func (source *Source) authorizeAccessEngine(ctx context.Context, user goth.User) error {
+ // The guarded target extension cannot silently fall back to a local group
+ // decision when admission, keys, facts, PDP or caller authentication is absent.
+ if source.Provider != "openidConnect" || ValidateRequiredClaimValues(source.RequiredClaimName, source.RequiredClaimValue, source.RequiredClaimValues) != nil {
+ return errApplicationDecision
+ }
+ a, e := loadAccessEngineAdmission(os.Getenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE"))
+ if e != nil || source.authSource == nil || a.SourceName != source.authSource.Name || a.Audience != source.ClientID {
+ return errApplicationDecision
+ }
+ identity, e := VerifyApplicationIdentity(user.IDToken, a, time.Now().UTC())
+ if e != nil {
+ return errApplicationDecision
+ }
+ // RequireCurrentUserInfoClaim has refused missing/malformed current groups
+ // before Goth can merge. The validated ID subject must still match that join.
+ sub, ok := user.RawData["sub"].(string)
+ if !ok || sub != identity.Subject || user.UserID != identity.Subject {
+ return errApplicationDecision
+ }
+ groups, ok := strictClaimValues(user.RawData[source.RequiredClaimName])
+ if !ok {
+ return errApplicationDecision
+ }
+ client, e := decisionpep.New(a.Decision)
+ if e != nil {
+ return errApplicationDecision
+ }
+ request := api.CheckRequest{Tenant: identity.Tenant,
+ Subject: api.SubjectRef{ID: identity.Subject, Type: identity.PrincipalType, Tenant: identity.Tenant,
+ Attributes: map[string]any{"issuer": identity.Issuer, "assurance": identity.Assurance, "current_userinfo_groups": groups}},
+ Action: "application.access", Resource: api.ResourceRef{ID: "application:forgejo", Type: "application", System: "forgejo", Tenant: identity.Tenant},
+ Context: map[string]any{"identity_issuer": identity.Issuer, "identity_subject": identity.Subject, "identity_tenant": identity.Tenant, "identity_principal_type": string(identity.PrincipalType), "identity_assurance": identity.Assurance, "identity_not_after": identity.NotAfter.UTC().Format(time.RFC3339Nano), "current_userinfo_groups": groups, "required_groups_any_of": source.RequiredClaimValues, "source_name": a.SourceName, "source_id": source.authSource.ID}}
+ if _, e = client.Check(ctx, request); e != nil {
+ return errApplicationDecision
+ }
+ if !time.Now().UTC().Before(identity.NotAfter) {
+ return errApplicationDecision
+ }
+ return nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_azp_test.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_azp_test.go
new file mode 100644
index 00000000..3d9e1ab9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_azp_test.go
@@ -0,0 +1,34 @@
+package oauth2
+
+import "testing"
+
+func TestAccessEngineAuthorizedPartyRefusesAnotherClient(t *testing.T) {
+ for name, value := range map[string]any{
+ "other-client": "other-client",
+ "number": 17,
+ "array": []string{"forgejo"},
+ "empty": "",
+ } {
+ t.Run(name, func(t *testing.T) {
+ admission, key, claims, now := identityFixture(t)
+ claims["azp"] = value
+ token := signedIdentity(t, key, claims, nil)
+ if _, err := VerifyApplicationIdentity(token, admission, now); err == nil {
+ t.Fatal("a valid signature and audience concealed an invalid authorized party")
+ }
+ })
+ }
+}
+
+func TestAccessEngineAuthorizedPartyAcceptsAdmittedClient(t *testing.T) {
+ for _, multiple := range []bool{false, true} {
+ admission, key, claims, now := identityFixture(t)
+ claims["azp"] = admission.Audience
+ if multiple {
+ claims["aud"] = []string{admission.Audience, "another-resource"}
+ }
+ if _, err := VerifyApplicationIdentity(signedIdentity(t, key, claims, nil), admission, now); err != nil {
+ t.Fatal("admitted authorized party refused", err)
+ }
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_callback_test.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_callback_test.go
new file mode 100644
index 00000000..bf49e5dd
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_callback_test.go
@@ -0,0 +1,180 @@
+package oauth2
+
+import (
+ "crypto/ed25519"
+ "crypto/rand"
+ "encoding/base64"
+ "encoding/json"
+ "encoding/pem"
+ "net/http"
+ "net/http/httptest"
+ "os"
+ "path/filepath"
+ "strings"
+ "sync/atomic"
+ "testing"
+ "time"
+
+ authmodel "forgejo.org/models/auth"
+ "github.com/golang-jwt/jwt/v5"
+ "github.com/markbates/goth"
+ "github.com/markbates/goth/gothic"
+ "github.com/netkingdom/access-engine/pkg/api"
+ "github.com/netkingdom/access-engine/pkg/decisionpep"
+ "github.com/netkingdom/access-engine/testsupport/signfixture"
+)
+
+// This fixture substitutes only Goth's completed authentication result. The
+// actual Source.Callback, JOSE verifier, HTTPS PEP client and producer signature
+// implementation execute. Actual issuer login and native admission are separate.
+func callbackFixture(t *testing.T, group, mode string) (*Source, *goth.User, *atomic.Int64) {
+ t.Helper()
+ admission, identityKey, claims, _ := identityFixture(t)
+ identityToken := signedIdentity(t, identityKey, claims, nil)
+ pub, key, err := ed25519.GenerateKey(rand.Reader)
+ if err != nil {
+ t.Fatal(err)
+ }
+ calls := new(atomic.Int64)
+ server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ calls.Add(1)
+ if r.URL.Path != "/v1/check" || r.Method != http.MethodPost || r.Header.Get("Authorization") != "Bearer synthetic-caller" || r.Header.Get("Access-Engine-JSON-Profile") != decisionpep.JSONProfile {
+ t.Error("incorrect authenticated PDP request")
+ w.WriteHeader(403)
+ return
+ }
+ var request api.CheckRequest
+ decoder := json.NewDecoder(r.Body)
+ decoder.UseNumber()
+ if err := decoder.Decode(&request); err != nil {
+ t.Error(err)
+ w.WriteHeader(400)
+ return
+ }
+ c := request.Context
+ if request.Subject.ID != "user:synthetic" || request.Subject.Tenant != "tenant:synthetic" || request.Subject.Type != "human" || request.Action != "application.access" || request.Resource.ID != "application:forgejo" || c["identity_issuer"] != "https://issuer.invalid" || c["identity_assurance"] != "aal2" || c["identity_tenant"] != "tenant:synthetic" || c["source_id"] != json.Number("17") {
+ t.Error("PDP request did not use authenticated identity and source")
+ w.WriteHeader(400)
+ return
+ }
+ now := time.Now().UTC()
+ envelope := api.DecisionEnvelope{ID: "synthetic-decision", RequestID: request.ID, Effect: api.DecisionEffectAllow, MatchedPolicyVersion: "v1", Subject: request.Subject, Resource: request.Resource, Binding: api.NewDecisionBindingFor(request, request), Provenance: api.DecisionProvenance{Evaluator: "flex-auth/local", Mode: "standalone/" + decisionpep.JSONProfile, PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyPackageDigest: "sha256:" + strings.Repeat("1", 64), RegistrySnapshotDigest: "sha256:" + strings.Repeat("2", 64), Caller: &api.CallerProvenance{Mode: "enforce", Principal: "system:serviceaccount:synthetic:forgejo", Audience: "access-engine", NotAfter: now.Add(time.Minute).Format(time.RFC3339Nano)}}}
+ api.CompleteDecision(&envelope, request, api.DecisionCompletion{AllowTTL: "10s", Now: now})
+ switch mode {
+ case "deny":
+ envelope.Effect = api.DecisionEffectDeny
+ case "wrong-binding":
+ envelope.Binding.Subject.ID = "other"
+ case "wrong-pin":
+ envelope.Provenance.PolicyPackageDigest = "sha256:" + strings.Repeat("3", 64)
+ case "expired":
+ envelope.Lifetime.ExpiresAt = now.Add(-time.Hour).Format(time.RFC3339Nano)
+ }
+ if mode != "unsigned" {
+ signingKey := key
+ if mode == "wrong-key" {
+ _, signingKey, err = ed25519.GenerateKey(rand.Reader)
+ if err != nil {
+ t.Error(err)
+ return
+ }
+ }
+ if err := signfixture.Sign(&envelope, signingKey, "synthetic-pdp"); err != nil {
+ t.Error(err)
+ return
+ }
+ }
+ w.Header().Set("Content-Type", "application/json")
+ if err := json.NewEncoder(w).Encode(envelope); err != nil {
+ t.Error(err)
+ }
+ }))
+ t.Cleanup(server.Close)
+ dir := t.TempDir()
+ ca := filepath.Join(dir, "ca.pem")
+ token := filepath.Join(dir, "caller")
+ config := filepath.Join(dir, "admission.json")
+ if err := os.WriteFile(ca, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw}), 0600); err != nil {
+ t.Fatal(err)
+ }
+ if err := os.WriteFile(token, []byte("synthetic-caller"), 0600); err != nil {
+ t.Fatal(err)
+ }
+ admission.SourceName = "synthetic-source"
+ admission.Decision = decisionpep.Admission{Endpoint: server.URL + "/v1/check", CAFile: ca, TokenFile: token, Keys: map[string]string{"synthetic-pdp": base64.RawURLEncoding.EncodeToString(pub)}, Evaluator: "flex-auth/local", PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyDigest: "sha256:" + strings.Repeat("1", 64), RegistryDigest: "sha256:" + strings.Repeat("2", 64), CallerPrincipal: "system:serviceaccount:synthetic:forgejo", CallerAudience: "access-engine", MaxTTL: "30s", MaxClockSkew: "2s"}
+ raw, err := json.Marshal(admission)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if err = os.WriteFile(config, raw, 0600); err != nil {
+ t.Fatal(err)
+ }
+ t.Setenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE", config)
+ source := &Source{Provider: "openidConnect", ClientID: admission.Audience, RequiredClaimName: "groups", RequiredClaimValues: []string{"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}}
+ source.authSource = &authmodel.Source{ID: 17, Name: admission.SourceName}
+ user := &goth.User{UserID: "user:synthetic", IDToken: identityToken, RawData: map[string]any{"sub": "user:synthetic", "groups": []string{group}}}
+ previous := gothic.CompleteUserAuth
+ gothic.CompleteUserAuth = func(http.ResponseWriter, *http.Request) (goth.User, error) { return *user, nil }
+ t.Cleanup(func() { gothic.CompleteUserAuth = previous })
+ return source, user, calls
+}
+
+func TestAccessEngineActualCallbackAllowsAuthenticatedDecision(t *testing.T) {
+ for _, group := range []string{"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"} {
+ t.Run(group, func(t *testing.T) {
+ source, user, calls := callbackFixture(t, group, "allow")
+ // Mutable UserInfo cannot supply identity assurance, issuer or tenant.
+ user.RawData["acr"] = "aal1"
+ user.RawData["tenant"] = "tenant:attacker"
+ user.RawData["iss"] = "https://attacker.invalid"
+ got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
+ if err != nil || got.UserID != user.UserID || calls.Load() != 1 {
+ t.Fatalf("callback result: err=%v requests=%d", err, calls.Load())
+ }
+ })
+ }
+}
+
+func TestAccessEngineActualCallbackRefusesUnverifiedPDP(t *testing.T) {
+ for _, mode := range []string{"deny", "unsigned", "wrong-key", "wrong-pin", "wrong-binding", "expired"} {
+ t.Run(mode, func(t *testing.T) {
+ source, _, calls := callbackFixture(t, "forge-admins", mode)
+ got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
+ if err == nil || got.UserID != "" || got.IDToken != "" || calls.Load() != 1 {
+ t.Fatalf("unverified decision escaped callback: requests=%d err=%v", calls.Load(), err)
+ }
+ })
+ }
+}
+
+func TestAccessEngineActualCallbackChecksIdentityBeforePDP(t *testing.T) {
+ cases := map[string]func(*Source, *goth.User){
+ "missing-token": func(_ *Source, u *goth.User) { u.IDToken = "" },
+ "mismatched-user": func(_ *Source, u *goth.User) { u.UserID = "other" },
+ "mismatched-subject": func(_ *Source, u *goth.User) { u.RawData["sub"] = "other" },
+ "missing-groups": func(_ *Source, u *goth.User) { delete(u.RawData, "groups") },
+ "wrong-source": func(s *Source, _ *goth.User) { s.authSource.Name = "other" },
+ "wrong-provider": func(s *Source, _ *goth.User) { s.Provider = "other" },
+ "wrong-audience": func(s *Source, _ *goth.User) { s.ClientID = "other" },
+ "missing-admission": func(_ *Source, _ *goth.User) { t.Setenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE", "") },
+ "expired-token": func(_ *Source, u *goth.User) {
+ _, key, claims, now := identityFixture(t)
+ claims["exp"] = now.Add(-time.Hour).Unix()
+ u.IDToken = signedIdentity(t, key, claims, nil)
+ },
+ "untrusted-identity": func(_ *Source, u *goth.User) {
+ token := jwt.NewWithClaims(jwt.SigningMethodNone, jwt.MapClaims{"sub": "user:synthetic"})
+ u.IDToken, _ = token.SignedString(jwt.UnsafeAllowNoneSignatureType)
+ },
+ }
+ for name, mutate := range cases {
+ t.Run(name, func(t *testing.T) {
+ source, user, calls := callbackFixture(t, "forge-admins", "allow")
+ mutate(source, user)
+ got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
+ if err == nil || got.UserID != "" || calls.Load() != 0 {
+ t.Fatalf("unverified identity reached PDP: requests=%d err=%v", calls.Load(), err)
+ }
+ })
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_test.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_test.go
new file mode 100644
index 00000000..cdcfb1ac
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/access_engine_test.go
@@ -0,0 +1,100 @@
+package oauth2
+
+import (
+ "crypto/ed25519"
+ "crypto/rand"
+ "crypto/x509"
+ "encoding/pem"
+ "testing"
+ "time"
+
+ "github.com/golang-jwt/jwt/v5"
+)
+
+func identityFixture(t *testing.T) (AccessEngineAdmission, ed25519.PrivateKey, jwt.MapClaims, time.Time) {
+ t.Helper()
+ pub, key, e := ed25519.GenerateKey(rand.Reader)
+ if e != nil {
+ t.Fatal(e)
+ }
+ der, e := x509.MarshalPKIXPublicKey(pub)
+ if e != nil {
+ t.Fatal(e)
+ }
+ now := time.Now().UTC().Truncate(time.Second)
+ a := AccessEngineAdmission{Issuer: "https://issuer.invalid", Audience: "forgejo", TokenType: "JWT", Algorithms: []string{"EdDSA"}, IdentityKeys: map[string]string{"synthetic": string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: der}))}, TenantClaim: "tenant", PrincipalTypeClaim: "principal_type", AssuranceClaim: "acr", MaxIdentityAge: "5m"}
+ c := jwt.MapClaims{"iss": a.Issuer, "aud": a.Audience, "sub": "user:synthetic", "iat": now.Add(-time.Second).Unix(), "exp": now.Add(time.Minute).Unix(), "tenant": "tenant:synthetic", "principal_type": "human", "acr": "aal2"}
+ return a, key, c, now
+}
+func signedIdentity(t *testing.T, key ed25519.PrivateKey, c jwt.MapClaims, mutate func(*jwt.Token)) string {
+ t.Helper()
+ token := jwt.NewWithClaims(jwt.SigningMethodEdDSA, c)
+ token.Header["kid"] = "synthetic"
+ token.Header["typ"] = "JWT"
+ if mutate != nil {
+ mutate(token)
+ }
+ raw, e := token.SignedString(key)
+ if e != nil {
+ t.Fatal(e)
+ }
+ return raw
+}
+func TestVerifiedApplicationIdentityActualJOSE(t *testing.T) {
+ a, key, c, now := identityFixture(t)
+ raw := signedIdentity(t, key, c, nil)
+ got, e := VerifyApplicationIdentity(raw, a, now)
+ if e != nil {
+ t.Fatal(e)
+ }
+ if got.Subject != "user:synthetic" || got.Tenant != "tenant:synthetic" || got.Assurance != "aal2" || got.Issuer != a.Issuer || string(got.PrincipalType) != "human" {
+ t.Fatal("identity did not come from verified token")
+ }
+ cases := map[string]func(jwt.MapClaims){"issuer": func(c jwt.MapClaims) { c["iss"] = "https://other.invalid" }, "audience": func(c jwt.MapClaims) { c["aud"] = "other" }, "expired": func(c jwt.MapClaims) { c["exp"] = now.Add(-time.Nanosecond).Unix() }, "future-issued": func(c jwt.MapClaims) { c["iat"] = now.Add(time.Minute).Unix() }, "old-issued": func(c jwt.MapClaims) { c["iat"] = now.Add(-10 * time.Minute).Unix() }, "no-exp": func(c jwt.MapClaims) { delete(c, "exp") }, "no-iat": func(c jwt.MapClaims) { delete(c, "iat") }, "no-tenant": func(c jwt.MapClaims) { delete(c, "tenant") }, "no-principal": func(c jwt.MapClaims) { delete(c, "principal_type") }, "no-assurance": func(c jwt.MapClaims) { delete(c, "acr") }, "multi-audience-no-azp": func(c jwt.MapClaims) { c["aud"] = []string{"forgejo", "other"} }, "empty-subject": func(c jwt.MapClaims) { c["sub"] = "" }}
+ for name, change := range cases {
+ t.Run(name, func(t *testing.T) {
+ copy := jwt.MapClaims{}
+ for k, v := range c {
+ copy[k] = v
+ }
+ change(copy)
+ if _, e := VerifyApplicationIdentity(signedIdentity(t, key, copy, nil), a, now); e == nil {
+ t.Fatal("unverified identity accepted")
+ }
+ })
+ }
+ t.Run("wrong-key", func(t *testing.T) {
+ _, other, _ := ed25519.GenerateKey(rand.Reader)
+ if _, e := VerifyApplicationIdentity(signedIdentity(t, other, c, nil), a, now); e == nil {
+ t.Fatal("wrong key accepted")
+ }
+ })
+ t.Run("unknown-key", func(t *testing.T) {
+ if _, e := VerifyApplicationIdentity(signedIdentity(t, key, c, func(t *jwt.Token) { t.Header["kid"] = "other" }), a, now); e == nil {
+ t.Fatal("unknown key accepted")
+ }
+ })
+ t.Run("wrong-type", func(t *testing.T) {
+ if _, e := VerifyApplicationIdentity(signedIdentity(t, key, c, func(t *jwt.Token) { t.Header["typ"] = "at+jwt" }), a, now); e == nil {
+ t.Fatal("access token accepted as ID token")
+ }
+ })
+ t.Run("algorithm-confusion", func(t *testing.T) {
+ token := jwt.NewWithClaims(jwt.SigningMethodHS256, c)
+ token.Header["kid"] = "synthetic"
+ token.Header["typ"] = "JWT"
+ raw, _ := token.SignedString([]byte(a.IdentityKeys["synthetic"]))
+ if _, e := VerifyApplicationIdentity(raw, a, now); e == nil {
+ t.Fatal("algorithm confusion accepted")
+ }
+ })
+ t.Run("none", func(t *testing.T) {
+ token := jwt.NewWithClaims(jwt.SigningMethodNone, c)
+ token.Header["kid"] = "synthetic"
+ token.Header["typ"] = "JWT"
+ raw, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)
+ if _, e := VerifyApplicationIdentity(raw, a, now); e == nil {
+ t.Fatal("unsigned identity accepted")
+ }
+ })
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/source_callout.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/source_callout.go
new file mode 100644
index 00000000..5ff9ace9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/forgejo-source/services/auth/source/oauth2/source_callout.go
@@ -0,0 +1,74 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package oauth2
+
+import (
+ "net/http"
+ "net/url"
+
+ "github.com/markbates/goth"
+ "github.com/markbates/goth/gothic"
+)
+
+// Callout redirects request/response pair to authenticate against the provider
+func (source *Source) Callout(request *http.Request, response http.ResponseWriter, codeChallengeS256 string) error {
+ // not sure if goth is thread safe (?) when using multiple providers
+ request.Header.Set(ProviderHeaderKey, source.authSource.Name)
+
+ var querySuffix string
+ if codeChallengeS256 != "" {
+ querySuffix = "&" + url.Values{
+ "code_challenge_method": []string{"S256"},
+ "code_challenge": []string{codeChallengeS256},
+ }.Encode()
+ }
+
+ // don't use the default gothic begin handler to prevent issues when some error occurs
+ // normally the gothic library will write some custom stuff to the response instead of our own nice error page
+ // gothic.BeginAuthHandler(response, request)
+
+ gothRWMutex.RLock()
+ defer gothRWMutex.RUnlock()
+
+ url, err := gothic.GetAuthURL(response, request)
+ if err == nil {
+ // hacky way to set the code_challenge, but no better way until
+ // https://github.com/markbates/goth/issues/516 is resolved
+ http.Redirect(response, request, url+querySuffix, http.StatusTemporaryRedirect)
+ }
+ return err
+}
+
+// Callback handles OAuth callback, resolve to a goth user and send back to original url
+// this will trigger a new authentication request, but because we save it in the session we can use that
+func (source *Source) Callback(request *http.Request, response http.ResponseWriter, codeVerifier string) (goth.User, error) {
+ // not sure if goth is thread safe (?) when using multiple providers
+ request.Header.Set(ProviderHeaderKey, source.authSource.Name)
+
+ if codeVerifier != "" {
+ // hacky way to set the code_verifier...
+ // Will be picked up inside CompleteUserAuth: params := req.URL.Query()
+ // https://github.com/markbates/goth/pull/474/files
+ request = request.Clone(request.Context())
+ q := request.URL.Query()
+ q.Add("code_verifier", codeVerifier)
+ request.URL.RawQuery = q.Encode()
+ }
+
+ gothRWMutex.RLock()
+ defer gothRWMutex.RUnlock()
+
+ user, err := gothic.CompleteUserAuth(response, request)
+ if err != nil {
+ return user, err
+ }
+
+ if source.RequiredClaimValues != nil {
+ if err := source.authorizeAccessEngine(request.Context(), user); err != nil {
+ return goth.User{}, err
+ }
+ }
+
+ return user, nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/Makefile b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/Makefile
new file mode 100644
index 00000000..76482667
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/Makefile
@@ -0,0 +1,80 @@
+BIN_DIR ?= bin
+BIN := $(BIN_DIR)/access-engine
+PKG := ./...
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo 0.0.0-dev)
+LDFLAGS := -X main.version=$(VERSION)
+
+.PHONY: all build test vet lint fmt tidy sbom clean ci overlay-render overlay-dry-run verify-posture check-layer
+
+all: vet lint test build
+
+build:
+ @mkdir -p $(BIN_DIR)
+ go build -ldflags "$(LDFLAGS)" -o $(BIN) ./cmd/access-engine
+
+test: check-layer
+ go test -race $(PKG)
+
+check-layer:
+ go run ./tools/check_layer_conformance.go
+
+vet:
+ go vet $(PKG)
+
+fmt:
+ gofmt -l -w .
+
+tidy:
+ go mod tidy
+
+lint:
+ @if command -v golangci-lint >/dev/null 2>&1; then \
+ golangci-lint run $(PKG); \
+ else \
+ echo "golangci-lint not installed; run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest"; \
+ echo "falling back to: go vet"; \
+ go vet $(PKG); \
+ fi
+
+GOBIN_PATH := $(shell go env GOPATH)/bin
+
+sbom:
+ @mkdir -p $(BIN_DIR)
+ @if command -v cyclonedx-gomod >/dev/null 2>&1; then \
+ cyclonedx-gomod mod -json -output $(BIN_DIR)/sbom.cdx.json .; \
+ echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (cyclonedx-gomod)"; \
+ elif [ -x "$(GOBIN_PATH)/cyclonedx-gomod" ]; then \
+ "$(GOBIN_PATH)/cyclonedx-gomod" mod -json -output $(BIN_DIR)/sbom.cdx.json .; \
+ echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (cyclonedx-gomod via GOPATH)"; \
+ elif command -v syft >/dev/null 2>&1; then \
+ syft . -o cyclonedx-json=$(BIN_DIR)/sbom.cdx.json; \
+ echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (syft)"; \
+ else \
+ echo "no SBOM tool found. install one:"; \
+ echo " go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest"; \
+ echo " or syft: https://github.com/anchore/syft"; \
+ exit 1; \
+ fi
+
+clean:
+ rm -rf $(BIN_DIR)
+
+ci: vet lint test build overlay-render
+
+verify-posture:
+ @bash tools/verify-posture.sh
+
+.PHONY: verify-emission-cadence
+verify-emission-cadence:
+ python3 tools/verify_emission_cadence.py
+
+overlay-render:
+ @tests/stage1.sh
+
+overlay-dry-run:
+ @test -n "$$KUBECONFIG" || { echo "set KUBECONFIG to the railiance01 kubeconfig"; exit 1; }
+ @for values in values/stage2-canary.yaml values/user-engine.yaml values/tenant-engine.yaml; do \
+ echo "server-dry-run $$values"; \
+ helm template flex-auth charts/flex-auth -f "$$values" --namespace flex-auth \
+ | kubectl apply --dry-run=server --server-side -f -; \
+ done
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/cmd/access-engine/main.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/cmd/access-engine/main.go
new file mode 100644
index 00000000..71dbd9d7
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/cmd/access-engine/main.go
@@ -0,0 +1,757 @@
+// Command flex-auth is the CLI entry point for the flex-auth authorization
+// registry and control plane.
+package main
+
+import (
+ "context"
+ "encoding/json"
+ "errors"
+ "flag"
+ "fmt"
+ "io"
+ "net/http"
+ "os"
+ "strings"
+ "time"
+
+ "gopkg.in/yaml.v3"
+
+ "github.com/netkingdom/access-engine/internal/audit"
+ "github.com/netkingdom/access-engine/internal/callerauth"
+ decisioncore "github.com/netkingdom/access-engine/internal/decision"
+ "github.com/netkingdom/access-engine/internal/emission"
+ "github.com/netkingdom/access-engine/internal/policy"
+ "github.com/netkingdom/access-engine/internal/registry"
+ "github.com/netkingdom/access-engine/internal/taskexecution"
+ "github.com/netkingdom/access-engine/pkg/api"
+)
+
+// version is set at build time via -ldflags "-X main.version=...".
+var version = "0.0.0-dev"
+
+func main() {
+ os.Exit(run(os.Args[1:], os.Stdout, os.Stderr))
+}
+
+func run(args []string, stdout, stderr io.Writer) int {
+ if len(args) == 0 {
+ printUsage(stderr)
+ return 64
+ }
+
+ switch args[0] {
+ case "version", "--version", "-version":
+ fmt.Fprintln(stdout, version)
+ return 0
+ case "validate":
+ return runValidate(args[1:], stdout, stderr)
+ case "load-registry":
+ return runLoadRegistry(args[1:], stdout, stderr)
+ case "test-policy":
+ return runTestPolicy(args[1:], stdout, stderr)
+ case "check":
+ return runCheck(args[1:], stdout, stderr)
+ case "batch-check":
+ return runBatchCheck(args[1:], stdout, stderr)
+ case "list-allowed":
+ return runListAllowed(args[1:], stdout, stderr)
+ case "explain":
+ return runExplain(args[1:], stdout, stderr)
+ case "serve":
+ return runServe(args[1:], stdout, stderr)
+ case "serve-readback":
+ return runServeReadback(args[1:], stdout, stderr)
+ case "help", "-h", "--help":
+ printUsage(stdout)
+ return 0
+ default:
+ fmt.Fprintf(stderr, "access-engine: unknown subcommand %q\n", args[0])
+ printUsage(stderr)
+ return 64
+ }
+}
+
+func runValidate(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("validate", stderr)
+ kind := fs.String("kind", "", "resource-manifest, subject-manifest, protected-system, relationship, access-descriptor, or policy")
+ file := fs.String("file", "", "YAML/JSON file to validate")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *kind == "" || *file == "" {
+ fmt.Fprintln(stderr, "validate requires --kind and --file")
+ return 64
+ }
+
+ switch *kind {
+ case "resource-manifest":
+ var manifest api.ResourceManifest
+ if err := readYAML(*file, &manifest); err != nil {
+ return fail(stderr, err)
+ }
+ if err := registry.NewStore().ImportResourceManifest(manifest); err != nil {
+ return fail(stderr, err)
+ }
+ case "subject-manifest":
+ var manifest api.SubjectManifest
+ if err := readYAML(*file, &manifest); err != nil {
+ return fail(stderr, err)
+ }
+ if err := registry.NewStore().ImportSubjectManifest(manifest); err != nil {
+ return fail(stderr, err)
+ }
+ case "protected-system":
+ var manifest api.ProtectedSystemManifest
+ if err := readYAML(*file, &manifest); err != nil {
+ return fail(stderr, err)
+ }
+ if err := registry.NewStore().PutProtectedSystem(manifest); err != nil {
+ return fail(stderr, err)
+ }
+ case "relationship":
+ var fact api.RelationshipFact
+ if err := readYAML(*file, &fact); err != nil {
+ return fail(stderr, err)
+ }
+ if err := registry.NewStore().PutRelationship(fact); err != nil {
+ return fail(stderr, err)
+ }
+ case "access-descriptor":
+ var descriptor api.CaringAccessDescriptor
+ if err := readYAML(*file, &descriptor); err != nil {
+ return fail(stderr, err)
+ }
+ if err := validateDescriptor(descriptor); err != nil {
+ return fail(stderr, err)
+ }
+ case "policy", "policy-package":
+ pkg, err := policy.LoadAndValidateFile(context.Background(), *file)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ if err := writeJSON(stdout, pkg.Validation); err != nil {
+ return fail(stderr, err)
+ }
+ if !pkg.Valid {
+ return 1
+ }
+ return 0
+ default:
+ fmt.Fprintf(stderr, "unsupported validate kind %q\n", *kind)
+ return 64
+ }
+
+ return writeStatus(stdout, "valid", map[string]any{"kind": *kind, "file": *file})
+}
+
+func runLoadRegistry(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("load-registry", stderr)
+ file := fs.String("file", "", "registry snapshot JSON file")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *file == "" {
+ fmt.Fprintln(stderr, "load-registry requires --file")
+ return 64
+ }
+
+ store, err := registry.LoadFile(*file)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ snapshot := store.Snapshot()
+ return writeStatus(stdout, "loaded", map[string]any{
+ "file": *file,
+ "systems": len(snapshot.Systems),
+ "resource_manifests": len(snapshot.ResourceManifests),
+ "subjects": len(snapshot.Subjects),
+ "groups": len(snapshot.Groups),
+ "teams": len(snapshot.Teams),
+ "tenants": len(snapshot.Tenants),
+ "relationships": len(snapshot.Relationships),
+ })
+}
+
+func runTestPolicy(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("test-policy", stderr)
+ file := fs.String("file", "", "policy package Markdown file")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *file == "" {
+ fmt.Fprintln(stderr, "test-policy requires --file")
+ return 64
+ }
+
+ pkg, err := policy.LoadAndValidateFile(context.Background(), *file)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ if err := writeJSON(stdout, pkg.Validation); err != nil {
+ return fail(stderr, err)
+ }
+ if !pkg.Valid {
+ return 1
+ }
+ return 0
+}
+
+func runCheck(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("check", stderr)
+ registryPath := fs.String("registry", "", "registry snapshot JSON file")
+ policyPath := fs.String("policy", "", "policy package Markdown file")
+ requestPath := fs.String("request", "", "check request YAML/JSON file")
+ logPath := fs.String("log", "", "optional JSONL decision log path")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *registryPath == "" || *policyPath == "" || *requestPath == "" {
+ fmt.Fprintln(stderr, "check requires --registry, --policy, and --request")
+ return 64
+ }
+
+ engine, err := buildEngine(context.Background(), *registryPath, *policyPath, *logPath)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ var request api.CheckRequest
+ if err := readYAML(*requestPath, &request); err != nil {
+ return fail(stderr, err)
+ }
+ decision, err := engine.Check(context.Background(), request)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ if err := writeJSON(stdout, decision); err != nil {
+ return fail(stderr, err)
+ }
+ return 0
+}
+
+func runBatchCheck(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("batch-check", stderr)
+ registryPath := fs.String("registry", "", "registry snapshot JSON file")
+ policyPath := fs.String("policy", "", "policy package Markdown file")
+ requestPath := fs.String("request", "", "batch check request YAML/JSON file")
+ logPath := fs.String("log", "", "optional JSONL decision log path")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *registryPath == "" || *policyPath == "" || *requestPath == "" {
+ fmt.Fprintln(stderr, "batch-check requires --registry, --policy, and --request")
+ return 64
+ }
+
+ engine, err := buildEngine(context.Background(), *registryPath, *policyPath, *logPath)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ var request api.BatchCheckRequest
+ if err := readYAML(*requestPath, &request); err != nil {
+ return fail(stderr, err)
+ }
+ decisions, err := engine.BatchCheck(context.Background(), request)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ if err := writeJSON(stdout, decisions); err != nil {
+ return fail(stderr, err)
+ }
+ return 0
+}
+
+func runListAllowed(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("list-allowed", stderr)
+ registryPath := fs.String("registry", "", "registry snapshot JSON file")
+ policyPath := fs.String("policy", "", "policy package Markdown file")
+ subject := fs.String("subject", "", "subject id")
+ action := fs.String("action", "", "action name")
+ system := fs.String("system", "", "protected system id")
+ resourceType := fs.String("resource-type", "", "resource type")
+ logPath := fs.String("log", "", "optional JSONL decision log path")
+ var filters keyValueFlags
+ fs.Var(&filters, "filter", "resource filter as key=value; may be repeated")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *registryPath == "" || *policyPath == "" || *subject == "" || *action == "" {
+ fmt.Fprintln(stderr, "list-allowed requires --registry, --policy, --subject, and --action")
+ return 64
+ }
+
+ engine, err := buildEngine(context.Background(), *registryPath, *policyPath, *logPath)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ decisions, err := engine.ListAllowed(context.Background(), decisioncore.ListAllowedRequest{
+ Subject: api.SubjectRef{ID: *subject},
+ Action: *action,
+ System: *system,
+ ResourceType: *resourceType,
+ Filters: filters.Map(),
+ })
+ if err != nil {
+ return fail(stderr, err)
+ }
+ if err := writeJSON(stdout, decisions); err != nil {
+ return fail(stderr, err)
+ }
+ return 0
+}
+
+func runExplain(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("explain", stderr)
+ logPath := fs.String("decision-log", "", "JSONL decision log path")
+ decisionID := fs.String("decision-id", "", "decision id to explain")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *logPath == "" || *decisionID == "" {
+ fmt.Fprintln(stderr, "explain requires --decision-log and --decision-id")
+ return 64
+ }
+
+ log := audit.NewJSONLDecisionLog(*logPath)
+ envelope, ok, err := log.Find(*decisionID)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ if !ok {
+ return fail(stderr, fmt.Errorf("decision %q not found", *decisionID))
+ }
+ if err := writeJSON(stdout, decisioncore.ExplainEnvelope(envelope)); err != nil {
+ return fail(stderr, err)
+ }
+ return 0
+}
+
+func runServe(args []string, stdout, stderr io.Writer) int {
+ fs := newFlagSet("serve", stderr)
+ addr := fs.String("addr", "127.0.0.1:8080", "HTTP listen address")
+ registryPath := fs.String("registry", "", "registry snapshot JSON file")
+ policyPath := fs.String("policy", "", "policy package Markdown file")
+ logPath := fs.String("log", "", "optional JSONL decision log path")
+ signingKeyFile := fs.String("envelope-signing-key-file", "", "owner-mounted base64url Ed25519 seed file")
+ signingKID := fs.String("envelope-signing-kid", "", "independently admitted envelope signing key id")
+ approvalSourceFile := fs.String("approval-source-file", "", "owner fixed Approval HTTPS reader configuration file")
+ outboxMaxBytes := fs.Int64("outbox-max-bytes", emission.MaxOutboxBytes, "bounded outbox payload bytes, maximum67108864")
+ outboxDir := fs.String("outbox-dir", "", "durable emission outbox directory (FLEX-WP-0031); exclusive with --log")
+ emissionSource := fs.String("emission-source", "", "audit-core source name for emitted decision events, e.g. flex-auth.tenant-engine")
+ auditURL := fs.String("audit-url", "", "admitted audit-core /v1/events endpoint; empty disables drain and heartbeats")
+ auditTokenFile := fs.String("audit-token-file", "", "mounted sender token file, never a token value")
+ callerAuthMode := fs.String("caller-auth-mode", "disabled", "disabled, warn, or enforce")
+ callerAudience := fs.String("caller-audience", "flex-auth", "required caller token audience")
+ callerKubernetesURL := fs.String("caller-kubernetes-url", "https://kubernetes.default.svc", "Kubernetes API base URL for TokenReview")
+ callerReviewerTokenFile := fs.String("caller-reviewer-token-file", "/var/run/secrets/flex-auth-reviewer/token", "projected Kubernetes API credential")
+ callerCAFile := fs.String("caller-ca-file", "/var/run/secrets/flex-auth-reviewer/ca.crt", "Kubernetes API CA bundle")
+ var callerBindings keyValueFlags
+ fs.Var(&callerBindings, "caller-binding", "resource system=authenticated Kubernetes principal (repeatable)")
+ if err := fs.Parse(args); err != nil {
+ return 64
+ }
+ if *registryPath == "" || *policyPath == "" {
+ fmt.Fprintln(stderr, "serve requires --registry and --policy")
+ return 64
+ }
+
+ if *outboxDir != "" && (*logPath != "" || *emissionSource == "") {
+ fmt.Fprintln(stderr, "serve --outbox-dir requires --emission-source and excludes --log")
+ return 64
+ }
+ delivery := emission.DeliveryConfig{URL: *auditURL, TokenFile: *auditTokenFile}
+ if *auditURL != "" || *auditTokenFile != "" {
+ if *outboxDir == "" {
+ fmt.Fprintln(stderr, "audit delivery requires --outbox-dir")
+ return 64
+ }
+ if err := delivery.Validate(); err != nil {
+ fmt.Fprintln(stderr, err)
+ return 64
+ }
+ }
+
+ engine, err := buildEngine(context.Background(), *registryPath, *policyPath, *logPath)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ if err := configureEnvelopeSigning(engine, *signingKeyFile, *signingKID); err != nil {
+ return fail(stderr, err)
+ }
+ var outbox *emission.Outbox
+ if *outboxDir != "" {
+ outbox, err = emission.OpenBounded(*outboxDir, *emissionSource, *outboxMaxBytes)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ defer outbox.Close()
+ engine.SetDecisionLog(outbox)
+ }
+
+ authenticator, err := buildCallerAuthenticator(
+ callerauth.Mode(*callerAuthMode),
+ *callerAudience,
+ *callerKubernetesURL,
+ *callerReviewerTokenFile,
+ *callerCAFile,
+ callerBindings.StringMap(),
+ stderr,
+ )
+ if err != nil {
+ return fail(stderr, err)
+ }
+
+ serviceInputs, err := buildServicePilotInputs(engine, callerauth.Mode(*callerAuthMode), *callerAudience, *callerKubernetesURL, *callerReviewerTokenFile, *callerCAFile, callerBindings.StringMap())
+ if err != nil {
+ return fail(stderr, err)
+ }
+ var approvalReader *taskexecution.ApprovalReader
+ if engine.IsTrustedServicePilot() {
+ if *signingKeyFile == "" || *approvalSourceFile == "" {
+ return fail(stderr, fmt.Errorf("trusted task source requires signing and fixed Approval reader configuration"))
+ }
+ approvalReader, err = taskexecution.LoadApprovalReader(*approvalSourceFile)
+ if err != nil {
+ return fail(stderr, err)
+ }
+ } else if *approvalSourceFile != "" {
+ return fail(stderr, fmt.Errorf("Approval reader requires exact trusted task source package"))
+ }
+ mux := newServeMuxWithTaskFacts(engine, authenticator, serviceInputs, approvalReader)
+ if outbox != nil {
+ mountEmission(mux, outbox)
+ }
+ if *auditURL != "" {
+ ctx, cancel := context.WithCancel(context.Background())
+ done := make(chan struct{})
+ go func() {
+ defer close(done)
+ runEmissionDelivery(ctx, outbox, delivery, stderr)
+ }()
+ defer func() { cancel(); <-done }()
+ }
+
+ fmt.Fprintf(stderr, "access-engine serving on http://%s\n", *addr)
+ if err := http.ListenAndServe(*addr, mux); err != nil {
+ return fail(stderr, err)
+ }
+ return 0
+}
+
+func runEmissionDelivery(ctx context.Context, outbox *emission.Outbox, config emission.DeliveryConfig, stderr io.Writer) {
+ ticker := time.NewTicker(time.Minute)
+ defer ticker.Stop()
+ for {
+ if ctx.Err() != nil {
+ return
+ }
+ if err := outbox.AppendDueHeartbeats(); err != nil {
+ fmt.Fprintf(stderr, "emission heartbeat commit: %v\n", err)
+ }
+ n, err := outbox.Drain(ctx, config, 100)
+ if err != nil && ctx.Err() == nil {
+ fmt.Fprintf(stderr, "emission drain: %v\n", err)
+ }
+ if err == nil && n == 100 {
+ continue // Drain the next bounded batch without imposing a rate cap.
+ }
+ select {
+ case <-ctx.Done():
+ return
+ case <-ticker.C:
+ }
+ }
+}
+
+func newServeMux(engine *decisioncore.Engine) *http.ServeMux {
+ return newServeMuxWithCallerAuth(engine, callerauth.Disabled())
+}
+
+func newServeMuxWithCallerAuth(engine *decisioncore.Engine, authenticator *callerauth.Authenticator) *http.ServeMux {
+ return newServeMuxWithServicePilotInputs(engine, authenticator, nil)
+}
+
+func newServeMuxWithServicePilotInputs(engine *decisioncore.Engine, authenticator *callerauth.Authenticator, serviceInputs *taskexecution.ServicePilotInputs) *http.ServeMux {
+ return newServeMuxWithTaskFacts(engine, authenticator, serviceInputs, nil)
+}
+func newServeMuxWithTaskFacts(engine *decisioncore.Engine, authenticator *callerauth.Authenticator, serviceInputs *taskexecution.ServicePilotInputs, approvalReader *taskexecution.ApprovalReader) *http.ServeMux {
+ mux := http.NewServeMux()
+ mux.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+ w.Header().Set("content-type", "application/json")
+ _ = json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+ })
+ mux.HandleFunc("/v1/check", func(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodPost {
+ http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+ if engine.IsTaskPin() {
+ if serviceInputs == nil {
+ http.Error(w, "service input unavailable", http.StatusServiceUnavailable)
+ return
+ }
+ decode := taskexecution.DecodeServiceRequest
+ if engine.IsTrustedServicePilot() {
+ decode = taskexecution.DecodeTrustedServiceRequest
+ }
+ request, err := decode(r.Body)
+ if err != nil || request.Purpose != "" {
+ http.Error(w, "invalid service task request", http.StatusBadRequest)
+ return
+ }
+ input, err := serviceInputs.Prepare(r.Context(), r.Header.Get("Authorization"), request, time.Now().UTC())
+ if err != nil {
+ http.Error(w, "service task input refused", http.StatusForbidden)
+ return
+ }
+ var decision api.DecisionEnvelope
+ if engine.IsTrustedServicePilot() {
+ decision, err = engine.CheckTrustedService(r.Context(), input, approvalReader)
+ } else {
+ decision, err = engine.CheckServicePilot(r.Context(), input)
+ }
+ writeHTTP(w, decision, err)
+ return
+ }
+ var request api.CheckRequest
+ if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+ http.Error(w, err.Error(), http.StatusBadRequest)
+ return
+ }
+ if request.Purpose != "" {
+ // Only the readback pin issues purpose-bearing decisions
+ // (FLEX-DEC-2026-019); an enforcement pin never does.
+ http.Error(w, "purpose is not accepted on /v1/check", http.StatusBadRequest)
+ return
+ }
+ identity, err := authenticator.Authorize(r.Context(), r.Header.Get("Authorization"), []string{request.Resource.System})
+ if err != nil {
+ writeCallerAuthError(w, err)
+ return
+ }
+ decision, err := engine.Check(callerauth.WithRecord(r.Context(), authenticator.Record(identity)), request)
+ writeHTTP(w, decision, err)
+ })
+ mux.HandleFunc("/v1/batch_check", func(w http.ResponseWriter, r *http.Request) {
+ if engine.IsTaskPin() {
+ http.Error(w, "service task batch unavailable", http.StatusForbidden)
+ return
+ }
+ if r.Method != http.MethodPost {
+ http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+ var request api.BatchCheckRequest
+ if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+ http.Error(w, err.Error(), http.StatusBadRequest)
+ return
+ }
+ systems := make([]string, 0, len(request.Resources))
+ for _, resource := range request.Resources {
+ systems = append(systems, resource.System)
+ }
+ identity, err := authenticator.Authorize(r.Context(), r.Header.Get("Authorization"), systems)
+ if err != nil {
+ writeCallerAuthError(w, err)
+ return
+ }
+ decisions, err := engine.BatchCheck(callerauth.WithRecord(r.Context(), authenticator.Record(identity)), request)
+ writeHTTP(w, decisions, err)
+ })
+ return mux
+}
+
+// Only the existing exact service pilot package selects this source path.
+// This is not an eligibility toggle; successful preparation still only DENYs.
+func buildServicePilotInputs(engine *decisioncore.Engine, mode callerauth.Mode, audience, kubernetesURL, reviewerTokenFile, caFile string, bindings map[string]string) (*taskexecution.ServicePilotInputs, error) {
+ if !engine.IsTaskPin() {
+ return nil, nil
+ }
+ if mode != callerauth.ModeEnforce || audience != "flex-auth" || len(bindings) != 1 || bindings["secrets-engine"] != taskexecution.ServicePilotPrincipal {
+ return nil, fmt.Errorf("service pilot requires exact enforced retained caller mapping")
+ }
+ reviewer, err := callerauth.NewKubernetesTokenReviewer(kubernetesURL, audience, reviewerTokenFile, caFile)
+ if err != nil {
+ return nil, err
+ }
+ if engine.IsTrustedServicePilot() {
+ return taskexecution.NewTrustedServiceInputs(reviewer)
+ }
+ return taskexecution.NewServicePilotInputs(reviewer)
+}
+
+func buildCallerAuthenticator(mode callerauth.Mode, audience, kubernetesURL, reviewerTokenFile, caFile string, bindings map[string]string, stderr io.Writer) (*callerauth.Authenticator, error) {
+ if mode == callerauth.ModeDisabled {
+ return callerauth.New(mode, nil, "", nil, nil)
+ }
+ reviewer, err := callerauth.NewKubernetesTokenReviewer(kubernetesURL, audience, reviewerTokenFile, caFile)
+ if err != nil {
+ return nil, err
+ }
+ return callerauth.New(mode, reviewer, audience, bindings, func(format string, args ...any) {
+ fmt.Fprintf(stderr, format+"\n", args...)
+ })
+}
+
+func writeCallerAuthError(w http.ResponseWriter, err error) {
+ switch {
+ case errors.Is(err, callerauth.ErrUnauthenticated):
+ http.Error(w, "unauthenticated", http.StatusUnauthorized)
+ case errors.Is(err, callerauth.ErrForbidden):
+ http.Error(w, "forbidden", http.StatusForbidden)
+ default:
+ http.Error(w, "caller authentication unavailable", http.StatusServiceUnavailable)
+ }
+}
+
+func buildEngine(ctx context.Context, registryPath, policyPath, logPath string) (*decisioncore.Engine, error) {
+ pkg, err := policy.LoadAndValidateFile(ctx, policyPath)
+ if err != nil {
+ return nil, err
+ }
+ load := registry.LoadFile
+ if pkg.Metadata.ID == taskexecution.ServicePilotPackageID && pkg.Metadata.Version == taskexecution.TrustedServicePilotPackageVersion {
+ load = registry.LoadFilePreservingNumbers
+ }
+ store, err := load(registryPath)
+ if err != nil {
+ return nil, err
+ }
+ engine, err := decisioncore.NewEngine(store, pkg)
+ if err != nil {
+ return nil, err
+ }
+ if logPath != "" {
+ engine.SetDecisionLog(audit.NewJSONLDecisionLog(logPath))
+ }
+ return engine, nil
+}
+
+func validateDescriptor(descriptor api.CaringAccessDescriptor) error {
+ if descriptor.Profile != api.CaringProfileCaring040RC2 {
+ return fmt.Errorf("unsupported CARING profile %q", descriptor.Profile)
+ }
+ if descriptor.SubjectType == "" {
+ return fmt.Errorf("subject_type is required")
+ }
+ if descriptor.OrganizationRelation == "" {
+ return fmt.Errorf("organization_relation is required")
+ }
+ if descriptor.CanonicalRole == "" {
+ return fmt.Errorf("canonical_role is required")
+ }
+ if descriptor.Scope.Level == "" || descriptor.Scope.ID == "" {
+ return fmt.Errorf("scope.level and scope.id are required")
+ }
+ if len(descriptor.Planes) == 0 {
+ return fmt.Errorf("at least one plane is required")
+ }
+ if len(descriptor.Capabilities) == 0 {
+ return fmt.Errorf("at least one capability is required")
+ }
+ return nil
+}
+
+func readYAML(path string, out any) error {
+ data, err := os.ReadFile(path)
+ if err != nil {
+ return err
+ }
+ if err := yaml.Unmarshal(data, out); err != nil {
+ return fmt.Errorf("unmarshal %s: %w", path, err)
+ }
+ return nil
+}
+
+func writeJSON(w io.Writer, value any) error {
+ encoder := json.NewEncoder(w)
+ encoder.SetIndent("", " ")
+ if err := encoder.Encode(value); err != nil {
+ return err
+ }
+ return nil
+}
+
+func writeStatus(w io.Writer, status string, extra map[string]any) int {
+ out := map[string]any{"status": status}
+ for key, value := range extra {
+ out[key] = value
+ }
+ if err := writeJSON(w, out); err != nil {
+ return fail(w, err)
+ }
+ return 0
+}
+
+// mountEmission exposes the local half of reconciliation: committed and
+// released-uncommitted counts per class. Counts only, never records.
+func mountEmission(mux *http.ServeMux, outbox *emission.Outbox) {
+ mux.HandleFunc("/v1/emission", func(w http.ResponseWriter, r *http.Request) {
+ if r.Method != http.MethodGet {
+ http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+ return
+ }
+ writeHTTP(w, outbox.Status(), nil)
+ })
+}
+
+func writeHTTP(w http.ResponseWriter, value any, err error) {
+ w.Header().Set("content-type", "application/json")
+ if errors.Is(err, decisioncore.ErrRecordNotCommitted) || errors.Is(err, decisioncore.ErrServicePilotUnavailable) {
+ // Unavailable evaluation is not an authorization verdict (GH-DEC-2026-024).
+ http.Error(w, err.Error(), http.StatusServiceUnavailable)
+ return
+ }
+ if err != nil {
+ http.Error(w, err.Error(), http.StatusInternalServerError)
+ return
+ }
+ _ = json.NewEncoder(w).Encode(value)
+}
+
+func newFlagSet(name string, stderr io.Writer) *flag.FlagSet {
+ fs := flag.NewFlagSet(name, flag.ContinueOnError)
+ fs.SetOutput(stderr)
+ return fs
+}
+
+func fail(stderr io.Writer, err error) int {
+ fmt.Fprintln(stderr, "access-engine:", err)
+ return 1
+}
+
+func printUsage(w io.Writer) {
+ fmt.Fprintln(w, "usage: access-engine [options]")
+ fmt.Fprintln(w, "commands: version, validate, load-registry, test-policy, check, batch-check, list-allowed, explain, serve, serve-readback")
+}
+
+type keyValueFlags []string
+
+func (f *keyValueFlags) String() string {
+ return strings.Join(*f, ",")
+}
+
+func (f *keyValueFlags) Set(value string) error {
+ if !strings.Contains(value, "=") {
+ return fmt.Errorf("filter must be key=value")
+ }
+ *f = append(*f, value)
+ return nil
+}
+
+func (f keyValueFlags) Map() map[string]any {
+ out := make(map[string]any, len(f))
+ for _, item := range f {
+ key, value, _ := strings.Cut(item, "=")
+ out[key] = value
+ }
+ return out
+}
+
+func (f keyValueFlags) StringMap() map[string]string {
+ out := make(map[string]string, len(f))
+ for _, item := range f {
+ key, value, _ := strings.Cut(item, "=")
+ out[key] = value
+ }
+ return out
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/internal/decision/engine.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/internal/decision/engine.go
new file mode 100644
index 00000000..8a37c83e
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/access-engine/internal/decision/engine.go
@@ -0,0 +1,729 @@
+package decision
+
+import (
+ "bytes"
+ "context"
+ "crypto/ed25519"
+ "crypto/sha256"
+ "encoding/hex"
+ "encoding/json"
+ "errors"
+ "fmt"
+ "reflect"
+ "slices"
+ "sort"
+ "strings"
+ "sync"
+ "time"
+
+ "github.com/netkingdom/access-engine/internal/callerauth"
+ "github.com/netkingdom/access-engine/internal/policy"
+ "github.com/netkingdom/access-engine/internal/registry"
+ "github.com/netkingdom/access-engine/internal/sign"
+ "github.com/netkingdom/access-engine/internal/taskexecution"
+ "github.com/netkingdom/access-engine/pkg/api"
+)
+
+// Engine evaluates deterministic standalone authorization checks against a
+// local registry and one validated policy package.
+type Engine struct {
+ store *registry.Store
+ policy *policy.Package
+ mu sync.RWMutex
+ history map[string]api.DecisionEnvelope
+ log DecisionRecorder
+ clock func() time.Time
+ signingKey ed25519.PrivateKey
+ signingKID string
+}
+
+// DecisionRecorder persists decision envelopes.
+type DecisionRecorder interface {
+ Append(api.DecisionEnvelope) error
+}
+
+// BatchRecorder commits several decisions in one durable write.
+type BatchRecorder interface {
+ AppendBatch([]api.DecisionEnvelope) error
+}
+
+// ErrRecordNotCommitted means a decision was withheld because its required
+// record did not commit (GH-DEC-2026-024). The service answers 503; this is
+// unavailability, never a substitute authorization verdict.
+var ErrRecordNotCommitted = errors.New("decision withheld: record not committed")
+
+// ListAllowedRequest describes a deterministic list_allowed call.
+type ListAllowedRequest struct {
+ Subject api.SubjectRef `json:"subject"`
+ Action string `json:"action"`
+ System string `json:"system,omitempty"`
+ ResourceType string `json:"resource_type,omitempty"`
+ Filters map[string]any `json:"filters,omitempty"`
+ Context map[string]any `json:"context,omitempty"`
+ PolicyVersion string `json:"policy_version,omitempty"`
+}
+
+// Explanation is a compact explanation view over a recorded decision.
+type Explanation struct {
+ DecisionID string `json:"decision_id"`
+ Effect api.DecisionEffect `json:"effect"`
+ Reason string `json:"reason,omitempty"`
+ Summary string `json:"summary"`
+ Subject api.SubjectRef `json:"subject"`
+ Resource api.ResourceRef `json:"resource"`
+ PolicyPackage string `json:"policy_package,omitempty"`
+ PolicyVersion string `json:"policy_version,omitempty"`
+ MatchedRule string `json:"matched_rule,omitempty"`
+ Diagnostics map[string]any `json:"diagnostics,omitempty"`
+ Caring *api.CaringDecisionMetadata `json:"caring,omitempty"`
+}
+
+// NewEngine creates a standalone decision engine.
+func NewEngine(store *registry.Store, policyPackage *policy.Package) (*Engine, error) {
+ if store == nil {
+ return nil, fmt.Errorf("registry store is required")
+ }
+ if policyPackage == nil {
+ return nil, fmt.Errorf("policy package is required")
+ }
+ if !policyPackage.Valid {
+ return nil, fmt.Errorf("policy package %q is not valid", policyPackage.Metadata.ID)
+ }
+ return &Engine{
+ store: store,
+ policy: policyPackage,
+ history: make(map[string]api.DecisionEnvelope),
+ }, nil
+}
+
+// SetEnvelopeSigningKey installs an owner-custodied key before serving requests.
+// The key is copied so caller mutation cannot change the admitted signer.
+func (e *Engine) SetEnvelopeSigningKey(key ed25519.PrivateKey, kid string) error {
+ if len(key) != ed25519.PrivateKeySize || strings.TrimSpace(kid) == "" {
+ return fmt.Errorf("valid Ed25519 private key and kid are required")
+ }
+ e.mu.Lock()
+ defer e.mu.Unlock()
+ e.signingKey = append(ed25519.PrivateKey(nil), key...)
+ e.signingKID = kid
+ return nil
+}
+
+// SetDecisionLog attaches a local decision recorder to the engine.
+func (e *Engine) SetDecisionLog(log DecisionRecorder) {
+ e.mu.Lock()
+ defer e.mu.Unlock()
+ e.log = log
+}
+
+// SetClock overrides the engine clock. Tests use this to pin allow lifetimes.
+func (e *Engine) SetClock(clock func() time.Time) {
+ e.mu.Lock()
+ defer e.mu.Unlock()
+ e.clock = clock
+}
+
+func (e *Engine) now() time.Time {
+ e.mu.RLock()
+ clock := e.clock
+ e.mu.RUnlock()
+ if clock != nil {
+ return clock().UTC()
+ }
+ return time.Now().UTC()
+}
+
+// decide evaluates one request without recording it.
+func (e *Engine) decide(ctx context.Context, request api.CheckRequest) (api.DecisionEnvelope, error) {
+ normalized, facts := e.normalizeRequest(request)
+
+ expectation, err := e.policy.Evaluate(ctx, normalized)
+ if err != nil {
+ return api.DecisionEnvelope{}, err
+ }
+
+ envelope := e.envelope(ctx, normalized, request, expectation, facts)
+ e.mu.RLock()
+ key, kid := e.signingKey, e.signingKID
+ e.mu.RUnlock()
+ if len(key) != 0 {
+ if err := sign.Sign(&envelope, key, kid); err != nil {
+ return api.DecisionEnvelope{}, fmt.Errorf("decision signing failed: %w", err)
+ }
+ }
+ return envelope, nil
+}
+
+// IsServicePilot selects the existing exact source package, never a request flag.
+func (e *Engine) IsServicePilot() bool {
+ return e.policy.Metadata.ID == taskexecution.ServicePilotPackageID && e.policy.Metadata.Version == taskexecution.ServicePilotPackageVersion
+}
+func (e *Engine) IsTrustedServicePilot() bool {
+ return e.policy.Metadata.ID == taskexecution.ServicePilotPackageID && e.policy.Metadata.Version == taskexecution.TrustedServicePilotPackageVersion
+}
+func (e *Engine) IsTaskPin() bool { return e.IsServicePilot() || e.IsTrustedServicePilot() }
+
+// ErrServicePilotUnavailable withholds any result that is not this B1 slice's
+// signed DENY. Provider joins and executable eligibility remain unimplemented.
+var ErrServicePilotUnavailable = errors.New("service pilot source path unavailable")
+
+// CheckServicePilot records only a signed DENY after authenticating the exact
+// immutable service input. It does not validate Approval facts or grant an act.
+func (e *Engine) CheckServicePilot(ctx context.Context, input taskexecution.ServiceInput) (api.DecisionEnvelope, error) {
+ if !e.IsServicePilot() {
+ return api.DecisionEnvelope{}, ErrServicePilotUnavailable
+ }
+ request, err := input.RequestAt(e.now())
+ if err != nil {
+ return api.DecisionEnvelope{}, err
+ }
+ envelope, err := e.decide(callerauth.WithRecord(ctx, input.Caller()), request)
+ if err != nil {
+ return api.DecisionEnvelope{}, err
+ }
+ if envelope.Effect != api.DecisionEffectDeny || envelope.Signature == nil || envelope.Signature.Mode != api.EnvelopeSignatureSigned {
+ return api.DecisionEnvelope{}, ErrServicePilotUnavailable
+ }
+ if err := e.recordDecisions([]api.DecisionEnvelope{envelope}); err != nil {
+ return api.DecisionEnvelope{}, err
+ }
+ return envelope, nil
+}
+
+// Check evaluates one subject/action/resource request. The decision is
+// released only after its required record commits (GH-DEC-2026-024).
+func (e *Engine) Check(ctx context.Context, request api.CheckRequest) (api.DecisionEnvelope, error) {
+ if e.IsTaskPin() || request.Action == "execute-ccr" {
+ return api.DecisionEnvelope{}, ErrServicePilotUnavailable
+ }
+ decision, err := e.decide(ctx, request)
+ if err != nil {
+ return api.DecisionEnvelope{}, err
+ }
+ if err := e.recordDecisions([]api.DecisionEnvelope{decision}); err != nil {
+ return api.DecisionEnvelope{}, err
+ }
+ return decision, nil
+}
+
+// BatchCheck evaluates one subject/action/context tuple against resources in
+// request order, and commits the whole batch in one durable write.
+func (e *Engine) BatchCheck(ctx context.Context, request api.BatchCheckRequest) ([]api.DecisionEnvelope, error) {
+ if e.IsTaskPin() || request.Action == "execute-ccr" {
+ return nil, ErrServicePilotUnavailable
+ }
+ decisions := make([]api.DecisionEnvelope, 0, len(request.Resources))
+ for _, resource := range request.Resources {
+ decision, err := e.decide(ctx, api.CheckRequest{
+ ID: request.ID,
+ Tenant: request.Tenant,
+ Subject: request.Subject,
+ Action: request.Action,
+ Resource: resource,
+ Context: request.Context,
+ PolicyVersion: request.PolicyVersion,
+ })
+ if err != nil {
+ return nil, err
+ }
+ decisions = append(decisions, decision)
+ }
+ if err := e.recordDecisions(decisions); err != nil {
+ return nil, err
+ }
+ return decisions, nil
+}
+
+// ListAllowed evaluates candidate resources and returns only allow decisions.
+func (e *Engine) ListAllowed(ctx context.Context, request ListAllowedRequest) ([]api.DecisionEnvelope, error) {
+ if e.IsTaskPin() || request.Action == "execute-ccr" {
+ return nil, ErrServicePilotUnavailable
+ }
+ candidates := e.store.ResourceRefs(request.System, request.ResourceType)
+ decisions := make([]api.DecisionEnvelope, 0, len(candidates))
+ for _, resource := range candidates {
+ if !resourceMatchesFilters(resource, request.Filters) {
+ continue
+ }
+ decision, err := e.decide(ctx, api.CheckRequest{
+ Subject: request.Subject,
+ Action: request.Action,
+ Resource: resource,
+ Context: request.Context,
+ PolicyVersion: request.PolicyVersion,
+ })
+ if err != nil {
+ return nil, err
+ }
+ decisions = append(decisions, decision)
+ }
+ if err := e.recordDecisions(decisions); err != nil {
+ return nil, err
+ }
+ allowed := make([]api.DecisionEnvelope, 0, len(decisions))
+ for _, decision := range decisions {
+ if decision.Effect == api.DecisionEffectAllow {
+ allowed = append(allowed, decision)
+ }
+ }
+ return allowed, nil
+}
+
+// Explain returns a CARING-aware explanation for a decision recorded by this
+// engine instance. P2.6 replaces this in-memory history with the local log.
+func (e *Engine) Explain(decisionID string) (Explanation, error) {
+ e.mu.RLock()
+ decision, ok := e.history[decisionID]
+ e.mu.RUnlock()
+ if !ok {
+ return Explanation{}, fmt.Errorf("decision %q not found", decisionID)
+ }
+
+ return ExplainEnvelope(decision), nil
+}
+
+// ExplainEnvelope returns the same explanation shape for an already-loaded
+// decision envelope.
+func ExplainEnvelope(decision api.DecisionEnvelope) Explanation {
+ return Explanation{
+ DecisionID: decision.ID,
+ Effect: decision.Effect,
+ Reason: decision.Reason,
+ Summary: explanationSummary(decision),
+ Subject: decision.Subject,
+ Resource: decision.Resource,
+ PolicyPackage: decision.Provenance.PolicyPackage,
+ PolicyVersion: decision.Provenance.PolicyVersion,
+ MatchedRule: decision.MatchedRule,
+ Diagnostics: decision.Diagnostics,
+ Caring: decision.Caring,
+ }
+}
+
+type registryFacts struct {
+ subjectFound bool
+ resourceFound bool
+ subject api.Subject
+ resource api.Resource
+ matchedRelationship string
+ descriptor *api.CaringAccessDescriptor
+ // overriddenByRegistry names request attribute keys whose caller-supplied
+ // value was displaced by a registry fact. Empty on an honest request; a
+ // non-empty list means the caller asserted something the registry contradicts,
+ // which is worth seeing even though the registry won (FLEX-DEC-2026-012).
+ overriddenByRegistry []string
+}
+
+func (e *Engine) normalizeRequest(request api.CheckRequest) (api.CheckRequest, registryFacts) {
+ normalized := request
+ facts := registryFacts{}
+
+ overridden := []string{}
+
+ if normalized.Tenant != "" {
+ if normalized.Subject.Tenant == "" {
+ normalized.Subject.Tenant = normalized.Tenant
+ }
+ if normalized.Resource.Tenant == "" {
+ normalized.Resource.Tenant = normalized.Tenant
+ }
+ }
+
+ if subject, ok := e.store.Subject(request.Subject.ID); ok {
+ facts.subjectFound = true
+ facts.subject = subject
+ normalized.Subject = enrichSubjectRef(request.Subject, subject, &overridden)
+ }
+
+ if resource, ok := e.store.Resource(request.Resource.System, request.Resource.ID); ok {
+ facts.resourceFound = true
+ facts.resource = resource
+ normalized.Resource = enrichResourceRef(request.Resource, resource, &overridden)
+ }
+
+ if normalized.CaringContext != nil {
+ descriptor := *normalized.CaringContext
+ facts.descriptor = &descriptor
+ facts.overriddenByRegistry = overridden
+ return normalized, facts
+ }
+
+ facts.overriddenByRegistry = overridden
+
+ if descriptor, relationshipID := e.matchCaringDescriptor(normalized, facts); descriptor != nil {
+ facts.descriptor = descriptor
+ facts.matchedRelationship = relationshipID
+ normalized.CaringContext = descriptor
+ } else if facts.resourceFound && facts.resource.Caring != nil {
+ descriptor := *facts.resource.Caring
+ facts.descriptor = &descriptor
+ normalized.CaringContext = &descriptor
+ }
+
+ return normalized, facts
+}
+
+func (e *Engine) matchCaringDescriptor(request api.CheckRequest, facts registryFacts) (*api.CaringAccessDescriptor, string) {
+ candidates := []string{request.Subject.ID}
+ if facts.subjectFound {
+ candidates = append(candidates, facts.subject.Groups...)
+ }
+
+ for _, relationship := range e.store.RelationshipsForObject(request.Resource.ID) {
+ if relationship.Caring == nil {
+ continue
+ }
+ if !slices.Contains(candidates, relationship.Subject) {
+ continue
+ }
+ if relationship.System != "" && relationship.System != request.Resource.System {
+ continue
+ }
+ if relationship.Tenant != "" && request.Resource.Tenant != "" && relationship.Tenant != request.Resource.Tenant {
+ continue
+ }
+ descriptor := *relationship.Caring
+ return &descriptor, relationship.ID
+ }
+ return nil, ""
+}
+
+// enrichSubjectRef overlays registry facts onto the subject the caller sent.
+//
+// Registry facts WIN. A value in the registry is an authority statement; the
+// same key on the request is the caller's proposal about itself. Letting the
+// proposal survive made a registry ceiling advisory — see FLEX-DEC-2026-012,
+// where a caller supplying resource.attributes.allowed_subjects authorized a
+// subject the registry did not know.
+//
+// Keys the registry does not define still pass through from the request. That
+// residual is stated in docs/request-enrichment.md rather than fixed here: a
+// policy reading a key its manifest omits is consuming caller input, and the
+// structural fix is separating the two namespaces (FLEX-WP-0025).
+func enrichSubjectRef(ref api.SubjectRef, subject api.Subject, overridden *[]string) api.SubjectRef {
+ out := ref
+ // subject.Type is deliberately NOT overwritten, unlike every other registry
+ // fact here. The registry's Type is CARING vocabulary (Human, Agent,
+ // Automation, Service); the request's is the protected system's actor
+ // vocabulary (service, adm, agt, atm). They are two different fields sharing
+ // a name, and substituting one for the other is translation rather than
+ // identity — the error GH-DEC-2026-008 ruled against. Making the registry win
+ // here denied every secrets-engine allow, because "Service" is not "service".
+ //
+ // The residual is that a caller can still assert its own subject.type and
+ // packages branch on it. That is not fixable by overwriting from a different
+ // vocabulary; it needs the two fields separated. FLEX-WP-0025.
+ if out.Type == "" {
+ out.Type = subject.Type
+ }
+ if subject.Tenant != "" {
+ out.Tenant = subject.Tenant
+ }
+ out.Attributes = copyMap(out.Attributes)
+ setAuthoritative(out.Attributes, "display_name", subject.DisplayName, "subject", overridden)
+ setAuthoritative(out.Attributes, "organization_relation", subject.OrganizationRelation, "subject", overridden)
+ setAuthoritative(out.Attributes, "roles", subject.Roles, "subject", overridden)
+ setAuthoritative(out.Attributes, "groups", subject.Groups, "subject", overridden)
+ setAuthoritatives(out.Attributes, subject.Claims, "subject", overridden)
+ setAuthoritatives(out.Attributes, subject.Metadata, "subject", overridden)
+ return out
+}
+
+// enrichResourceRef overlays registry facts onto the resource the caller sent.
+// Registry facts win, for the reason given on enrichSubjectRef: ops-warden's
+// max_ttl_hours, allowed_subjects, and allowed_principals are ceilings and
+// allowlists, and a ceiling a caller can raise is not a ceiling.
+func enrichResourceRef(ref api.ResourceRef, resource api.Resource, overridden *[]string) api.ResourceRef {
+ out := ref
+ if resource.Type != "" {
+ out.Type = resource.Type
+ }
+ out.Attributes = copyMap(out.Attributes)
+ setAuthoritative(out.Attributes, "path", resource.Path, "resource", overridden)
+ setAuthoritative(out.Attributes, "parent", resource.Parent, "resource", overridden)
+ setAuthoritative(out.Attributes, "labels", resource.Labels, "resource", overridden)
+ setAuthoritative(out.Attributes, "trust_zone", resource.TrustZone, "resource", overridden)
+ setAuthoritative(out.Attributes, "owner", resource.Owner, "resource", overridden)
+ setAuthoritatives(out.Attributes, resource.Attributes, "resource", overridden)
+ return out
+}
+
+func (e *Engine) envelope(ctx context.Context, request, submitted api.CheckRequest, expectation api.DecisionExpectation, facts registryFacts) api.DecisionEnvelope {
+ envelope := api.DecisionEnvelope{
+ RequestID: request.ID,
+ Effect: expectation.Effect,
+ Reason: expectation.Reason,
+ MatchedPolicyVersion: e.policy.Metadata.Version,
+ MatchedRule: expectation.Reason,
+ Resource: request.Resource,
+ Subject: request.Subject,
+ Binding: api.NewDecisionBindingFor(request, submitted),
+ Obligations: expectation.Obligations,
+ Diagnostics: map[string]any{
+ "action": request.Action,
+ "policy_package": e.policy.Metadata.ID,
+ "policy_status": e.policy.Metadata.Status,
+ "registry_subject": facts.subjectFound,
+ "registry_resource": facts.resourceFound,
+ "matched_relationship": facts.matchedRelationship,
+ "registry_overrode": facts.overriddenByRegistry,
+ },
+ Provenance: api.DecisionProvenance{
+ Evaluator: "flex-auth/local",
+ Mode: "standalone",
+ PolicyPackage: e.policy.Metadata.ID,
+ PolicyVersion: e.policy.Metadata.Version,
+ PolicyPackageDigest: e.policy.Digest(),
+ RegistrySnapshotDigest: e.store.Digest(),
+ Caller: callerProvenance(ctx),
+ },
+ Caring: e.caringDecisionMetadata(facts.descriptor, expectation.ConformanceFindings),
+ }
+ api.CompleteDecision(&envelope, request, api.DecisionCompletion{
+ AllowTTL: e.policy.Metadata.AllowTTL,
+ Now: e.now(),
+ })
+ envelope.ID = decisionID(e.policy.Metadata, request, envelope)
+ if envelope.Signature == nil {
+ envelope.Signature = api.UnsignedEnvelopeSignature()
+ }
+ return envelope
+}
+
+func callerProvenance(ctx context.Context) *api.CallerProvenance {
+ record, ok := callerauth.RecordFromContext(ctx)
+ if !ok {
+ record = callerauth.Record{Mode: callerauth.ModeDisabled}
+ }
+ out := &api.CallerProvenance{Mode: string(record.Mode)}
+ if record.Principal != "" {
+ out.Principal = record.Principal
+ out.Audience = record.Audience
+ if !record.NotAfter.IsZero() {
+ out.NotAfter = record.NotAfter.UTC().Format(time.RFC3339)
+ }
+ }
+ return out
+}
+
+// recordDecisions releases no effect until its required record commits.
+// GH-DEC-2026-024 refuses the former restrictive-effect failure exception.
+// Failed decisions must not enter Explain's history as if they were released.
+func (e *Engine) recordDecisions(decisions []api.DecisionEnvelope) error {
+ e.mu.RLock()
+ log := e.log
+ e.mu.RUnlock()
+ if log != nil && len(decisions) != 0 {
+ if err := appendAll(log, decisions); err != nil {
+ return fmt.Errorf("%w: %v", ErrRecordNotCommitted, err)
+ }
+ }
+ e.mu.Lock()
+ defer e.mu.Unlock()
+ for _, decision := range decisions {
+ e.history[decision.ID] = decision
+ }
+ return nil
+}
+
+func appendAll(log DecisionRecorder, decisions []api.DecisionEnvelope) error {
+ if batch, ok := log.(BatchRecorder); ok {
+ return batch.AppendBatch(decisions)
+ }
+ for _, decision := range decisions {
+ if err := log.Append(decision); err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
+func (e *Engine) caringDecisionMetadata(descriptor *api.CaringAccessDescriptor, findings []api.CaringConformanceFinding) *api.CaringDecisionMetadata {
+ profile := e.policy.Metadata.Caring.Profile
+ if descriptor != nil && descriptor.Profile != "" {
+ profile = descriptor.Profile
+ }
+
+ metadata := &api.CaringDecisionMetadata{
+ Profile: profile,
+ ConformanceFindings: append([]api.CaringConformanceFinding(nil), findings...),
+ }
+ if descriptor == nil {
+ metadata.ConformanceFindings = append(metadata.ConformanceFindings, api.CaringConformanceFinding{
+ Code: "CARING-DESCRIPTOR-MISSING",
+ Severity: "warning",
+ Message: "no CARING descriptor matched the request",
+ Fields: []string{"caring_context"},
+ })
+ return metadata
+ }
+
+ descriptorCopy := *descriptor
+ metadata.Descriptor = &descriptorCopy
+ metadata.RestrictionsEvaluated = append([]api.Restriction(nil), descriptor.Restrictions...)
+ metadata.ExposureModes = append([]api.ExposureMode(nil), descriptor.ExposureModes...)
+ metadata.DerivedCapabilities = append([]api.CaringDerivedCapability(nil), descriptor.DerivedCapabilities...)
+ return metadata
+}
+
+func decisionID(metadata api.PolicyPackageMetadata, request api.CheckRequest, envelope api.DecisionEnvelope) string {
+ data, _ := json.Marshal(struct {
+ PolicyID string `json:"policy_id"`
+ PolicyVersion string `json:"policy_version"`
+ Request api.CheckRequest `json:"request"`
+ Effect api.DecisionEffect `json:"effect"`
+ Reason string `json:"reason,omitempty"`
+ }{
+ PolicyID: metadata.ID,
+ PolicyVersion: metadata.Version,
+ Request: request,
+ Effect: envelope.Effect,
+ Reason: envelope.Reason,
+ })
+ sum := sha256.Sum256(data)
+ return "decision:" + hex.EncodeToString(sum[:8])
+}
+
+func copyMap(in map[string]any) map[string]any {
+ out := make(map[string]any, len(in))
+ for key, value := range in {
+ out[key] = value
+ }
+ return out
+}
+
+// setAuthoritative writes a registry fact over whatever the request carried for
+// that key, and records the key when a caller value was displaced so the
+// override is visible in diagnostics rather than silent.
+func setAuthoritative(target map[string]any, key string, value any, scope string, overridden *[]string) {
+ if isEmptyAttribute(value) {
+ return
+ }
+ if existing, exists := target[key]; exists && overridden != nil && !equalAttribute(existing, value) {
+ *overridden = append(*overridden, scope+"."+key)
+ }
+ target[key] = value
+}
+
+func setAuthoritatives(target map[string]any, attrs map[string]any, scope string, overridden *[]string) {
+ for _, key := range sortedKeys(attrs) {
+ setAuthoritative(target, key, attrs[key], scope, overridden)
+ }
+}
+
+func equalAttribute(a, b any) bool {
+ left, errLeft := json.Marshal(a)
+ right, errRight := json.Marshal(b)
+ if errLeft != nil || errRight != nil {
+ return false
+ }
+ return bytes.Equal(left, right)
+}
+
+func sortedKeys(attrs map[string]any) []string {
+ keys := make([]string, 0, len(attrs))
+ for key := range attrs {
+ keys = append(keys, key)
+ }
+ sort.Strings(keys)
+ return keys
+}
+
+func addAttributes(target map[string]any, attrs map[string]any) {
+ for key, value := range attrs {
+ addAttribute(target, key, value)
+ }
+}
+
+func addAttribute(target map[string]any, key string, value any) {
+ if isEmptyAttribute(value) {
+ return
+ }
+ if _, exists := target[key]; !exists {
+ target[key] = value
+ }
+}
+
+func resourceMatchesFilters(resource api.ResourceRef, filters map[string]any) bool {
+ for key, want := range filters {
+ var got any
+ switch key {
+ case "id":
+ got = resource.ID
+ case "type", "resource_type":
+ got = resource.Type
+ case "system":
+ got = resource.System
+ case "tenant":
+ got = resource.Tenant
+ default:
+ got = resource.Attributes[key]
+ }
+ if !valuesEqual(got, want) {
+ return false
+ }
+ }
+ return true
+}
+
+func valuesEqual(got, want any) bool {
+ if reflect.DeepEqual(got, want) {
+ return true
+ }
+ return fmt.Sprint(got) == fmt.Sprint(want)
+}
+
+func explanationSummary(decision api.DecisionEnvelope) string {
+ action, _ := decision.Diagnostics["action"].(string)
+ actor := decision.Subject.ID
+ capability := action
+ plane := ""
+ if decision.Caring != nil && decision.Caring.Descriptor != nil {
+ descriptor := decision.Caring.Descriptor
+ if descriptor.OrganizationRelation != "" || descriptor.CanonicalRole != "" {
+ actor = strings.TrimSpace(fmt.Sprintf("%s %s", descriptor.OrganizationRelation, descriptor.CanonicalRole))
+ }
+ if len(descriptor.Capabilities) > 0 {
+ capability = string(descriptor.Capabilities[0])
+ }
+ if len(descriptor.Planes) > 0 {
+ plane = string(descriptor.Planes[0]) + " Plane "
+ }
+ }
+ if capability == "" {
+ capability = "access"
+ }
+
+ verb := "may"
+ switch decision.Effect {
+ case api.DecisionEffectDeny:
+ verb = "may not"
+ case api.DecisionEffectRedact:
+ verb = "receives redacted"
+ case api.DecisionEffectAuditOnly:
+ verb = "is audit-only for"
+ case api.DecisionEffectNotApplicable:
+ verb = "has no applicable policy for"
+ }
+
+ reason := decision.Reason
+ if reason == "" {
+ reason = string(decision.Effect)
+ }
+ return fmt.Sprintf("%s %s %s %sresource %s because %s.", actor, verb, capability, plane, decision.Resource.ID, reason)
+}
+
+func isEmptyAttribute(value any) bool {
+ switch typed := value.(type) {
+ case string:
+ return typed == ""
+ case api.OrganizationRelation:
+ return typed == ""
+ case []api.CanonicalRole:
+ return len(typed) == 0
+ case []string:
+ return len(typed) == 0
+ default:
+ return value == nil
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/cmd/admin_auth_oauth.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/cmd/admin_auth_oauth.go
new file mode 100644
index 00000000..f382555f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/cmd/admin_auth_oauth.go
@@ -0,0 +1,372 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+ "errors"
+ "fmt"
+ "net/url"
+
+ auth_model "forgejo.org/models/auth"
+ "forgejo.org/models/db"
+ "forgejo.org/modules/setting"
+ "forgejo.org/services/auth/source/oauth2"
+
+ "github.com/urfave/cli/v2"
+ "xorm.io/xorm"
+)
+
+var (
+ oauthCLIFlags = []cli.Flag{
+ &cli.StringFlag{
+ Name: "name",
+ Value: "",
+ Usage: "Application Name",
+ },
+ &cli.StringFlag{
+ Name: "provider",
+ Value: "",
+ Usage: "OAuth2 Provider",
+ },
+ &cli.StringFlag{
+ Name: "key",
+ Value: "",
+ Usage: "Client ID (Key)",
+ },
+ &cli.StringFlag{
+ Name: "secret",
+ Value: "",
+ Usage: "Client Secret",
+ },
+ &cli.StringFlag{
+ Name: "secret-file",
+ Usage: "Read a 64-byte base64url client secret from an admitted read-only regular file",
+ },
+ &cli.StringFlag{
+ Name: "auto-discover-url",
+ Value: "",
+ Usage: "OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider)",
+ },
+ &cli.StringFlag{
+ Name: "use-custom-urls",
+ Value: "false",
+ Usage: "Use custom URLs for GitLab/GitHub OAuth endpoints",
+ },
+ &cli.StringFlag{
+ Name: "custom-tenant-id",
+ Value: "",
+ Usage: "Use custom Tenant ID for OAuth endpoints",
+ },
+ &cli.StringFlag{
+ Name: "custom-auth-url",
+ Value: "",
+ Usage: "Use a custom Authorization URL (option for GitLab/GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "custom-token-url",
+ Value: "",
+ Usage: "Use a custom Token URL (option for GitLab/GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "custom-profile-url",
+ Value: "",
+ Usage: "Use a custom Profile URL (option for GitLab/GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "custom-email-url",
+ Value: "",
+ Usage: "Use a custom Email URL (option for GitHub)",
+ },
+ &cli.StringFlag{
+ Name: "icon-url",
+ Value: "",
+ Usage: "Custom icon URL for OAuth2 login source",
+ },
+ &cli.BoolFlag{
+ Name: "skip-local-2fa",
+ Usage: "Set to true to skip local 2fa for users authenticated by this source",
+ },
+ &cli.StringSliceFlag{
+ Name: "scopes",
+ Value: nil,
+ Usage: "Scopes to request when to authenticate against this OAuth2 source",
+ },
+ &cli.StringFlag{
+ Name: "required-claim-name",
+ Value: "",
+ Usage: "Claim name that has to be set to allow users to login with this source",
+ },
+ &cli.StringFlag{
+ Name: "required-claim-value",
+ Value: "",
+ Usage: "Claim value that has to be set to allow users to login with this source",
+ },
+ &cli.StringSliceFlag{
+ Name: "required-claim-values",
+ Usage: "Require any one exact array value from current OpenID Connect UserInfo (cannot combine with required-claim-value)",
+ },
+ &cli.StringFlag{
+ Name: "group-claim-name",
+ Value: "",
+ Usage: "Claim name providing group names for this source",
+ },
+ &cli.StringFlag{
+ Name: "admin-group",
+ Value: "",
+ Usage: "Group Claim value for administrator users",
+ },
+ &cli.StringFlag{
+ Name: "restricted-group",
+ Value: "",
+ Usage: "Group Claim value for restricted users",
+ },
+ &cli.StringFlag{
+ Name: "group-team-map",
+ Value: "",
+ Usage: "JSON mapping between groups and org teams",
+ },
+ &cli.BoolFlag{
+ Name: "group-team-map-removal",
+ Usage: "Activate automatic team membership removal depending on groups",
+ },
+ }
+
+ microcmdAuthAddOauth = &cli.Command{
+ Name: "add-oauth",
+ Usage: "Add new Oauth authentication source",
+ Action: runAddOauth,
+ Flags: oauthCLIFlags,
+ }
+
+ microcmdAuthUpdateOauth = &cli.Command{
+ Name: "update-oauth",
+ Usage: "Update existing Oauth authentication source",
+ Action: runUpdateOauth,
+ Flags: append(oauthCLIFlags[:1], append([]cli.Flag{idFlag}, oauthCLIFlags[1:]...)...),
+ }
+)
+
+func parseOAuth2Config(c *cli.Context) *oauth2.Source {
+ var customURLMapping *oauth2.CustomURLMapping
+ if c.IsSet("use-custom-urls") {
+ customURLMapping = &oauth2.CustomURLMapping{
+ TokenURL: c.String("custom-token-url"),
+ AuthURL: c.String("custom-auth-url"),
+ ProfileURL: c.String("custom-profile-url"),
+ EmailURL: c.String("custom-email-url"),
+ Tenant: c.String("custom-tenant-id"),
+ }
+ } else {
+ customURLMapping = nil
+ }
+ return &oauth2.Source{
+ Provider: c.String("provider"),
+ ClientID: c.String("key"),
+ ClientSecret: c.String("secret"),
+ OpenIDConnectAutoDiscoveryURL: c.String("auto-discover-url"),
+ CustomURLMapping: customURLMapping,
+ IconURL: c.String("icon-url"),
+ SkipLocalTwoFA: c.Bool("skip-local-2fa"),
+ Scopes: c.StringSlice("scopes"),
+ RequiredClaimName: c.String("required-claim-name"),
+ RequiredClaimValue: c.String("required-claim-value"),
+ RequiredClaimValues: c.StringSlice("required-claim-values"),
+ GroupClaimName: c.String("group-claim-name"),
+ AdminGroup: c.String("admin-group"),
+ RestrictedGroup: c.String("restricted-group"),
+ GroupTeamMap: c.String("group-team-map"),
+ GroupTeamMapRemoval: c.Bool("group-team-map-removal"),
+ }
+}
+
+func runAddOauth(c *cli.Context) error {
+ secret, selected, err := oauthSecretInput(c)
+ if err != nil {
+ return err
+ }
+ ctx, cancel := installSignals()
+ defer cancel()
+ ctx = db.WithSensitiveSQL(ctx)
+
+ if err := initDB(ctx); err != nil {
+ return err
+ }
+ engine, ok := db.GetEngine(ctx).(*xorm.Engine)
+ if !ok || setting.Database.LogSQL || engine.Logger().IsShowSQL() {
+ return errors.New("OAuth configuration requires SQL logging disabled")
+ }
+
+ config := parseOAuth2Config(c)
+ if selected {
+ config.ClientSecret = secret
+ }
+ if err := oauth2.ValidateRequiredClaimValues(config.RequiredClaimName, config.RequiredClaimValue, config.RequiredClaimValues); err != nil {
+ return err
+ }
+ if config.RequiredClaimValues != nil && config.Provider != "openidConnect" {
+ return errors.New("required-claim-values requires openidConnect")
+ }
+ if config.Provider == "openidConnect" {
+ discoveryURL, err := url.Parse(config.OpenIDConnectAutoDiscoveryURL)
+ if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
+ return fmt.Errorf("invalid Auto Discovery URL: %s (this must be a valid URL starting with http:// or https://)", config.OpenIDConnectAutoDiscoveryURL)
+ }
+ }
+
+ err = auth_model.CreateSource(ctx, &auth_model.Source{
+ Type: auth_model.OAuth2,
+ Name: c.String("name"),
+ IsActive: true,
+ Cfg: config,
+ })
+ if err != nil && c.IsSet("secret-file") {
+ return errors.New("OAuth source creation failed")
+ }
+ return err
+}
+
+func runUpdateOauth(c *cli.Context) error {
+ secret, selected, err := oauthSecretInput(c)
+ if err != nil {
+ return err
+ }
+ if !c.IsSet("id") {
+ return errors.New("--id flag is missing")
+ }
+
+ ctx, cancel := installSignals()
+ defer cancel()
+ ctx = db.WithSensitiveSQL(ctx)
+
+ if err := initDB(ctx); err != nil {
+ return err
+ }
+ engine, ok := db.GetEngine(ctx).(*xorm.Engine)
+ if !ok || setting.Database.LogSQL || engine.Logger().IsShowSQL() {
+ return errors.New("OAuth configuration requires SQL logging disabled")
+ }
+
+ source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
+ if err != nil {
+ return err
+ }
+
+ oAuth2Config, ok := source.Cfg.(*oauth2.Source)
+ if !ok {
+ return errors.New("authentication source is not OAuth2")
+ }
+
+ if c.IsSet("name") {
+ source.Name = c.String("name")
+ }
+
+ if c.IsSet("provider") {
+ oAuth2Config.Provider = c.String("provider")
+ }
+
+ if c.IsSet("key") {
+ oAuth2Config.ClientID = c.String("key")
+ }
+
+ if selected {
+ oAuth2Config.ClientSecret = secret
+ }
+
+ if c.IsSet("auto-discover-url") {
+ oAuth2Config.OpenIDConnectAutoDiscoveryURL = c.String("auto-discover-url")
+ }
+
+ if c.IsSet("icon-url") {
+ oAuth2Config.IconURL = c.String("icon-url")
+ }
+
+ if c.IsSet("scopes") {
+ oAuth2Config.Scopes = c.StringSlice("scopes")
+ }
+
+ if c.IsSet("required-claim-name") {
+ oAuth2Config.RequiredClaimName = c.String("required-claim-name")
+ }
+ if c.IsSet("required-claim-value") {
+ oAuth2Config.RequiredClaimValue = c.String("required-claim-value")
+ }
+
+ if c.IsSet("required-claim-values") {
+ oAuth2Config.RequiredClaimValues = c.StringSlice("required-claim-values")
+ }
+
+ if c.IsSet("group-claim-name") {
+ oAuth2Config.GroupClaimName = c.String("group-claim-name")
+ }
+ if c.IsSet("admin-group") {
+ oAuth2Config.AdminGroup = c.String("admin-group")
+ }
+ if c.IsSet("restricted-group") {
+ oAuth2Config.RestrictedGroup = c.String("restricted-group")
+ }
+ if c.IsSet("group-team-map") {
+ oAuth2Config.GroupTeamMap = c.String("group-team-map")
+ }
+ if c.IsSet("group-team-map-removal") {
+ oAuth2Config.GroupTeamMapRemoval = c.Bool("group-team-map-removal")
+ }
+
+ // update custom URL mapping
+ customURLMapping := &oauth2.CustomURLMapping{}
+
+ if oAuth2Config.CustomURLMapping != nil {
+ customURLMapping.TokenURL = oAuth2Config.CustomURLMapping.TokenURL
+ customURLMapping.AuthURL = oAuth2Config.CustomURLMapping.AuthURL
+ customURLMapping.ProfileURL = oAuth2Config.CustomURLMapping.ProfileURL
+ customURLMapping.EmailURL = oAuth2Config.CustomURLMapping.EmailURL
+ customURLMapping.Tenant = oAuth2Config.CustomURLMapping.Tenant
+ }
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-token-url") {
+ customURLMapping.TokenURL = c.String("custom-token-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-auth-url") {
+ customURLMapping.AuthURL = c.String("custom-auth-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-profile-url") {
+ customURLMapping.ProfileURL = c.String("custom-profile-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-email-url") {
+ customURLMapping.EmailURL = c.String("custom-email-url")
+ }
+
+ if c.IsSet("use-custom-urls") && c.IsSet("custom-tenant-id") {
+ customURLMapping.Tenant = c.String("custom-tenant-id")
+ }
+
+ oAuth2Config.CustomURLMapping = customURLMapping
+ if err := oauth2.ValidateRequiredClaimValues(oAuth2Config.RequiredClaimName, oAuth2Config.RequiredClaimValue, oAuth2Config.RequiredClaimValues); err != nil {
+ return err
+ }
+ if oAuth2Config.RequiredClaimValues != nil && oAuth2Config.Provider != "openidConnect" {
+ return errors.New("required-claim-values requires openidConnect")
+ }
+ source.Cfg = oAuth2Config
+
+ err = auth_model.UpdateSource(ctx, source)
+ if err != nil && c.IsSet("secret-file") {
+ return errors.New("OAuth source update failed")
+ }
+ return err
+}
+
+// Resolve before opening the DB or mutating a loaded source. Never store the
+// resolved bytes in the CLI context: they must not become flag/argv diagnostics.
+func oauthSecretInput(c *cli.Context) (string, bool, error) {
+ if c.IsSet("secret-file") {
+ if c.IsSet("secret") {
+ return "", false, errors.New("secret and secret-file are mutually exclusive")
+ }
+ value, err := readOAuthSecretFile(c.String("secret-file"))
+ return value, true, err
+ }
+ return c.String("secret"), c.IsSet("secret"), nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/go.mod b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/go.mod
new file mode 100644
index 00000000..cbeed643
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/go.mod
@@ -0,0 +1,257 @@
+module forgejo.org
+
+go 1.24
+
+toolchain go1.24.3
+
+require (
+ code.forgejo.org/f3/gof3/v3 v3.10.6
+ code.forgejo.org/forgejo-contrib/go-libravatar v0.0.0-20191008002943-06d1c002b251
+ code.forgejo.org/forgejo/levelqueue v1.0.0
+ code.forgejo.org/forgejo/reply v1.0.2
+ code.forgejo.org/go-chi/binding v1.0.0
+ code.forgejo.org/go-chi/cache v1.0.0
+ code.forgejo.org/go-chi/captcha v1.0.1
+ code.forgejo.org/go-chi/session v1.0.1
+ code.gitea.io/actions-proto-go v0.4.0
+ code.gitea.io/sdk/gitea v0.20.0
+ codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
+ connectrpc.com/connect v1.17.0
+ github.com/42wim/httpsig v1.2.2
+ github.com/42wim/sshsig v0.0.0-20211121163825-841cf5bbc121
+ github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358
+ github.com/ProtonMail/go-crypto v1.1.6
+ github.com/PuerkitoBio/goquery v1.10.2
+ github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.7.2
+ github.com/alecthomas/chroma/v2 v2.15.0
+ github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
+ github.com/blevesearch/bleve/v2 v2.5.2
+ github.com/buildkite/terminal-to-html/v3 v3.16.8
+ github.com/caddyserver/certmagic v0.22.2
+ github.com/chi-middleware/proxy v1.1.1
+ github.com/djherbis/buffer v1.2.0
+ github.com/djherbis/nio/v3 v3.0.1
+ github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
+ github.com/dustin/go-humanize v1.0.1
+ github.com/editorconfig/editorconfig-core-go/v2 v2.6.3
+ github.com/emersion/go-imap v1.2.1
+ github.com/felixge/fgprof v0.9.5
+ github.com/fsnotify/fsnotify v1.8.0
+ github.com/gliderlabs/ssh v0.3.8
+ github.com/go-ap/activitypub v0.0.0-20231114162308-e219254dc5c9
+ github.com/go-ap/jsonld v0.0.0-20221030091449-f2a191312c73
+ github.com/go-chi/chi/v5 v5.2.0
+ github.com/go-chi/cors v1.2.1
+ github.com/go-co-op/gocron v1.37.0
+ github.com/go-enry/go-enry/v2 v2.9.2
+ github.com/go-git/go-git/v5 v5.13.2
+ github.com/go-ldap/ldap/v3 v3.4.6
+ github.com/go-openapi/spec v0.20.14
+ github.com/go-sql-driver/mysql v1.9.1
+ github.com/go-webauthn/webauthn v0.12.2
+ github.com/gobwas/glob v0.2.3
+ github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
+ github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
+ github.com/golang-jwt/jwt/v5 v5.2.2
+ github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0
+ github.com/google/go-github/v64 v64.0.0
+ github.com/google/pprof v0.0.0-20241017200806-017d972448fc
+ github.com/google/uuid v1.6.0
+ github.com/gorilla/feeds v1.2.0
+ github.com/gorilla/sessions v1.4.0
+ github.com/hashicorp/go-version v1.7.0
+ github.com/hashicorp/golang-lru/v2 v2.0.7
+ github.com/huandu/xstrings v1.5.0
+ github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056
+ github.com/jhillyerd/enmime/v2 v2.1.0
+ github.com/json-iterator/go v1.1.12
+ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
+ github.com/klauspost/compress v1.17.11
+ github.com/klauspost/cpuid/v2 v2.2.10
+ github.com/lib/pq v1.10.9
+ github.com/markbates/goth v1.80.0
+ github.com/mattn/go-isatty v0.0.20
+ github.com/mattn/go-sqlite3 v1.14.28
+ github.com/meilisearch/meilisearch-go v0.31.0
+ github.com/mholt/archiver/v3 v3.5.1
+ github.com/microcosm-cc/bluemonday v1.0.27
+ github.com/minio/minio-go/v7 v7.0.88
+ github.com/msteinert/pam/v2 v2.1.0
+ github.com/nektos/act v0.2.52
+ github.com/niklasfasching/go-org v1.7.0
+ github.com/olivere/elastic/v7 v7.0.32
+ github.com/opencontainers/go-digest v1.0.0
+ github.com/opencontainers/image-spec v1.1.1
+ github.com/pquerna/otp v1.4.0
+ github.com/prometheus/client_golang v1.21.1
+ github.com/redis/go-redis/v9 v9.7.3
+ github.com/robfig/cron/v3 v3.0.1
+ github.com/santhosh-tekuri/jsonschema/v6 v6.0.1
+ github.com/sassoftware/go-rpmutils v0.4.0
+ github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
+ github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92
+ github.com/stretchr/testify v1.10.0
+ github.com/syndtr/goleveldb v1.0.0
+ github.com/ulikunitz/xz v0.5.12
+ github.com/urfave/cli/v2 v2.27.6
+ github.com/valyala/fastjson v1.6.4
+ github.com/yohcop/openid-go v1.0.1
+ github.com/yuin/goldmark v1.7.8
+ github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
+ gitlab.com/gitlab-org/api/client-go v0.126.0
+ go.uber.org/mock v0.5.0
+ golang.org/x/crypto v0.36.0
+ golang.org/x/image v0.25.0
+ golang.org/x/net v0.38.0
+ golang.org/x/oauth2 v0.28.0
+ golang.org/x/sync v0.12.0
+ golang.org/x/sys v0.31.0
+ golang.org/x/text v0.23.0
+ google.golang.org/protobuf v1.36.4
+ gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
+ gopkg.in/ini.v1 v1.67.0
+ gopkg.in/yaml.v3 v3.0.1
+ mvdan.cc/xurls/v2 v2.5.0
+ xorm.io/builder v0.3.13
+ xorm.io/xorm v1.3.9
+)
+
+require (
+ cloud.google.com/go/compute/metadata v0.6.0 // indirect
+ dario.cat/mergo v1.0.0 // indirect
+ filippo.io/edwards25519 v1.1.0 // indirect
+ git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078 // indirect
+ github.com/DataDog/zstd v1.5.5 // indirect
+ github.com/Microsoft/go-winio v0.6.2 // indirect
+ github.com/RoaringBitmap/roaring/v2 v2.4.5 // indirect
+ github.com/andybalholm/brotli v1.1.1 // indirect
+ github.com/andybalholm/cascadia v1.3.3 // indirect
+ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
+ github.com/aymerick/douceur v0.2.0 // indirect
+ github.com/beorn7/perks v1.0.1 // indirect
+ github.com/bits-and-blooms/bitset v1.22.0 // indirect
+ github.com/blevesearch/bleve_index_api v1.2.8 // indirect
+ github.com/blevesearch/geo v0.2.3 // indirect
+ github.com/blevesearch/go-faiss v1.0.25 // indirect
+ github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
+ github.com/blevesearch/gtreap v0.1.1 // indirect
+ github.com/blevesearch/mmap-go v1.0.4 // indirect
+ github.com/blevesearch/scorch_segment_api/v2 v2.3.10 // indirect
+ github.com/blevesearch/segment v0.9.1 // indirect
+ github.com/blevesearch/snowballstem v0.9.0 // indirect
+ github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
+ github.com/blevesearch/vellum v1.1.0 // indirect
+ github.com/blevesearch/zapx/v11 v11.4.2 // indirect
+ github.com/blevesearch/zapx/v12 v12.4.2 // indirect
+ github.com/blevesearch/zapx/v13 v13.4.2 // indirect
+ github.com/blevesearch/zapx/v14 v14.4.2 // indirect
+ github.com/blevesearch/zapx/v15 v15.4.2 // indirect
+ github.com/blevesearch/zapx/v16 v16.2.4 // indirect
+ github.com/boombuler/barcode v1.0.1 // indirect
+ github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 // indirect
+ github.com/caddyserver/zerossl v0.1.3 // indirect
+ github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
+ github.com/cespare/xxhash/v2 v2.3.0 // indirect
+ github.com/cloudflare/circl v1.6.1 // indirect
+ github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+ github.com/cyphar/filepath-securejoin v0.3.6 // indirect
+ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+ github.com/davidmz/go-pageant v1.0.2 // indirect
+ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+ github.com/dlclark/regexp2 v1.11.4 // indirect
+ github.com/emersion/go-sasl v0.0.0-20231106173351-e73c9f7bad43 // indirect
+ github.com/emirpasic/gods v1.18.1 // indirect
+ github.com/fatih/color v1.16.0 // indirect
+ github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+ github.com/go-ap/errors v0.0.0-20231003111023-183eef4b31b7 // indirect
+ github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
+ github.com/go-enry/go-oniguruma v1.2.1 // indirect
+ github.com/go-fed/httpsig v1.1.0 // indirect
+ github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+ github.com/go-git/go-billy/v5 v5.6.2 // indirect
+ github.com/go-ini/ini v1.67.0 // indirect
+ github.com/go-openapi/jsonpointer v0.20.2 // indirect
+ github.com/go-openapi/jsonreference v0.20.4 // indirect
+ github.com/go-openapi/swag v0.22.7 // indirect
+ github.com/go-webauthn/x v0.1.20 // indirect
+ github.com/goccy/go-json v0.10.5 // indirect
+ github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
+ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+ github.com/golang/protobuf v1.5.4 // indirect
+ github.com/golang/snappy v0.0.4 // indirect
+ github.com/google/btree v1.1.2 // indirect
+ github.com/google/go-cmp v0.7.0 // indirect
+ github.com/google/go-querystring v1.1.0 // indirect
+ github.com/google/go-tpm v0.9.3 // indirect
+ github.com/gorilla/css v1.0.1 // indirect
+ github.com/gorilla/mux v1.8.1 // indirect
+ github.com/gorilla/securecookie v1.1.2 // indirect
+ github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+ github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+ github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+ github.com/josharian/intern v1.0.0 // indirect
+ github.com/kevinburke/ssh_config v1.2.0 // indirect
+ github.com/klauspost/pgzip v1.2.6 // indirect
+ github.com/libdns/libdns v0.2.3 // indirect
+ github.com/mailru/easyjson v0.9.0 // indirect
+ github.com/markbates/going v1.0.3 // indirect
+ github.com/mattn/go-colorable v0.1.13 // indirect
+ github.com/mattn/go-runewidth v0.0.16 // indirect
+ github.com/mholt/acmez/v3 v3.1.1 // indirect
+ github.com/miekg/dns v1.1.63 // indirect
+ github.com/minio/crc64nvme v1.0.1 // indirect
+ github.com/minio/md5-simd v1.1.2 // indirect
+ github.com/mitchellh/mapstructure v1.5.0 // indirect
+ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+ github.com/modern-go/reflect2 v1.0.2 // indirect
+ github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 // indirect
+ github.com/mschoch/smat v0.2.0 // indirect
+ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+ github.com/nwaples/rardecode v1.1.3 // indirect
+ github.com/olekukonko/tablewriter v0.0.5 // indirect
+ github.com/onsi/ginkgo v1.16.5 // indirect
+ github.com/pierrec/lz4/v4 v4.1.21 // indirect
+ github.com/pjbgf/sha1cd v0.3.2 // indirect
+ github.com/pkg/errors v0.9.1 // indirect
+ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+ github.com/prometheus/client_model v0.6.1 // indirect
+ github.com/prometheus/common v0.62.0 // indirect
+ github.com/prometheus/procfs v0.15.1 // indirect
+ github.com/rhysd/actionlint v1.6.27 // indirect
+ github.com/rivo/uniseg v0.4.7 // indirect
+ github.com/rogpeppe/go-internal v1.13.1 // indirect
+ github.com/rs/xid v1.6.0 // indirect
+ github.com/russross/blackfriday/v2 v2.1.0 // indirect
+ github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
+ github.com/sirupsen/logrus v1.9.3 // indirect
+ github.com/skeema/knownhosts v1.3.0 // indirect
+ github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
+ github.com/x448/float16 v0.8.4 // indirect
+ github.com/xanzy/ssh-agent v0.3.3 // indirect
+ github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
+ github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+ github.com/zeebo/assert v1.3.0 // indirect
+ github.com/zeebo/blake3 v0.2.4 // indirect
+ go.etcd.io/bbolt v1.4.0 // indirect
+ go.uber.org/atomic v1.11.0 // indirect
+ go.uber.org/multierr v1.11.0 // indirect
+ go.uber.org/zap v1.27.0 // indirect
+ go.uber.org/zap/exp v0.3.0 // indirect
+ golang.org/x/mod v0.24.0 // indirect
+ golang.org/x/time v0.10.0 // indirect
+ golang.org/x/tools v0.31.0 // indirect
+ gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
+ gopkg.in/warnings.v0 v0.1.2 // indirect
+)
+
+replace github.com/hashicorp/go-version => github.com/6543/go-version v1.3.1
+
+replace github.com/shurcooL/vfsgen => github.com/lunny/vfsgen v0.0.0-20220105142115-2c99e1ffdfa0
+
+replace github.com/nektos/act => code.forgejo.org/forgejo/act v1.25.1
+
+replace github.com/mholt/archiver/v3 => code.forgejo.org/forgejo/archiver/v3 v3.5.1
+
+replace github.com/gliderlabs/ssh => code.forgejo.org/forgejo/ssh v0.0.0-20241211213324-5fc306ca0616
+
+replace git.sr.ht/~mariusor/go-xsd-duration => code.forgejo.org/forgejo/go-xsd-duration v0.0.0-20220703122237-02e73435a078
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/models/db/sensitive_sql.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/models/db/sensitive_sql.go
new file mode 100644
index 00000000..246bb367
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/models/db/sensitive_sql.go
@@ -0,0 +1,18 @@
+// Copyright 2026 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package db
+
+import "context"
+
+type sensitiveSQLKey struct{}
+
+// WithSensitiveSQL suppresses argument, statement and driver-error disclosure
+// in the application's query hooks. The caller must separately refuse raw XORM
+// SQL logging; custom driver/server auditing remains an owner custody concern.
+func WithSensitiveSQL(ctx context.Context) context.Context {
+ return context.WithValue(ctx, sensitiveSQLKey{}, true)
+}
+func isSensitiveSQL(ctx context.Context) bool {
+ sensitive, _ := ctx.Value(sensitiveSQLKey{}).(bool)
+ return sensitive
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/routers/web/auth/oauth.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/routers/web/auth/oauth.go
new file mode 100644
index 00000000..1ed9f35a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/routers/web/auth/oauth.go
@@ -0,0 +1,1485 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+ go_context "context"
+ "crypto/sha256"
+ "encoding/base64"
+ "errors"
+ "fmt"
+ "html"
+ "html/template"
+ "io"
+ "net/http"
+ "net/url"
+ "sort"
+ "strings"
+
+ asymkey_model "forgejo.org/models/asymkey"
+ "forgejo.org/models/auth"
+ org_model "forgejo.org/models/organization"
+ user_model "forgejo.org/models/user"
+ auth_module "forgejo.org/modules/auth"
+ "forgejo.org/modules/base"
+ "forgejo.org/modules/container"
+ "forgejo.org/modules/json"
+ "forgejo.org/modules/log"
+ "forgejo.org/modules/optional"
+ "forgejo.org/modules/setting"
+ "forgejo.org/modules/timeutil"
+ "forgejo.org/modules/util"
+ "forgejo.org/modules/web"
+ "forgejo.org/modules/web/middleware"
+ auth_service "forgejo.org/services/auth"
+ source_service "forgejo.org/services/auth/source"
+ "forgejo.org/services/auth/source/oauth2"
+ "forgejo.org/services/context"
+ "forgejo.org/services/externalaccount"
+ "forgejo.org/services/forms"
+ remote_service "forgejo.org/services/remote"
+ user_service "forgejo.org/services/user"
+
+ "code.forgejo.org/go-chi/binding"
+ "github.com/golang-jwt/jwt/v5"
+ "github.com/markbates/goth"
+ "github.com/markbates/goth/gothic"
+ "github.com/markbates/goth/providers/fitbit"
+ "github.com/markbates/goth/providers/openidConnect"
+ "github.com/markbates/goth/providers/zoom"
+ go_oauth2 "golang.org/x/oauth2"
+)
+
+const (
+ tplGrantAccess base.TplName = "user/auth/grant"
+ tplGrantError base.TplName = "user/auth/grant_error"
+)
+
+// TODO move error and responses to SDK or models
+
+// AuthorizeErrorCode represents an error code specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1
+type AuthorizeErrorCode string
+
+const (
+ // ErrorCodeInvalidRequest represents the according error in RFC 6749
+ ErrorCodeInvalidRequest AuthorizeErrorCode = "invalid_request"
+ // ErrorCodeUnauthorizedClient represents the according error in RFC 6749
+ ErrorCodeUnauthorizedClient AuthorizeErrorCode = "unauthorized_client"
+ // ErrorCodeAccessDenied represents the according error in RFC 6749
+ ErrorCodeAccessDenied AuthorizeErrorCode = "access_denied"
+ // ErrorCodeUnsupportedResponseType represents the according error in RFC 6749
+ ErrorCodeUnsupportedResponseType AuthorizeErrorCode = "unsupported_response_type"
+ // ErrorCodeInvalidScope represents the according error in RFC 6749
+ ErrorCodeInvalidScope AuthorizeErrorCode = "invalid_scope"
+ // ErrorCodeServerError represents the according error in RFC 6749
+ ErrorCodeServerError AuthorizeErrorCode = "server_error"
+ // ErrorCodeTemporaryUnavailable represents the according error in RFC 6749
+ ErrorCodeTemporaryUnavailable AuthorizeErrorCode = "temporarily_unavailable"
+)
+
+// AuthorizeError represents an error type specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1
+type AuthorizeError struct {
+ ErrorCode AuthorizeErrorCode `json:"error" form:"error"`
+ ErrorDescription string
+ State string
+}
+
+// Error returns the error message
+func (err AuthorizeError) Error() string {
+ return fmt.Sprintf("%s: %s", err.ErrorCode, err.ErrorDescription)
+}
+
+// AccessTokenErrorCode represents an error code specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+type AccessTokenErrorCode string
+
+const (
+ // AccessTokenErrorCodeInvalidRequest represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidRequest AccessTokenErrorCode = "invalid_request"
+ // AccessTokenErrorCodeInvalidClient represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidClient = "invalid_client"
+ // AccessTokenErrorCodeInvalidGrant represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidGrant = "invalid_grant"
+ // AccessTokenErrorCodeUnauthorizedClient represents an error code specified in RFC 6749
+ AccessTokenErrorCodeUnauthorizedClient = "unauthorized_client"
+ // AccessTokenErrorCodeUnsupportedGrantType represents an error code specified in RFC 6749
+ AccessTokenErrorCodeUnsupportedGrantType = "unsupported_grant_type"
+ // AccessTokenErrorCodeInvalidScope represents an error code specified in RFC 6749
+ AccessTokenErrorCodeInvalidScope = "invalid_scope"
+)
+
+// AccessTokenError represents an error response specified in RFC 6749
+// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+type AccessTokenError struct {
+ ErrorCode AccessTokenErrorCode `json:"error" form:"error"`
+ ErrorDescription string `json:"error_description"`
+}
+
+// Error returns the error message
+func (err AccessTokenError) Error() string {
+ return fmt.Sprintf("%s: %s", err.ErrorCode, err.ErrorDescription)
+}
+
+// errCallback represents a oauth2 callback error
+type errCallback struct {
+ Code string
+ Description string
+}
+
+func (err errCallback) Error() string {
+ return err.Description
+}
+
+// TokenType specifies the kind of token
+type TokenType string
+
+const (
+ // TokenTypeBearer represents a token type specified in RFC 6749
+ TokenTypeBearer TokenType = "bearer"
+ // TokenTypeMAC represents a token type specified in RFC 6749
+ TokenTypeMAC = "mac"
+)
+
+// AccessTokenResponse represents a successful access token response
+// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2
+type AccessTokenResponse struct {
+ AccessToken string `json:"access_token"`
+ TokenType TokenType `json:"token_type"`
+ ExpiresIn int64 `json:"expires_in"`
+ RefreshToken string `json:"refresh_token"`
+ IDToken string `json:"id_token,omitempty"`
+}
+
+func newAccessTokenResponse(ctx go_context.Context, grant *auth.OAuth2Grant, serverKey, clientKey oauth2.JWTSigningKey) (*AccessTokenResponse, *AccessTokenError) {
+ if setting.OAuth2.InvalidateRefreshTokens {
+ if err := grant.IncreaseCounter(ctx); err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidGrant,
+ ErrorDescription: "cannot increase the grant counter",
+ }
+ }
+ }
+ // generate access token to access the API
+ expirationDate := timeutil.TimeStampNow().Add(setting.OAuth2.AccessTokenExpirationTime)
+ accessToken := &oauth2.Token{
+ GrantID: grant.ID,
+ Type: oauth2.TypeAccessToken,
+ RegisteredClaims: jwt.RegisteredClaims{
+ ExpiresAt: jwt.NewNumericDate(expirationDate.AsTime()),
+ },
+ }
+ signedAccessToken, err := accessToken.SignToken(serverKey)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot sign token",
+ }
+ }
+
+ // generate refresh token to request an access token after it expired later
+ refreshExpirationDate := timeutil.TimeStampNow().Add(setting.OAuth2.RefreshTokenExpirationTime * 60 * 60).AsTime()
+ refreshToken := &oauth2.Token{
+ GrantID: grant.ID,
+ Counter: grant.Counter,
+ Type: oauth2.TypeRefreshToken,
+ RegisteredClaims: jwt.RegisteredClaims{
+ ExpiresAt: jwt.NewNumericDate(refreshExpirationDate),
+ },
+ }
+ signedRefreshToken, err := refreshToken.SignToken(serverKey)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot sign token",
+ }
+ }
+
+ // generate OpenID Connect id_token
+ signedIDToken := ""
+ if grant.ScopeContains("openid") {
+ app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot find application",
+ }
+ }
+ user, err := user_model.GetUserByID(ctx, grant.UserID)
+ if err != nil {
+ if user_model.IsErrUserNotExist(err) {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot find user",
+ }
+ }
+ log.Error("Error loading user: %v", err)
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "server error",
+ }
+ }
+
+ idToken := &oauth2.OIDCToken{
+ RegisteredClaims: jwt.RegisteredClaims{
+ ExpiresAt: jwt.NewNumericDate(expirationDate.AsTime()),
+ Issuer: setting.AppURL,
+ Audience: []string{app.ClientID},
+ Subject: fmt.Sprint(grant.UserID),
+ },
+ Nonce: grant.Nonce,
+ }
+ if grant.ScopeContains("profile") {
+ idToken.Name = user.DisplayName()
+ idToken.PreferredUsername = user.Name
+ idToken.Profile = user.HTMLURL()
+ idToken.Picture = user.AvatarLink(ctx)
+ idToken.Website = user.Website
+ idToken.Locale = user.Language
+ idToken.UpdatedAt = user.UpdatedUnix
+ }
+ if grant.ScopeContains("email") {
+ idToken.Email = user.Email
+ idToken.EmailVerified = user.IsActive
+ }
+ if grant.ScopeContains("groups") {
+ onlyPublicGroups := ifOnlyPublicGroups(grant.Scope)
+
+ groups, err := getOAuthGroupsForUser(ctx, user, onlyPublicGroups)
+ if err != nil {
+ log.Error("Error getting groups: %v", err)
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "server error",
+ }
+ }
+ idToken.Groups = groups
+ }
+
+ signedIDToken, err = idToken.SignToken(clientKey)
+ if err != nil {
+ return nil, &AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot sign token",
+ }
+ }
+ }
+
+ return &AccessTokenResponse{
+ AccessToken: signedAccessToken,
+ TokenType: TokenTypeBearer,
+ ExpiresIn: setting.OAuth2.AccessTokenExpirationTime,
+ RefreshToken: signedRefreshToken,
+ IDToken: signedIDToken,
+ }, nil
+}
+
+type userInfoResponse struct {
+ Sub string `json:"sub"`
+ Name string `json:"name"`
+ Username string `json:"preferred_username"`
+ Email string `json:"email"`
+ Picture string `json:"picture"`
+ Groups []string `json:"groups,omitempty"`
+}
+
+func ifOnlyPublicGroups(scopes string) bool {
+ scopes = strings.ReplaceAll(scopes, ",", " ")
+ scopesList := strings.Fields(scopes)
+ for _, scope := range scopesList {
+ if scope == "all" || scope == "read:organization" || scope == "read:admin" {
+ return false
+ }
+ }
+ return true
+}
+
+// InfoOAuth manages request for userinfo endpoint
+func InfoOAuth(ctx *context.Context) {
+ if ctx.Doer == nil || ctx.Data["AuthedMethod"] != (&auth_service.OAuth2{}).Name() {
+ ctx.Resp.Header().Set("WWW-Authenticate", `Bearer realm=""`)
+ ctx.PlainText(http.StatusUnauthorized, "no valid authorization")
+ return
+ }
+
+ response := &userInfoResponse{
+ Sub: fmt.Sprint(ctx.Doer.ID),
+ Name: ctx.Doer.DisplayName(),
+ Username: ctx.Doer.Name,
+ Email: ctx.Doer.Email,
+ Picture: ctx.Doer.AvatarLink(ctx),
+ }
+
+ var token string
+ if auHead := ctx.Req.Header.Get("Authorization"); auHead != "" {
+ auths := strings.Fields(auHead)
+ if len(auths) == 2 && (auths[0] == "token" || strings.ToLower(auths[0]) == "bearer") {
+ token = auths[1]
+ }
+ }
+
+ _, grantScopes := auth_service.CheckOAuthAccessToken(ctx, token)
+ onlyPublicGroups := ifOnlyPublicGroups(grantScopes)
+
+ groups, err := getOAuthGroupsForUser(ctx, ctx.Doer, onlyPublicGroups)
+ if err != nil {
+ ctx.ServerError("Oauth groups for user", err)
+ return
+ }
+ response.Groups = groups
+
+ ctx.JSON(http.StatusOK, response)
+}
+
+// returns a list of "org" and "org:team" strings,
+// that the given user is a part of.
+func getOAuthGroupsForUser(ctx go_context.Context, user *user_model.User, onlyPublicGroups bool) ([]string, error) {
+ orgs, err := org_model.GetUserOrgsList(ctx, user)
+ if err != nil {
+ return nil, fmt.Errorf("GetUserOrgList: %w", err)
+ }
+
+ var groups []string
+ for _, org := range orgs {
+ if setting.OAuth2.EnableAdditionalGrantScopes {
+ if onlyPublicGroups {
+ public, err := org_model.IsPublicMembership(ctx, org.ID, user.ID)
+ if !public && err == nil {
+ continue
+ }
+ }
+ }
+
+ groups = append(groups, org.Name)
+ teams, err := org.LoadTeams(ctx)
+ if err != nil {
+ return nil, fmt.Errorf("LoadTeams: %w", err)
+ }
+ for _, team := range teams {
+ if team.IsMember(ctx, user.ID) {
+ groups = append(groups, org.Name+":"+team.LowerName)
+ }
+ }
+ }
+ return groups, nil
+}
+
+func parseBasicAuth(ctx *context.Context) (username, password string, err error) {
+ authHeader := ctx.Req.Header.Get("Authorization")
+ if authType, authData, ok := strings.Cut(authHeader, " "); ok && strings.EqualFold(authType, "Basic") {
+ return base.BasicAuthDecode(authData)
+ }
+ return "", "", errors.New("invalid basic authentication")
+}
+
+// IntrospectOAuth introspects an oauth token
+func IntrospectOAuth(ctx *context.Context) {
+ clientIDValid := false
+ if clientID, clientSecret, err := parseBasicAuth(ctx); err == nil {
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, clientID)
+ if err != nil && !auth.IsErrOauthClientIDInvalid(err) {
+ // this is likely a database error; log it and respond without details
+ log.Error("Error retrieving client_id: %v", err)
+ ctx.Error(http.StatusInternalServerError)
+ return
+ }
+ clientIDValid = err == nil && app.ValidateClientSecret([]byte(clientSecret))
+ }
+ if !clientIDValid {
+ ctx.Resp.Header().Set("WWW-Authenticate", `Basic realm=""`)
+ ctx.PlainText(http.StatusUnauthorized, "no valid authorization")
+ return
+ }
+
+ var response struct {
+ Active bool `json:"active"`
+ Scope string `json:"scope,omitempty"`
+ Username string `json:"username,omitempty"`
+ jwt.RegisteredClaims
+ }
+
+ form := web.GetForm(ctx).(*forms.IntrospectTokenForm)
+ token, err := oauth2.ParseToken(form.Token, oauth2.DefaultSigningKey)
+ if err == nil {
+ grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
+ if err == nil && grant != nil {
+ app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
+ if err == nil && app != nil {
+ response.Active = true
+ response.Scope = grant.Scope
+ response.Issuer = setting.AppURL
+ response.Audience = []string{app.ClientID}
+ response.Subject = fmt.Sprint(grant.UserID)
+ }
+ if user, err := user_model.GetUserByID(ctx, grant.UserID); err == nil {
+ response.Username = user.Name
+ }
+ }
+ }
+
+ ctx.JSON(http.StatusOK, response)
+}
+
+// AuthorizeOAuth manages authorize requests
+func AuthorizeOAuth(ctx *context.Context) {
+ form := web.GetForm(ctx).(*forms.AuthorizationForm)
+ errs := binding.Errors{}
+ errs = form.Validate(ctx.Req, errs)
+ if len(errs) > 0 {
+ errstring := ""
+ for _, e := range errs {
+ errstring += e.Error() + "\n"
+ }
+ ctx.ServerError("AuthorizeOAuth: Validate: ", fmt.Errorf("errors occurred during validation: %s", errstring))
+ return
+ }
+
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ if auth.IsErrOauthClientIDInvalid(err) {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeUnauthorizedClient,
+ ErrorDescription: "Client ID not registered",
+ State: form.State,
+ }, "")
+ return
+ }
+ ctx.ServerError("GetOAuth2ApplicationByClientID", err)
+ return
+ }
+
+ var user *user_model.User
+ if app.UID != 0 {
+ user, err = user_model.GetUserByID(ctx, app.UID)
+ if err != nil {
+ ctx.ServerError("GetUserByID", err)
+ return
+ }
+ }
+
+ if !app.ContainsRedirectURI(form.RedirectURI) {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeInvalidRequest,
+ ErrorDescription: "Unregistered Redirect URI",
+ State: form.State,
+ }, "")
+ return
+ }
+
+ if form.ResponseType != "code" {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeUnsupportedResponseType,
+ ErrorDescription: "Only code response type is supported.",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+
+ // pkce support
+ switch form.CodeChallengeMethod {
+ case "S256":
+ case "plain":
+ if err := ctx.Session.Set("CodeChallengeMethod", form.CodeChallengeMethod); err != nil {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeServerError,
+ ErrorDescription: "cannot set code challenge method",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+ if err := ctx.Session.Set("CodeChallengeMethod", form.CodeChallenge); err != nil {
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeServerError,
+ ErrorDescription: "cannot set code challenge",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+ // Here we're just going to try to release the session early
+ if err := ctx.Session.Release(); err != nil {
+ // we'll tolerate errors here as they *should* get saved elsewhere
+ log.Error("Unable to save changes to the session: %v", err)
+ }
+ case "":
+ // "Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message"
+ // https://datatracker.ietf.org/doc/html/rfc8252#section-8.1
+ if !app.ConfidentialClient {
+ // "the authorization endpoint MUST return the authorization error response with the "error" value set to "invalid_request""
+ // https://datatracker.ietf.org/doc/html/rfc7636#section-4.4.1
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeInvalidRequest,
+ ErrorDescription: "PKCE is required for public clients",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+ default:
+ // "If the server supporting PKCE does not support the requested transformation, the authorization endpoint MUST return the authorization error response with "error" value set to "invalid_request"."
+ // https://www.rfc-editor.org/rfc/rfc7636#section-4.4.1
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeInvalidRequest,
+ ErrorDescription: "unsupported code challenge method",
+ State: form.State,
+ }, form.RedirectURI)
+ return
+ }
+
+ grant, err := app.GetGrantByUserID(ctx, ctx.Doer.ID)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+
+ // Redirect if user already granted access and the application is confidential.
+ // I.e. always require authorization for public clients as recommended by RFC 6749 Section 10.2
+ if app.ConfidentialClient && grant != nil {
+ code, err := grant.GenerateNewAuthorizationCode(ctx, form.RedirectURI, form.CodeChallenge, form.CodeChallengeMethod)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ redirect, err := code.GenerateRedirectURI(form.State)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ // Update nonce to reflect the new session
+ if len(form.Nonce) > 0 {
+ err := grant.SetNonce(ctx, form.Nonce)
+ if err != nil {
+ log.Error("Unable to update nonce: %v", err)
+ }
+ }
+ ctx.Redirect(redirect.String())
+ return
+ }
+
+ // show authorize page to grant access
+ ctx.Data["Application"] = app
+ ctx.Data["RedirectURI"] = form.RedirectURI
+ ctx.Data["State"] = form.State
+ ctx.Data["Scope"] = form.Scope
+ ctx.Data["Nonce"] = form.Nonce
+ if user != nil {
+ ctx.Data["ApplicationCreatorLinkHTML"] = template.HTML(fmt.Sprintf(`@%s`, html.EscapeString(user.HomeLink()), html.EscapeString(user.Name)))
+ } else {
+ ctx.Data["ApplicationCreatorLinkHTML"] = template.HTML(fmt.Sprintf(`%s`, html.EscapeString(setting.AppSubURL+"/"), html.EscapeString(setting.AppName)))
+ }
+ ctx.Data["ApplicationRedirectDomainHTML"] = template.HTML("" + html.EscapeString(form.RedirectURI) + "")
+ // TODO document SESSION <=> FORM
+ err = ctx.Session.Set("client_id", app.ClientID)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ log.Error(err.Error())
+ return
+ }
+ err = ctx.Session.Set("redirect_uri", form.RedirectURI)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ log.Error(err.Error())
+ return
+ }
+ err = ctx.Session.Set("state", form.State)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ log.Error(err.Error())
+ return
+ }
+ // Here we're just going to try to release the session early
+ if err := ctx.Session.Release(); err != nil {
+ // we'll tolerate errors here as they *should* get saved elsewhere
+ log.Error("Unable to save changes to the session: %v", err)
+ }
+ ctx.HTML(http.StatusOK, tplGrantAccess)
+}
+
+// GrantApplicationOAuth manages the post request submitted when a user grants access to an application
+func GrantApplicationOAuth(ctx *context.Context) {
+ form := web.GetForm(ctx).(*forms.GrantApplicationForm)
+ if ctx.Session.Get("client_id") != form.ClientID || ctx.Session.Get("state") != form.State ||
+ ctx.Session.Get("redirect_uri") != form.RedirectURI {
+ ctx.Error(http.StatusBadRequest)
+ return
+ }
+
+ if !form.Granted {
+ handleAuthorizeError(ctx, AuthorizeError{
+ State: form.State,
+ ErrorDescription: "the request is denied",
+ ErrorCode: ErrorCodeAccessDenied,
+ }, form.RedirectURI)
+ return
+ }
+
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ ctx.ServerError("GetOAuth2ApplicationByClientID", err)
+ return
+ }
+ grant, err := app.GetGrantByUserID(ctx, ctx.Doer.ID)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ if grant == nil {
+ grant, err = app.CreateGrant(ctx, ctx.Doer.ID, form.Scope)
+ if err != nil {
+ handleAuthorizeError(ctx, AuthorizeError{
+ State: form.State,
+ ErrorDescription: "cannot create grant for user",
+ ErrorCode: ErrorCodeServerError,
+ }, form.RedirectURI)
+ return
+ }
+ } else if grant.Scope != form.Scope {
+ handleAuthorizeError(ctx, AuthorizeError{
+ State: form.State,
+ ErrorDescription: "a grant exists with different scope",
+ ErrorCode: ErrorCodeServerError,
+ }, form.RedirectURI)
+ return
+ }
+
+ if len(form.Nonce) > 0 {
+ err := grant.SetNonce(ctx, form.Nonce)
+ if err != nil {
+ log.Error("Unable to update nonce: %v", err)
+ }
+ }
+
+ var codeChallenge, codeChallengeMethod string
+ codeChallenge, _ = ctx.Session.Get("CodeChallenge").(string)
+ codeChallengeMethod, _ = ctx.Session.Get("CodeChallengeMethod").(string)
+
+ code, err := grant.GenerateNewAuthorizationCode(ctx, form.RedirectURI, codeChallenge, codeChallengeMethod)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ redirect, err := code.GenerateRedirectURI(form.State)
+ if err != nil {
+ handleServerError(ctx, form.State, form.RedirectURI, err)
+ return
+ }
+ ctx.Redirect(redirect.String(), http.StatusSeeOther)
+}
+
+// OIDCWellKnown generates JSON so OIDC clients know Gitea's capabilities
+func OIDCWellKnown(ctx *context.Context) {
+ ctx.Data["SigningKey"] = oauth2.DefaultSigningKey
+ ctx.JSONTemplate("user/auth/oidc_wellknown")
+}
+
+// OIDCKeys generates the JSON Web Key Set
+func OIDCKeys(ctx *context.Context) {
+ jwk, err := oauth2.DefaultSigningKey.ToJWK()
+ if err != nil {
+ log.Error("Error converting signing key to JWK: %v", err)
+ ctx.Error(http.StatusInternalServerError)
+ return
+ }
+
+ jwk["use"] = "sig"
+
+ jwks := map[string][]map[string]string{
+ "keys": {
+ jwk,
+ },
+ }
+
+ ctx.Resp.Header().Set("Content-Type", "application/json")
+ enc := json.NewEncoder(ctx.Resp)
+ if err := enc.Encode(jwks); err != nil {
+ log.Error("Failed to encode representation as json. Error: %v", err)
+ }
+}
+
+// AccessTokenOAuth manages all access token requests by the client
+func AccessTokenOAuth(ctx *context.Context) {
+ form := *web.GetForm(ctx).(*forms.AccessTokenForm)
+ // if there is no ClientID or ClientSecret in the request body, fill these fields by the Authorization header and ensure the provided field matches the Authorization header
+ if form.ClientID == "" || form.ClientSecret == "" {
+ authHeader := ctx.Req.Header.Get("Authorization")
+ if authType, authData, ok := strings.Cut(authHeader, " "); ok && strings.EqualFold(authType, "Basic") {
+ clientID, clientSecret, err := base.BasicAuthDecode(authData)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot parse basic auth header",
+ })
+ return
+ }
+ // validate that any fields present in the form match the Basic auth header
+ if form.ClientID != "" && form.ClientID != clientID {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "client_id in request body inconsistent with Authorization header",
+ })
+ return
+ }
+ form.ClientID = clientID
+ if form.ClientSecret != "" && form.ClientSecret != clientSecret {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "client_secret in request body inconsistent with Authorization header",
+ })
+ return
+ }
+ form.ClientSecret = clientSecret
+ }
+ }
+
+ serverKey := oauth2.DefaultSigningKey
+ clientKey := serverKey
+ if serverKey.IsSymmetric() {
+ var err error
+ clientKey, err = oauth2.CreateJWTSigningKey(serverKey.SigningMethod().Alg(), []byte(form.ClientSecret))
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "Error creating signing key",
+ })
+ return
+ }
+ }
+
+ switch form.GrantType {
+ case "refresh_token":
+ handleRefreshToken(ctx, form, serverKey, clientKey)
+ case "authorization_code":
+ handleAuthorizationCode(ctx, form, serverKey, clientKey)
+ default:
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnsupportedGrantType,
+ ErrorDescription: "Only refresh_token or authorization_code grant type is supported",
+ })
+ }
+}
+
+func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidClient,
+ ErrorDescription: fmt.Sprintf("cannot load client with client id: %q", form.ClientID),
+ })
+ return
+ }
+ // "The authorization server MUST ... require client authentication for confidential clients"
+ // https://datatracker.ietf.org/doc/html/rfc6749#section-6
+ if app.ConfidentialClient && !app.ValidateClientSecret([]byte(form.ClientSecret)) {
+ errorDescription := "invalid client secret"
+ if form.ClientSecret == "" {
+ errorDescription = "invalid empty client secret"
+ }
+ // "invalid_client ... Client authentication failed"
+ // https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidClient,
+ ErrorDescription: errorDescription,
+ })
+ return
+ }
+
+ token, err := oauth2.ParseToken(form.RefreshToken, serverKey)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "unable to parse refresh token",
+ })
+ return
+ }
+ // get grant before increasing counter
+ grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
+ if err != nil || grant == nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidGrant,
+ ErrorDescription: "grant does not exist",
+ })
+ return
+ }
+
+ // check if token got already used
+ if setting.OAuth2.InvalidateRefreshTokens && (grant.Counter != token.Counter || token.Counter == 0) {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "token was already used",
+ })
+ log.Warn("A client tried to use a refresh token for grant_id = %d was used twice!", grant.ID)
+ return
+ }
+ accessToken, tokenErr := newAccessTokenResponse(ctx, grant, serverKey, clientKey)
+ if tokenErr != nil {
+ handleAccessTokenError(ctx, *tokenErr)
+ return
+ }
+ ctx.JSON(http.StatusOK, accessToken)
+}
+
+func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {
+ app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
+ if err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidClient,
+ ErrorDescription: fmt.Sprintf("cannot load client with client id: '%s'", form.ClientID),
+ })
+ return
+ }
+ if app.ConfidentialClient && !app.ValidateClientSecret([]byte(form.ClientSecret)) {
+ errorDescription := "invalid client secret"
+ if form.ClientSecret == "" {
+ errorDescription = "invalid empty client secret"
+ }
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: errorDescription,
+ })
+ return
+ }
+ if form.RedirectURI != "" && !app.ContainsRedirectURI(form.RedirectURI) {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "unexpected redirect URI",
+ })
+ return
+ }
+ authorizationCode, err := auth.GetOAuth2AuthorizationByCode(ctx, form.Code)
+ if err != nil || authorizationCode == nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "client is not authorized",
+ })
+ return
+ }
+ // check if code verifier authorizes the client, PKCE support
+ if !authorizationCode.ValidateCodeChallenge(form.CodeVerifier) {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
+ ErrorDescription: "failed PKCE code challenge",
+ })
+ return
+ }
+ // check if granted for this application
+ if authorizationCode.Grant.ApplicationID != app.ID {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidGrant,
+ ErrorDescription: "invalid grant",
+ })
+ return
+ }
+ // remove token from database to deny duplicate usage
+ if err := authorizationCode.Invalidate(ctx); err != nil {
+ handleAccessTokenError(ctx, AccessTokenError{
+ ErrorCode: AccessTokenErrorCodeInvalidRequest,
+ ErrorDescription: "cannot proceed your request",
+ })
+ }
+ resp, tokenErr := newAccessTokenResponse(ctx, authorizationCode.Grant, serverKey, clientKey)
+ if tokenErr != nil {
+ handleAccessTokenError(ctx, *tokenErr)
+ return
+ }
+ // send successful response
+ ctx.JSON(http.StatusOK, resp)
+}
+
+func handleAccessTokenError(ctx *context.Context, acErr AccessTokenError) {
+ ctx.JSON(http.StatusBadRequest, acErr)
+}
+
+func handleServerError(ctx *context.Context, state, redirectURI string, err error) {
+ log.Error("OAuth server error: %v", err)
+ handleAuthorizeError(ctx, AuthorizeError{
+ ErrorCode: ErrorCodeServerError,
+ ErrorDescription: "A server error occurred",
+ State: state,
+ }, redirectURI)
+}
+
+func handleAuthorizeError(ctx *context.Context, authErr AuthorizeError, redirectURI string) {
+ if redirectURI == "" {
+ log.Warn("Authorization failed: %v", authErr.ErrorDescription)
+ ctx.Data["Error"] = authErr
+ ctx.HTML(http.StatusBadRequest, tplGrantError)
+ return
+ }
+ redirect, err := url.Parse(redirectURI)
+ if err != nil {
+ ctx.ServerError("url.Parse", err)
+ return
+ }
+ q := redirect.Query()
+ q.Set("error", string(authErr.ErrorCode))
+ q.Set("error_description", authErr.ErrorDescription)
+ q.Set("state", authErr.State)
+ redirect.RawQuery = q.Encode()
+ ctx.Redirect(redirect.String(), http.StatusSeeOther)
+}
+
+// SignInOAuth handles the OAuth2 login buttons
+func SignInOAuth(ctx *context.Context) {
+ provider := ctx.Params(":provider")
+
+ authSource, err := auth.GetActiveOAuth2SourceByName(ctx, provider)
+ if err != nil {
+ ctx.ServerError("SignIn", err)
+ return
+ }
+
+ redirectTo := ctx.FormString("redirect_to")
+ if len(redirectTo) > 0 {
+ middleware.SetRedirectToCookie(ctx.Resp, redirectTo)
+ }
+
+ // try to do a direct callback flow, so we don't authenticate the user again but use the valid accesstoken to get the user
+ user, gothUser, err := oAuth2UserLoginCallback(ctx, authSource, ctx.Req, ctx.Resp)
+ if err == nil && user != nil {
+ // we got the user without going through the whole OAuth2 authentication flow again
+ handleOAuth2SignIn(ctx, authSource, user, gothUser)
+ return
+ }
+
+ codeChallenge, err := generateCodeChallenge(ctx, provider)
+ if err != nil {
+ ctx.ServerError("SignIn", fmt.Errorf("could not generate code_challenge: %w", err))
+ return
+ }
+
+ if err = authSource.Cfg.(*oauth2.Source).Callout(ctx.Req, ctx.Resp, codeChallenge); err != nil {
+ if strings.Contains(err.Error(), "no provider for ") {
+ if err = oauth2.ResetOAuth2(ctx); err != nil {
+ ctx.ServerError("SignIn", err)
+ return
+ }
+ if err = authSource.Cfg.(*oauth2.Source).Callout(ctx.Req, ctx.Resp, codeChallenge); err != nil {
+ ctx.ServerError("SignIn", err)
+ }
+ return
+ }
+ ctx.ServerError("SignIn", err)
+ }
+ // redirect is done in oauth2.Auth
+}
+
+// SignInOAuthCallback handles the callback from the given provider
+func SignInOAuthCallback(ctx *context.Context) {
+ provider := ctx.Params(":provider")
+
+ if ctx.Req.FormValue("error") != "" {
+ var errorKeyValues []string
+ for k, vv := range ctx.Req.Form {
+ for _, v := range vv {
+ errorKeyValues = append(errorKeyValues, fmt.Sprintf("%s = %s", html.EscapeString(k), html.EscapeString(v)))
+ }
+ }
+ sort.Strings(errorKeyValues)
+ ctx.Flash.Error(strings.Join(errorKeyValues, "
"), true)
+ }
+
+ // first look if the provider is still active
+ authSource, err := auth.GetActiveOAuth2SourceByName(ctx, provider)
+ if err != nil {
+ ctx.ServerError("SignIn", err)
+ return
+ }
+
+ if authSource == nil {
+ ctx.ServerError("SignIn", errors.New("no valid provider found, check configured callback url in provider"))
+ return
+ }
+
+ u, gothUser, err := oAuth2UserLoginCallback(ctx, authSource, ctx.Req, ctx.Resp)
+ if err != nil {
+ if user_model.IsErrUserProhibitLogin(err) {
+ uplerr := err.(user_model.ErrUserProhibitLogin)
+ log.Info("Failed authentication attempt for %s from %s: %v", uplerr.Name, ctx.RemoteAddr(), err)
+ ctx.Data["Title"] = ctx.Tr("auth.prohibit_login")
+ ctx.HTML(http.StatusOK, "user/auth/prohibit_login")
+ return
+ }
+ if callbackErr, ok := err.(errCallback); ok {
+ log.Info("Failed OAuth callback: (%v) %v", callbackErr.Code, callbackErr.Description)
+ switch callbackErr.Code {
+ case "access_denied":
+ ctx.Flash.Error(ctx.Tr("auth.oauth.signin.error.access_denied"))
+ case "temporarily_unavailable":
+ ctx.Flash.Error(ctx.Tr("auth.oauth.signin.error.temporarily_unavailable"))
+ default:
+ ctx.Flash.Error(ctx.Tr("auth.oauth.signin.error"))
+ }
+ ctx.Redirect(setting.AppSubURL + "/user/login")
+ return
+ }
+ if err, ok := err.(*go_oauth2.RetrieveError); ok {
+ ctx.Flash.Error("OAuth2 RetrieveError: "+err.Error(), true)
+ ctx.Redirect(setting.AppSubURL + "/user/login")
+ return
+ }
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+
+ if u == nil {
+ if ctx.Doer != nil {
+ // attach user to already logged in user
+ err = externalaccount.LinkAccountToUser(ctx, ctx.Doer, gothUser)
+ if err != nil {
+ ctx.ServerError("UserLinkAccount", err)
+ return
+ }
+
+ ctx.Redirect(setting.AppSubURL + "/user/settings/security")
+ return
+ } else if !setting.Service.AllowOnlyInternalRegistration && setting.OAuth2Client.EnableAutoRegistration {
+ // create new user with details from oauth2 provider
+ if gothUser.UserID == "" {
+ log.Error("OAuth2 Provider %s returned empty or missing field: UserID", authSource.Name)
+ if authSource.IsOAuth2() && authSource.Cfg.(*oauth2.Source).Provider == "openidConnect" {
+ log.Error("You may need to change the 'OPENID_CONNECT_SCOPES' setting to request all required fields")
+ }
+ err = fmt.Errorf("OAuth2 Provider %s returned empty or missing field: UserID", authSource.Name)
+ ctx.ServerError("CreateUser", err)
+ return
+ }
+ var missingFields []string
+ if gothUser.Email == "" {
+ missingFields = append(missingFields, "email")
+ }
+ if setting.OAuth2Client.Username == setting.OAuth2UsernameNickname && gothUser.NickName == "" {
+ missingFields = append(missingFields, "nickname")
+ }
+ if len(missingFields) > 0 {
+ // we don't have enough information to create an account automatically,
+ // so we prompt the user for the remaining bits
+ log.Trace("OAuth2 Provider %s returned empty or missing fields: %s, prompting the user for them", authSource.Name, missingFields)
+ showLinkingLogin(ctx, gothUser)
+ return
+ }
+ uname, err := getUserName(&gothUser)
+ if err != nil {
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+ u = &user_model.User{
+ Name: uname,
+ FullName: gothUser.Name,
+ Email: gothUser.Email,
+ LoginType: auth.OAuth2,
+ LoginSource: authSource.ID,
+ LoginName: gothUser.UserID,
+ }
+
+ overwriteDefault := &user_model.CreateUserOverwriteOptions{
+ IsActive: optional.Some(!setting.OAuth2Client.RegisterEmailConfirm && !setting.Service.RegisterManualConfirm),
+ }
+
+ source := authSource.Cfg.(*oauth2.Source)
+
+ isAdmin, isRestricted := getUserAdminAndRestrictedFromGroupClaims(source, &gothUser)
+ u.IsAdmin = isAdmin.ValueOrDefault(false)
+ u.IsRestricted = isRestricted.ValueOrDefault(setting.Service.DefaultUserIsRestricted)
+
+ if !createAndHandleCreatedUser(ctx, base.TplName(""), nil, u, overwriteDefault, &gothUser, setting.OAuth2Client.AccountLinking != setting.OAuth2AccountLinkingDisabled) {
+ // error already handled
+ return
+ }
+
+ if err := syncGroupsToTeams(ctx, source, &gothUser, u); err != nil {
+ ctx.ServerError("SyncGroupsToTeams", err)
+ return
+ }
+ } else {
+ // no existing user is found, request attach or new account
+ showLinkingLogin(ctx, gothUser)
+ return
+ }
+ }
+
+ handleOAuth2SignIn(ctx, authSource, u, gothUser)
+}
+
+func claimValueToStringSet(claimValue any) container.Set[string] {
+ var groups []string
+
+ switch rawGroup := claimValue.(type) {
+ case []string:
+ groups = rawGroup
+ case []any:
+ for _, group := range rawGroup {
+ groups = append(groups, fmt.Sprintf("%s", group))
+ }
+ default:
+ str := fmt.Sprintf("%s", rawGroup)
+ groups = strings.Split(str, ",")
+ }
+ return container.SetOf(groups...)
+}
+
+func syncGroupsToTeams(ctx *context.Context, source *oauth2.Source, gothUser *goth.User, u *user_model.User) error {
+ if source.GroupTeamMap != "" || source.GroupTeamMapRemoval {
+ groupTeamMapping, err := auth_module.UnmarshalGroupTeamMapping(source.GroupTeamMap)
+ if err != nil {
+ return err
+ }
+
+ groups := getClaimedGroups(source, gothUser)
+
+ if err := source_service.SyncGroupsToTeams(ctx, u, groups, groupTeamMapping, source.GroupTeamMapRemoval); err != nil {
+ return err
+ }
+ }
+
+ return nil
+}
+
+func getClaimedGroups(source *oauth2.Source, gothUser *goth.User) container.Set[string] {
+ groupClaims, has := gothUser.RawData[source.GroupClaimName]
+ if !has {
+ return nil
+ }
+
+ return claimValueToStringSet(groupClaims)
+}
+
+func getUserAdminAndRestrictedFromGroupClaims(source *oauth2.Source, gothUser *goth.User) (isAdmin, isRestricted optional.Option[bool]) {
+ groups := getClaimedGroups(source, gothUser)
+
+ if source.AdminGroup != "" {
+ isAdmin = optional.Some(groups.Contains(source.AdminGroup))
+ }
+ if source.RestrictedGroup != "" {
+ isRestricted = optional.Some(groups.Contains(source.RestrictedGroup))
+ }
+
+ return isAdmin, isRestricted
+}
+
+func showLinkingLogin(ctx *context.Context, gothUser goth.User) {
+ if err := updateSession(ctx, nil, map[string]any{
+ "linkAccountGothUser": gothUser,
+ }); err != nil {
+ ctx.ServerError("updateSession", err)
+ return
+ }
+ ctx.Redirect(setting.AppSubURL + "/user/link_account")
+}
+
+func updateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {
+ if setting.OAuth2Client.UpdateAvatar && len(url) > 0 {
+ resp, err := http.Get(url)
+ if err == nil {
+ defer func() {
+ _ = resp.Body.Close()
+ }()
+ }
+ // ignore any error
+ if err == nil && resp.StatusCode == http.StatusOK {
+ data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1))
+ if err == nil && int64(len(data)) <= setting.Avatar.MaxFileSize {
+ _ = user_service.UploadAvatar(ctx, u, data)
+ }
+ }
+ }
+}
+
+func getSSHKeys(source *oauth2.Source, gothUser *goth.User) ([]string, error) {
+ key := source.AttributeSSHPublicKey
+ value, exists := gothUser.RawData[key]
+ if !exists {
+ return []string{}, nil
+ }
+
+ rawSlice, ok := value.([]any)
+ if !ok {
+ return nil, fmt.Errorf("unexpected type for SSH public key, expected []interface{} but got %T", value)
+ }
+
+ sshKeys := make([]string, 0, len(rawSlice))
+ for i, v := range rawSlice {
+ str, ok := v.(string)
+ if !ok {
+ return nil, fmt.Errorf("unexpected element type at index %d in SSH public key array, expected string but got %T", i, v)
+ }
+ sshKeys = append(sshKeys, str)
+ }
+
+ return sshKeys, nil
+}
+
+func updateSSHPubIfNeed(
+ ctx *context.Context,
+ authSource *auth.Source,
+ fetchedUser *goth.User,
+ user *user_model.User,
+) error {
+ oauth2Source := authSource.Cfg.(*oauth2.Source)
+
+ if oauth2Source.ProvidesSSHKeys() {
+ sshKeys, err := getSSHKeys(oauth2Source, fetchedUser)
+ if err != nil {
+ return err
+ }
+
+ if asymkey_model.SynchronizePublicKeys(ctx, user, authSource, sshKeys) {
+ err = asymkey_model.RewriteAllPublicKeys(ctx)
+ if err != nil {
+ return err
+ }
+ }
+ }
+
+ return nil
+}
+
+func handleOAuth2SignIn(ctx *context.Context, source *auth.Source, u *user_model.User, gothUser goth.User) {
+ updateAvatarIfNeed(ctx, gothUser.AvatarURL, u)
+ err := updateSSHPubIfNeed(ctx, source, &gothUser, u)
+ if err != nil {
+ ctx.ServerError("updateSSHPubIfNeed", err)
+ return
+ }
+
+ needs2FA := false
+ if !source.Cfg.(*oauth2.Source).SkipLocalTwoFA {
+ needs2FA, err = auth.HasTwoFactorByUID(ctx, u.ID)
+ if err != nil {
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+ }
+
+ oauth2Source := source.Cfg.(*oauth2.Source)
+ groupTeamMapping, err := auth_module.UnmarshalGroupTeamMapping(oauth2Source.GroupTeamMap)
+ if err != nil {
+ ctx.ServerError("UnmarshalGroupTeamMapping", err)
+ return
+ }
+
+ groups := getClaimedGroups(oauth2Source, &gothUser)
+
+ // If this user is enrolled in 2FA and this source doesn't override it,
+ // we can't sign the user in just yet. Instead, redirect them to the 2FA authentication page.
+ if !needs2FA {
+ if err := updateSession(ctx, nil, map[string]any{
+ "uid": u.ID,
+ }); err != nil {
+ ctx.ServerError("updateSession", err)
+ return
+ }
+
+ // Clear whatever CSRF cookie has right now, force to generate a new one
+ ctx.Csrf.DeleteCookie(ctx)
+
+ opts := &user_service.UpdateOptions{
+ SetLastLogin: true,
+ }
+ opts.IsAdmin, opts.IsRestricted = getUserAdminAndRestrictedFromGroupClaims(oauth2Source, &gothUser)
+ if err := user_service.UpdateUser(ctx, u, opts); err != nil {
+ ctx.ServerError("UpdateUser", err)
+ return
+ }
+
+ if oauth2Source.GroupTeamMap != "" || oauth2Source.GroupTeamMapRemoval {
+ if err := source_service.SyncGroupsToTeams(ctx, u, groups, groupTeamMapping, oauth2Source.GroupTeamMapRemoval); err != nil {
+ ctx.ServerError("SyncGroupsToTeams", err)
+ return
+ }
+ }
+
+ // update external user information
+ if err := externalaccount.UpdateExternalUser(ctx, u, gothUser); err != nil {
+ if !errors.Is(err, util.ErrNotExist) {
+ log.Error("UpdateExternalUser failed: %v", err)
+ }
+ }
+
+ if err := resetLocale(ctx, u); err != nil {
+ ctx.ServerError("resetLocale", err)
+ return
+ }
+
+ if redirectTo := ctx.GetSiteCookie("redirect_to"); len(redirectTo) > 0 {
+ middleware.DeleteRedirectToCookie(ctx.Resp)
+ ctx.RedirectToFirst(redirectTo)
+ return
+ }
+
+ ctx.Redirect(setting.AppSubURL + "/")
+ return
+ }
+
+ opts := &user_service.UpdateOptions{}
+ opts.IsAdmin, opts.IsRestricted = getUserAdminAndRestrictedFromGroupClaims(oauth2Source, &gothUser)
+ if opts.IsAdmin.Has() || opts.IsRestricted.Has() {
+ if err := user_service.UpdateUser(ctx, u, opts); err != nil {
+ ctx.ServerError("UpdateUser", err)
+ return
+ }
+ }
+
+ if oauth2Source.GroupTeamMap != "" || oauth2Source.GroupTeamMapRemoval {
+ if err := source_service.SyncGroupsToTeams(ctx, u, groups, groupTeamMapping, oauth2Source.GroupTeamMapRemoval); err != nil {
+ ctx.ServerError("SyncGroupsToTeams", err)
+ return
+ }
+ }
+
+ if err := updateSession(ctx, nil, map[string]any{
+ // User needs to use 2FA, save data and redirect to 2FA page.
+ "twofaUid": u.ID,
+ "twofaRemember": false,
+ }); err != nil {
+ ctx.ServerError("updateSession", err)
+ return
+ }
+
+ // If WebAuthn is enrolled -> Redirect to WebAuthn instead
+ regs, err := auth.GetWebAuthnCredentialsByUID(ctx, u.ID)
+ if err == nil && len(regs) > 0 {
+ ctx.Redirect(setting.AppSubURL + "/user/webauthn")
+ return
+ }
+
+ ctx.Redirect(setting.AppSubURL + "/user/two_factor")
+}
+
+// generateCodeChallenge stores a code verifier in the session and returns a S256 code challenge for PKCE
+func generateCodeChallenge(ctx *context.Context, provider string) (codeChallenge string, err error) {
+ // the `code_verifier` is only forwarded by specific providers
+ // https://codeberg.org/forgejo/forgejo/issues/4033
+ p, ok := goth.GetProviders()[provider]
+ if !ok {
+ return "", nil
+ }
+ switch p.(type) {
+ default:
+ return "", nil
+ case *openidConnect.Provider, *fitbit.Provider, *zoom.Provider:
+ // those providers forward the `code_verifier`
+ // a code_challenge can be generated
+ }
+
+ codeVerifier, err := util.CryptoRandomString(43) // 256/log2(62) = 256 bits of entropy (each char having log2(62) of randomness)
+ if err != nil {
+ return "", err
+ }
+ if err = ctx.Session.Set("CodeVerifier", codeVerifier); err != nil {
+ return "", err
+ }
+ return encodeCodeChallenge(codeVerifier)
+}
+
+func encodeCodeChallenge(codeVerifier string) (string, error) {
+ hasher := sha256.New()
+ _, err := io.WriteString(hasher, codeVerifier)
+ codeChallenge := base64.RawURLEncoding.EncodeToString(hasher.Sum(nil))
+ return codeChallenge, err
+}
+
+// OAuth2UserLoginCallback attempts to handle the callback from the OAuth2 provider and if successful
+// login the user
+func oAuth2UserLoginCallback(ctx *context.Context, authSource *auth.Source, request *http.Request, response http.ResponseWriter) (*user_model.User, goth.User, error) {
+ gothUser, err := oAuth2FetchUser(ctx, authSource, request, response)
+ if err != nil {
+ return nil, goth.User{}, err
+ }
+
+ if _, _, err := remote_service.MaybePromoteRemoteUser(ctx, authSource, gothUser.UserID, gothUser.Email); err != nil {
+ return nil, goth.User{}, err
+ }
+
+ u, err := oAuth2GothUserToUser(request.Context(), authSource, gothUser)
+ return u, gothUser, err
+}
+
+func oAuth2FetchUser(ctx *context.Context, authSource *auth.Source, request *http.Request, response http.ResponseWriter) (goth.User, error) {
+ oauth2Source := authSource.Cfg.(*oauth2.Source)
+
+ // Make sure that the response is not an error response.
+ errorName := request.FormValue("error")
+
+ if len(errorName) > 0 {
+ errorDescription := request.FormValue("error_description")
+
+ // Delete the goth session
+ err := gothic.Logout(response, request)
+ if err != nil {
+ return goth.User{}, err
+ }
+
+ return goth.User{}, errCallback{
+ Code: errorName,
+ Description: errorDescription,
+ }
+ }
+
+ // Proceed to authenticate through goth.
+ codeVerifier, _ := ctx.Session.Get("CodeVerifier").(string)
+ _ = ctx.Session.Delete("CodeVerifier")
+ gothUser, err := oauth2Source.Callback(request, response, codeVerifier)
+ if err != nil {
+ if err.Error() == "securecookie: the value is too long" || strings.Contains(err.Error(), "Data too long") {
+ log.Error("OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider", authSource.Name, setting.OAuth2.MaxTokenLength)
+ err = fmt.Errorf("OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider", authSource.Name, setting.OAuth2.MaxTokenLength)
+ }
+ return goth.User{}, err
+ }
+
+ if oauth2Source.RequiredClaimValues != nil {
+ if oauth2Source.Provider != "openidConnect" || !oauth2.MatchRequiredClaimValues(gothUser.RawData, oauth2Source.RequiredClaimName, oauth2Source.RequiredClaimValue, oauth2Source.RequiredClaimValues) {
+ return goth.User{}, user_model.ErrUserProhibitLogin{Name: gothUser.UserID}
+ }
+ } else if oauth2Source.RequiredClaimName != "" {
+ claimInterface, has := gothUser.RawData[oauth2Source.RequiredClaimName]
+ if !has {
+ return goth.User{}, user_model.ErrUserProhibitLogin{Name: gothUser.UserID}
+ }
+
+ if oauth2Source.RequiredClaimValue != "" {
+ groups := claimValueToStringSet(claimInterface)
+
+ if !groups.Contains(oauth2Source.RequiredClaimValue) {
+ return goth.User{}, user_model.ErrUserProhibitLogin{Name: gothUser.UserID}
+ }
+ }
+ }
+
+ return gothUser, nil
+}
+
+func oAuth2GothUserToUser(ctx go_context.Context, authSource *auth.Source, gothUser goth.User) (*user_model.User, error) {
+ user := &user_model.User{
+ LoginName: gothUser.UserID,
+ LoginType: auth.OAuth2,
+ LoginSource: authSource.ID,
+ }
+
+ hasUser, err := user_model.GetUser(ctx, user)
+ if err != nil {
+ return nil, err
+ }
+
+ if hasUser {
+ return user, nil
+ }
+ log.Debug("no user found for LoginName %v, LoginSource %v, LoginType %v", user.LoginName, user.LoginSource, user.LoginType)
+
+ // search in external linked users
+ externalLoginUser := &user_model.ExternalLoginUser{
+ ExternalID: gothUser.UserID,
+ LoginSourceID: authSource.ID,
+ }
+ hasUser, err = user_model.GetExternalLogin(ctx, externalLoginUser)
+ if err != nil {
+ return nil, err
+ }
+ if hasUser {
+ user, err = user_model.GetUserByID(ctx, externalLoginUser.UserID)
+ return user, err
+ }
+
+ // no user found to login
+ return nil, nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/services/auth/source/oauth2/source_callout.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/services/auth/source/oauth2/source_callout.go
new file mode 100644
index 00000000..f95a80fc
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/services/auth/source/oauth2/source_callout.go
@@ -0,0 +1,68 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package oauth2
+
+import (
+ "net/http"
+ "net/url"
+
+ "github.com/markbates/goth"
+ "github.com/markbates/goth/gothic"
+)
+
+// Callout redirects request/response pair to authenticate against the provider
+func (source *Source) Callout(request *http.Request, response http.ResponseWriter, codeChallengeS256 string) error {
+ // not sure if goth is thread safe (?) when using multiple providers
+ request.Header.Set(ProviderHeaderKey, source.authSource.Name)
+
+ var querySuffix string
+ if codeChallengeS256 != "" {
+ querySuffix = "&" + url.Values{
+ "code_challenge_method": []string{"S256"},
+ "code_challenge": []string{codeChallengeS256},
+ }.Encode()
+ }
+
+ // don't use the default gothic begin handler to prevent issues when some error occurs
+ // normally the gothic library will write some custom stuff to the response instead of our own nice error page
+ // gothic.BeginAuthHandler(response, request)
+
+ gothRWMutex.RLock()
+ defer gothRWMutex.RUnlock()
+
+ url, err := gothic.GetAuthURL(response, request)
+ if err == nil {
+ // hacky way to set the code_challenge, but no better way until
+ // https://github.com/markbates/goth/issues/516 is resolved
+ http.Redirect(response, request, url+querySuffix, http.StatusTemporaryRedirect)
+ }
+ return err
+}
+
+// Callback handles OAuth callback, resolve to a goth user and send back to original url
+// this will trigger a new authentication request, but because we save it in the session we can use that
+func (source *Source) Callback(request *http.Request, response http.ResponseWriter, codeVerifier string) (goth.User, error) {
+ // not sure if goth is thread safe (?) when using multiple providers
+ request.Header.Set(ProviderHeaderKey, source.authSource.Name)
+
+ if codeVerifier != "" {
+ // hacky way to set the code_verifier...
+ // Will be picked up inside CompleteUserAuth: params := req.URL.Query()
+ // https://github.com/markbates/goth/pull/474/files
+ request = request.Clone(request.Context())
+ q := request.URL.Query()
+ q.Add("code_verifier", codeVerifier)
+ request.URL.RawQuery = q.Encode()
+ }
+
+ gothRWMutex.RLock()
+ defer gothRWMutex.RUnlock()
+
+ user, err := gothic.CompleteUserAuth(response, request)
+ if err != nil {
+ return user, err
+ }
+
+ return user, nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/prepare_forgejo.py b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/prepare_forgejo.py
new file mode 100644
index 00000000..53e078d9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/prepare_forgejo.py
@@ -0,0 +1,69 @@
+"""Reconstruct the complete pinned consumer with all reviewed source candidates."""
+from pathlib import Path
+import hashlib
+import json
+import shutil
+import subprocess
+import tarfile
+
+HERE = Path(__file__).resolve().parent
+BASE = HERE.parent
+INPUTS = Path('/tmp/custodian-forgejo-successor')
+WORK = Path('/tmp/custodian-forgejo-successor-attempt2')
+WORK.mkdir(exist_ok=False)
+SOURCE = WORK / 'source'
+assert not SOURCE.exists()
+for name, pin in [('forgejo-v11.0.3.tar.gz', '1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c'),
+ ('go1.24.3.tar.gz', '3333f6ea53afa971e9078895eaa4ac7204a8c6b5c68c10e6bc9a33e8e391bdd8')]:
+ assert hashlib.sha256((INPUTS / name).read_bytes()).hexdigest() == pin, name
+ with tarfile.open(INPUTS / name) as archive:
+ archive.extractall(WORK, filter='data')
+(WORK / 'forgejo').rename(SOURCE)
+# The interrupted packet's context snapshots are empty, but its frozen patch
+# and inventory retain the exact source. Recover only if both hashes match.
+operation = BASE / 'apps-operation-backend-r1'
+row = next(row for row in json.loads((operation / 'source-inventory.json').read_text())['paths'] if row['path'] == 'models/db/context.go')
+target = SOURCE / row['path']
+assert hashlib.sha256(target.read_bytes()).hexdigest() == row['before_sha256']
+original_context = target.read_bytes()
+patch = (operation / 'forgejo-operation-source.patch').read_text()
+start = patch.index('--- a/models/db/context.go\n')
+end = patch.index('--- /dev/null\n', start)
+subprocess.run(['patch', '--fuzz=0', '-p1'], input=patch[start:end], text=True, cwd=SOURCE, check=True, capture_output=True)
+assert hashlib.sha256(target.read_bytes()).hexdigest() == row['after_sha256']
+recovered = HERE / 'recovered-source/models/db/context.go'
+recovered.parent.mkdir(parents=True, exist_ok=True)
+recovered.write_bytes(target.read_bytes())
+target.write_bytes(original_context)
+applied = []
+for packet, before, after in [
+ (BASE / 'forgejo-required-claim-values-r1', 'preimages', 'postimages'),
+ (BASE / 'forgejo-private-input-r1', 'preimages/forgejo', 'postimages/forgejo'),
+ (BASE / 'forgejo-private-input-r1', 'preimages/shared', 'postimages/shared'),
+ (BASE / 'apps-operation-backend-r1', 'preimages', 'postimages'),
+ (HERE, 'preimages/forgejo', 'forgejo-source'),
+]:
+ for item in (packet / after).rglob('*'):
+ if not item.is_file():
+ continue
+ name = item.relative_to(packet / after)
+ target = SOURCE / name
+ original = packet / before / name
+ if packet == operation and str(name) == 'models/db/context.go':
+ item = recovered
+ assert hashlib.sha256(target.read_bytes()).hexdigest() == row['before_sha256']
+ original = target
+ if original.exists() and target.exists() and original.read_bytes() != target.read_bytes():
+ # Shared SQL redaction was already composed from the same source.
+ identical_shared = name.as_posix().startswith('models/db/') and item.read_bytes() == target.read_bytes()
+ expanded_hook_test = (packet == operation and str(name) == 'models/db/sensitive_sql_test.go'
+ and hashlib.sha256(target.read_bytes()).hexdigest() == 'f0f74c09a9e96a6529db7b9ce459a2ea37e204de38c5ad01855b80c9a992a769'
+ and hashlib.sha256(item.read_bytes()).hexdigest() == 'de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b')
+ assert identical_shared or expanded_hook_test, str(name)
+ target.parent.mkdir(parents=True, exist_ok=True)
+ shutil.copyfile(item, target)
+ applied.append({'packet': packet.name, 'path': str(name), 'sha256': hashlib.sha256(item.read_bytes()).hexdigest()})
+shutil.copytree(HERE / 'access-engine-source/adapters/go/decisionpep', SOURCE / 'third_party/access-engine-pep')
+(WORK / 'home').mkdir()
+(HERE / 'consumer-reconstruction.json').write_text(json.dumps({'workspace': str(WORK), 'inputs_verified': True, 'paths': applied}, indent=2) + '\n')
+print(json.dumps({'workspace': str(WORK), 'composed_paths': len(applied)}))
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-result.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-result.json
new file mode 100644
index 00000000..f434bfde
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-result.json
@@ -0,0 +1,102 @@
+{
+ "target": "producer-all",
+ "source_revision": "d328a2601095686f74376d87791bff01e2a3a2a3",
+ "returncode": 1,
+ "seconds": 169.79,
+ "argv": [
+ "bwrap",
+ "--unshare-net",
+ "--unshare-pid",
+ "--die-with-parent",
+ "--new-session",
+ "--ro-bind",
+ "/usr",
+ "/usr",
+ "--ro-bind",
+ "/lib",
+ "/lib",
+ "--ro-bind",
+ "/lib64",
+ "/lib64",
+ "--symlink",
+ "usr/bin",
+ "/bin",
+ "--proc",
+ "/proc",
+ "--dev",
+ "/dev",
+ "--tmpfs",
+ "/tmp",
+ "--bind",
+ "/tmp/custodian-resume-producer-all-i56scyc5",
+ "/work",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+ "/toolchain",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod",
+ "/modules",
+ "--chdir",
+ "/work/source",
+ "--clearenv",
+ "--setenv",
+ "PATH",
+ "/toolchain/bin:/usr/bin:/bin",
+ "--setenv",
+ "HOME",
+ "/work/home",
+ "--setenv",
+ "GOTOOLCHAIN",
+ "local",
+ "--setenv",
+ "GOPROXY",
+ "off",
+ "--setenv",
+ "GOSUMDB",
+ "off",
+ "--setenv",
+ "GOMODCACHE",
+ "/modules",
+ "--setenv",
+ "GOCACHE",
+ "/work/gocache",
+ "--setenv",
+ "GOMAXPROCS",
+ "4",
+ "--setenv",
+ "CGO_ENABLED",
+ "0",
+ "--",
+ "go",
+ "test",
+ "-p",
+ "4",
+ "-json",
+ "./...",
+ "-count=1"
+ ],
+ "workspace": "/tmp/custodian-resume-producer-all-i56scyc5",
+ "network": "disabled",
+ "pid_namespace": "private",
+ "real_credentials": false,
+ "canonical_owner_modified": false,
+ "candidate_files": {
+ "adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
+ "adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
+ "adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
+ "adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
+ "adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
+ "adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
+ "adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
+ "adapters/go/decisionpep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee",
+ "adapters/go/decisionpep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa",
+ "adapters/go/decisionpep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29",
+ "cmd/access-engine/forgejo_application_profile_test.go": "bb42f6695fa353fe36ebbdb05d9d12462b2a29fec54b5fd5dc7b1e07d357d225",
+ "cmd/access-engine/main.go": "e4b6ad3b3dd4bb72e9a908fa7eb1296c8202ae92b81922c640c632415dbd6445",
+ "examples/forgejo-application-access/policy.md": "1ad11259f7ea8aae160f2542d88719cdb247037a2754c339c3a83e807953fa31",
+ "examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
+ "examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
+ "internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d",
+ "internal/decision/json_profile.go": "430d2c89f47d218ec843af76a9766b42e9d938a15063fc8e979f14c56306f4bc"
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-test-attempt2.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-test-attempt2.jsonl
new file mode 100644
index 00000000..16d4cace
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-test-attempt2.jsonl
@@ -0,0 +1,2081 @@
+{"Time":"2026-10-17T23:01:31.549789722Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"}
+{"Time":"2026-10-17T23:01:31.69979329Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration"}
+{"Time":"2026-10-17T23:01:31.699864346Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Output":"=== RUN TestEnvelopeSigningStartupConfiguration\n"}
+{"Time":"2026-10-17T23:01:31.875891159Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Output":"--- PASS: TestEnvelopeSigningStartupConfiguration (0.18s)\n"}
+{"Time":"2026-10-17T23:01:31.875975335Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Elapsed":0.18}
+{"Time":"2026-10-17T23:01:31.87600355Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"}
+{"Time":"2026-10-17T23:01:31.876014307Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"}
+{"Time":"2026-10-17T23:01:32.192819316Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins"}
+{"Time":"2026-10-17T23:01:32.192905792Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins\n"}
+{"Time":"2026-10-17T23:01:32.353379321Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins (0.16s)\n"}
+{"Time":"2026-10-17T23:01:32.35345604Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Elapsed":0.16}
+{"Time":"2026-10-17T23:01:32.353478646Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners"}
+{"Time":"2026-10-17T23:01:32.353489151Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners\n"}
+{"Time":"2026-10-17T23:01:32.481088783Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners (0.12s)\n"}
+{"Time":"2026-10-17T23:01:32.481198667Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Elapsed":0.12}
+{"Time":"2026-10-17T23:01:32.481232734Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers"}
+{"Time":"2026-10-17T23:01:32.481245376Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers\n"}
+{"Time":"2026-10-17T23:01:32.483060494Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/flex-auth"}
+{"Time":"2026-10-17T23:01:32.499854215Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement"}
+{"Time":"2026-10-17T23:01:32.499949022Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Output":"=== RUN TestRetiredBinaryNamesReplacement\n"}
+{"Time":"2026-10-17T23:01:32.504781831Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters"}
+{"Time":"2026-10-17T23:01:32.504886783Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters","Output":"? \tgithub.com/netkingdom/access-engine/internal/adapters\t[no test files]\n"}
+{"Time":"2026-10-17T23:01:32.50491718Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/adapters","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.504999814Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/directory"}
+{"Time":"2026-10-17T23:01:32.537327046Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage"}
+{"Time":"2026-10-17T23:01:32.537416813Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Output":"=== RUN TestGraphResolverDetectsTokenOverage\n"}
+{"Time":"2026-10-17T23:01:32.537846196Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Output":"--- PASS: TestGraphResolverDetectsTokenOverage (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.537866557Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.537881697Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance"}
+{"Time":"2026-10-17T23:01:32.537892509Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Output":"=== RUN TestSCIMResolverCarriesDescriptorProvenance\n"}
+{"Time":"2026-10-17T23:01:32.537906179Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Output":"--- PASS: TestSCIMResolverCarriesDescriptorProvenance (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.537928109Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.537942383Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim"}
+{"Time":"2026-10-17T23:01:32.537952023Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Output":"=== RUN TestLDAPResolverUsesDistinguishedNameClaim\n"}
+{"Time":"2026-10-17T23:01:32.537965332Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Output":"--- PASS: TestLDAPResolverUsesDistinguishedNameClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.53798499Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.53800224Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject"}
+{"Time":"2026-10-17T23:01:32.538015522Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Output":"=== RUN TestMergeResultsAndApplyToSubject\n"}
+{"Time":"2026-10-17T23:01:32.538038723Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Output":"--- PASS: TestMergeResultsAndApplyToSubject (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.538075766Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.538087723Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:32.544144691Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/directory\t0.039s\n"}
+{"Time":"2026-10-17T23:01:32.544233691Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Elapsed":0.039}
+{"Time":"2026-10-17T23:01:32.546018632Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Output":"--- PASS: TestRetiredBinaryNamesReplacement (0.05s)\n"}
+{"Time":"2026-10-17T23:01:32.546083971Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:32.546100905Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:32.546658054Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/flex-auth\t0.063s\n"}
+{"Time":"2026-10-17T23:01:32.54672085Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Elapsed":0.064}
+{"Time":"2026-10-17T23:01:32.547118691Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak"}
+{"Time":"2026-10-17T23:01:32.55614256Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship"}
+{"Time":"2026-10-17T23:01:32.579831628Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape"}
+{"Time":"2026-10-17T23:01:32.57990869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Output":"=== RUN TestBuildAuthorizationRequestUsesUMAPermissionShape\n"}
+{"Time":"2026-10-17T23:01:32.580002442Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Output":"--- PASS: TestBuildAuthorizationRequestUsesUMAPermissionShape (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.580015508Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.580031892Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest"}
+{"Time":"2026-10-17T23:01:32.580041306Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Output":"=== RUN TestResourceRegistrationsFromManifest\n"}
+{"Time":"2026-10-17T23:01:32.580055382Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Output":"--- PASS: TestResourceRegistrationsFromManifest (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.58006595Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.580076888Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow"}
+{"Time":"2026-10-17T23:01:32.580087303Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Output":"=== RUN TestAdapterCheckWrapsKeycloakAllow\n"}
+{"Time":"2026-10-17T23:01:32.580122191Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Output":"--- PASS: TestAdapterCheckWrapsKeycloakAllow (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.580134788Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.580144969Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak"}
+{"Time":"2026-10-17T23:01:32.58015367Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Output":"=== RUN TestAdapterFailsClosedOnUnavailableKeycloak\n"}
+{"Time":"2026-10-17T23:01:32.580165257Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Output":"--- PASS: TestAdapterFailsClosedOnUnavailableKeycloak (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.580176421Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.580186024Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient"}
+{"Time":"2026-10-17T23:01:32.580194636Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Output":"=== RUN TestRegisterResourceManifestDelegatesToClient\n"}
+{"Time":"2026-10-17T23:01:32.580206087Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Output":"--- PASS: TestRegisterResourceManifestDelegatesToClient (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.58021607Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.58022542Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:32.580264465Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers (0.11s)\n"}
+{"Time":"2026-10-17T23:01:32.580277955Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Elapsed":0.11}
+{"Time":"2026-10-17T23:01:32.580291454Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action"}
+{"Time":"2026-10-17T23:01:32.580305304Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action\n"}
+{"Time":"2026-10-17T23:01:32.600484844Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry"}
+{"Time":"2026-10-17T23:01:32.600561969Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Output":"=== RUN TestSnapshotToTuplesMapsCanonicalRegistry\n"}
+{"Time":"2026-10-17T23:01:32.603949028Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/keycloak\t0.057s\n"}
+{"Time":"2026-10-17T23:01:32.604074286Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Elapsed":0.057}
+{"Time":"2026-10-17T23:01:32.61790542Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Output":"--- PASS: TestSnapshotToTuplesMapsCanonicalRegistry (0.01s)\n"}
+{"Time":"2026-10-17T23:01:32.618313298Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/rule"}
+{"Time":"2026-10-17T23:01:32.633956958Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action (0.05s)\n"}
+{"Time":"2026-10-17T23:01:32.634031332Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:32.634053632Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant"}
+{"Time":"2026-10-17T23:01:32.634065345Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant\n"}
+{"Time":"2026-10-17T23:01:32.638877152Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:32.638950895Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple"}
+{"Time":"2026-10-17T23:01:32.638965683Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Output":"=== RUN TestAdapterCheckPreservesCARINGFromMatchedTuple\n"}
+{"Time":"2026-10-17T23:01:32.638985512Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Output":"--- PASS: TestAdapterCheckPreservesCARINGFromMatchedTuple (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.638997586Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.639014773Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend"}
+{"Time":"2026-10-17T23:01:32.639023817Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Output":"=== RUN TestAdapterCheckFailsClosedOnStaleBackend\n"}
+{"Time":"2026-10-17T23:01:32.639037073Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Output":"--- PASS: TestAdapterCheckFailsClosedOnStaleBackend (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.63904829Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.639058958Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder"}
+{"Time":"2026-10-17T23:01:32.639075216Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Output":"=== RUN TestBatchCheckPreservesBackendOrder\n"}
+{"Time":"2026-10-17T23:01:32.639088273Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Output":"--- PASS: TestBatchCheckPreservesBackendOrder (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.639122448Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.639135802Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults"}
+{"Time":"2026-10-17T23:01:32.639145036Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Output":"=== RUN TestListAllowedReturnsEnvelopeResults\n"}
+{"Time":"2026-10-17T23:01:32.63915766Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Output":"--- PASS: TestListAllowedReturnsEnvelopeResults (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.639168075Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.639180348Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples"}
+{"Time":"2026-10-17T23:01:32.63918914Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Output":"=== RUN TestImportTuplesDelegatesSnapshotTuples\n"}
+{"Time":"2026-10-17T23:01:32.639201123Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Output":"--- PASS: TestImportTuplesDelegatesSnapshotTuples (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.639211647Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.6392207Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:32.643020618Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/relationship\t0.087s\n"}
+{"Time":"2026-10-17T23:01:32.643108283Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Elapsed":0.087}
+{"Time":"2026-10-17T23:01:32.646189477Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz"}
+{"Time":"2026-10-17T23:01:32.710454792Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry"}
+{"Time":"2026-10-17T23:01:32.710525496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Output":"=== RUN TestSnapshotToDirectoryMapsCanonicalRegistry\n"}
+{"Time":"2026-10-17T23:01:32.728312624Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Output":"--- PASS: TestSnapshotToDirectoryMapsCanonicalRegistry (0.02s)\n"}
+{"Time":"2026-10-17T23:01:32.728852469Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:32.729105294Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope"}
+{"Time":"2026-10-17T23:01:32.729138388Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Output":"=== RUN TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope\n"}
+{"Time":"2026-10-17T23:01:32.730156345Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Output":"--- PASS: TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.730398909Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.736525693Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz"}
+{"Time":"2026-10-17T23:01:32.7366027Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Output":"=== RUN TestAdapterCheckFailsClosedOnUnavailableTopaz\n"}
+{"Time":"2026-10-17T23:01:32.736637462Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Output":"--- PASS: TestAdapterCheckFailsClosedOnUnavailableTopaz (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.736653097Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.736666668Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations"}
+{"Time":"2026-10-17T23:01:32.736675136Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Output":"=== RUN TestImportDirectoryWritesObjectsAndRelations\n"}
+{"Time":"2026-10-17T23:01:32.737351159Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Output":"--- PASS: TestImportDirectoryWritesObjectsAndRelations (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.737686005Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.73772092Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle"}
+{"Time":"2026-10-17T23:01:32.737730514Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Output":"=== RUN TestImportPolicyWritesTopazBundle\n"}
+{"Time":"2026-10-17T23:01:32.765227591Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant (0.13s)\n"}
+{"Time":"2026-10-17T23:01:32.765391128Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Elapsed":0.13}
+{"Time":"2026-10-17T23:01:32.765415394Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance"}
+{"Time":"2026-10-17T23:01:32.765426674Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance\n"}
+{"Time":"2026-10-17T23:01:32.81082119Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Output":"--- PASS: TestImportPolicyWritesTopazBundle (0.07s)\n"}
+{"Time":"2026-10-17T23:01:32.81090827Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:32.810959867Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape"}
+{"Time":"2026-10-17T23:01:32.810978947Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Output":"=== RUN TestHTTPClientUsesTopazDirectoryRESTShape\n"}
+{"Time":"2026-10-17T23:01:32.83298062Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck"}
+{"Time":"2026-10-17T23:01:32.833062911Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Output":"=== RUN TestCanonicalInputFromCheck\n"}
+{"Time":"2026-10-17T23:01:32.839773368Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Output":"--- PASS: TestCanonicalInputFromCheck (0.01s)\n"}
+{"Time":"2026-10-17T23:01:32.839864821Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:32.839911359Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures"}
+{"Time":"2026-10-17T23:01:32.839923235Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Output":"=== RUN TestPolicyArtifactFromPackagePreservesRegoAndFixtures\n"}
+{"Time":"2026-10-17T23:01:32.867710905Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance (0.10s)\n"}
+{"Time":"2026-10-17T23:01:32.867798454Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Elapsed":0.1}
+{"Time":"2026-10-17T23:01:32.867820429Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource"}
+{"Time":"2026-10-17T23:01:32.867832927Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource\n"}
+{"Time":"2026-10-17T23:01:32.879623492Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Output":"--- PASS: TestHTTPClientUsesTopazDirectoryRESTShape (0.06s)\n"}
+{"Time":"2026-10-17T23:01:32.879738768Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Elapsed":0.06}
+{"Time":"2026-10-17T23:01:32.879757813Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample"}
+{"Time":"2026-10-17T23:01:32.879767975Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":"=== RUN TestTopazDockerComposeExample\n"}
+{"Time":"2026-10-17T23:01:32.879929465Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":" integration_test.go:17: set ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 to run the examples/topaz docker-compose integration\n"}
+{"Time":"2026-10-17T23:01:32.879957022Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":"--- SKIP: TestTopazDockerComposeExample (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.879999214Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.880013416Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:32.909338882Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/topaz\t0.263s\n"}
+{"Time":"2026-10-17T23:01:32.909599525Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Elapsed":0.263}
+{"Time":"2026-10-17T23:01:32.945941219Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Output":"--- PASS: TestPolicyArtifactFromPackagePreservesRegoAndFixtures (0.11s)\n"}
+{"Time":"2026-10-17T23:01:32.946020255Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Elapsed":0.11}
+{"Time":"2026-10-17T23:01:32.955576259Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/audit"}
+{"Time":"2026-10-17T23:01:32.962075442Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult"}
+{"Time":"2026-10-17T23:01:32.962143576Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Output":"=== RUN TestAdapterCheckWrapsRuleResult\n"}
+{"Time":"2026-10-17T23:01:32.962167039Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Output":"--- PASS: TestAdapterCheckWrapsRuleResult (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.962178311Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.962191133Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy"}
+{"Time":"2026-10-17T23:01:32.962200069Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Output":"=== RUN TestAdapterFailsClosedOnStalePolicy\n"}
+{"Time":"2026-10-17T23:01:32.962212982Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Output":"--- PASS: TestAdapterFailsClosedOnStalePolicy (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.962224064Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.962233171Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder"}
+{"Time":"2026-10-17T23:01:32.962241548Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Output":"=== RUN TestBatchCheckPreservesOrder\n"}
+{"Time":"2026-10-17T23:01:32.962253109Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Output":"--- PASS: TestBatchCheckPreservesOrder (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.962263046Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.962272252Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations"}
+{"Time":"2026-10-17T23:01:32.962280368Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Output":"=== RUN TestEvaluateFixturesComparesExpectations\n"}
+{"Time":"2026-10-17T23:01:32.962318096Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Output":"--- PASS: TestEvaluateFixturesComparesExpectations (0.00s)\n"}
+{"Time":"2026-10-17T23:01:32.962330459Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Elapsed":0}
+{"Time":"2026-10-17T23:01:32.962344544Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact"}
+{"Time":"2026-10-17T23:01:32.962353092Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Output":"=== RUN TestImportPolicyDelegatesArtifact\n"}
+{"Time":"2026-10-17T23:01:32.983395344Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource (0.12s)\n"}
+{"Time":"2026-10-17T23:01:32.983469465Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Elapsed":0.12}
+{"Time":"2026-10-17T23:01:32.983489781Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut"}
+{"Time":"2026-10-17T23:01:32.983509538Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut\n"}
+{"Time":"2026-10-17T23:01:32.990851322Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions"}
+{"Time":"2026-10-17T23:01:32.990916661Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Output":"=== RUN TestJSONLDecisionLogRoundTripsDecisions\n"}
+{"Time":"2026-10-17T23:01:33.001465725Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Output":"--- PASS: TestJSONLDecisionLogRoundTripsDecisions (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.001707549Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.00185912Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:33.011564004Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Output":"ok \tgithub.com/netkingdom/access-engine/internal/audit\t0.044s\n"}
+{"Time":"2026-10-17T23:01:33.011922737Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/audit","Elapsed":0.056}
+{"Time":"2026-10-17T23:01:33.012588144Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Output":"--- PASS: TestImportPolicyDelegatesArtifact (0.05s)\n"}
+{"Time":"2026-10-17T23:01:33.013575668Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:33.013735697Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:33.046531865Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/callerauth"}
+{"Time":"2026-10-17T23:01:33.057730669Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut (0.08s)\n"}
+{"Time":"2026-10-17T23:01:33.058799953Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Elapsed":0.08}
+{"Time":"2026-10-17T23:01:33.0707545Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/rule\t0.452s\n"}
+{"Time":"2026-10-17T23:01:33.070840587Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Elapsed":0.453}
+{"Time":"2026-10-17T23:01:33.089471184Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding"}
+{"Time":"2026-10-17T23:01:33.089543593Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Output":"=== RUN TestAuthenticatorEnforcesAudienceAndSystemBinding\n"}
+{"Time":"2026-10-17T23:01:33.089624477Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Output":"--- PASS: TestAuthenticatorEnforcesAudienceAndSystemBinding (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.089642404Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.089663775Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure"}
+{"Time":"2026-10-17T23:01:33.089674812Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Output":"=== RUN TestAuthenticatorRejectsMissingTokenAndReviewerFailure\n"}
+{"Time":"2026-10-17T23:01:33.089703694Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider"}
+{"Time":"2026-10-17T23:01:33.089721557Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/outsider\n"}
+{"Time":"2026-10-17T23:01:33.09580137Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Output":"--- PASS: TestAuthenticatorRejectsMissingTokenAndReviewerFailure (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.095869838Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.095885483Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure"}
+{"Time":"2026-10-17T23:01:33.095895303Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Output":"=== RUN TestAuthenticatorWarnModePermitsButRecordsFailure\n"}
+{"Time":"2026-10-17T23:01:33.097855571Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Output":"--- PASS: TestAuthenticatorWarnModePermitsButRecordsFailure (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.103845081Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.103928527Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal"}
+{"Time":"2026-10-17T23:01:33.103940935Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Output":"=== RUN TestAuthenticatorWarnModeKeepsObservedPrincipal\n"}
+{"Time":"2026-10-17T23:01:33.103981954Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Output":"--- PASS: TestAuthenticatorWarnModeKeepsObservedPrincipal (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.103994948Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104004885Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence"}
+{"Time":"2026-10-17T23:01:33.104014101Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Output":"=== RUN TestDisabledRecordStatesAbsence\n"}
+{"Time":"2026-10-17T23:01:33.104026012Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Output":"--- PASS: TestDisabledRecordStatesAbsence (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104036788Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104052505Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary"}
+{"Time":"2026-10-17T23:01:33.104061234Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Output":"=== RUN TestOpenRouterNativeCallerBoundary\n"}
+{"Time":"2026-10-17T23:01:33.104071432Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller"}
+{"Time":"2026-10-17T23:01:33.10408164Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Output":"=== RUN TestOpenRouterNativeCallerBoundary/native_lifecycle_caller\n"}
+{"Time":"2026-10-17T23:01:33.104094002Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/native_lifecycle_caller (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104118755Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104133741Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system"}
+{"Time":"2026-10-17T23:01:33.104142948Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_own_system\n"}
+{"Time":"2026-10-17T23:01:33.104155193Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_own_system (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104165608Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104175645Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner"}
+{"Time":"2026-10-17T23:01:33.104184418Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner\n"}
+{"Time":"2026-10-17T23:01:33.104210983Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104222579Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104232751Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine"}
+{"Time":"2026-10-17T23:01:33.104249018Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine\n"}
+{"Time":"2026-10-17T23:01:33.104261399Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104312229Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104337567Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller"}
+{"Time":"2026-10-17T23:01:33.10434736Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Output":"=== RUN TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller\n"}
+{"Time":"2026-10-17T23:01:33.104360922Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104372221Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104381815Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner"}
+{"Time":"2026-10-17T23:01:33.104390517Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner\n"}
+{"Time":"2026-10-17T23:01:33.104406847Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104418668Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104429092Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner"}
+{"Time":"2026-10-17T23:01:33.104453385Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner\n"}
+{"Time":"2026-10-17T23:01:33.104465874Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104475982Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104487109Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Output":"--- PASS: TestOpenRouterNativeCallerBoundary (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104497155Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104507227Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding"}
+{"Time":"2026-10-17T23:01:33.104516614Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding\n"}
+{"Time":"2026-10-17T23:01:33.104526533Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden"}
+{"Time":"2026-10-17T23:01:33.104535216Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/ops-warden\n"}
+{"Time":"2026-10-17T23:01:33.104547092Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/ops-warden (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.104557273Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.104567201Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch"}
+{"Time":"2026-10-17T23:01:33.104576786Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch\n"}
+{"Time":"2026-10-17T23:01:33.107900941Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.108128022Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.10816419Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine"}
+{"Time":"2026-10-17T23:01:33.10817419Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/secrets-engine\n"}
+{"Time":"2026-10-17T23:01:33.109294529Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/secrets-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.109383764Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.109410437Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine"}
+{"Time":"2026-10-17T23:01:33.109421718Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/user-engine\n"}
+{"Time":"2026-10-17T23:01:33.111400336Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/user-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.111465919Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.1114815Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine"}
+{"Time":"2026-10-17T23:01:33.111491356Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/tenant-engine\n"}
+{"Time":"2026-10-17T23:01:33.127948402Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/outsider (0.05s)\n"}
+{"Time":"2026-10-17T23:01:33.128216079Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:33.12836655Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups"}
+{"Time":"2026-10-17T23:01:33.128388228Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups\n"}
+{"Time":"2026-10-17T23:01:33.136241934Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/tenant-engine (0.02s)\n"}
+{"Time":"2026-10-17T23:01:33.137112567Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:33.137144145Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle"}
+{"Time":"2026-10-17T23:01:33.137154885Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle\n"}
+{"Time":"2026-10-17T23:01:33.137364022Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.137400091Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.137437062Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting"}
+{"Time":"2026-10-17T23:01:33.138131544Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting\n"}
+{"Time":"2026-10-17T23:01:33.139513488Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.153317249Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.153389278Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03"}
+{"Time":"2026-10-17T23:01:33.153402146Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03\n"}
+{"Time":"2026-10-17T23:01:33.15341918Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.153430253Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.154751478Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback"}
+{"Time":"2026-10-17T23:01:33.154801587Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/application-readback\n"}
+{"Time":"2026-10-17T23:01:33.16082232Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/application-readback (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.160883664Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.160899859Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding (0.06s)\n"}
+{"Time":"2026-10-17T23:01:33.160910382Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Elapsed":0.06}
+{"Time":"2026-10-17T23:01:33.160920211Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience"}
+{"Time":"2026-10-17T23:01:33.160928119Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience\n"}
+{"Time":"2026-10-17T23:01:33.160937669Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth"}
+{"Time":"2026-10-17T23:01:33.160964098Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth\n"}
+{"Time":"2026-10-17T23:01:33.168687537Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups (0.04s)\n"}
+{"Time":"2026-10-17T23:01:33.169134603Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:33.169193432Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer"}
+{"Time":"2026-10-17T23:01:33.169204793Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer\n"}
+{"Time":"2026-10-17T23:01:33.196275513Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth (0.04s)\n"}
+{"Time":"2026-10-17T23:01:33.19699325Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:33.197045063Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine"}
+{"Time":"2026-10-17T23:01:33.197061376Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine\n"}
+{"Time":"2026-10-17T23:01:33.210563431Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.210637625Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.21066308Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign"}
+{"Time":"2026-10-17T23:01:33.21067364Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign\n"}
+{"Time":"2026-10-17T23:01:33.231914411Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer (0.06s)\n"}
+{"Time":"2026-10-17T23:01:33.232044602Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Elapsed":0.06}
+{"Time":"2026-10-17T23:01:33.232070346Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer"}
+{"Time":"2026-10-17T23:01:33.232103746Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer\n"}
+{"Time":"2026-10-17T23:01:33.231914044Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign (0.02s)\n"}
+{"Time":"2026-10-17T23:01:33.232133692Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:33.232147462Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp"}
+{"Time":"2026-10-17T23:01:33.232157922Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp\n"}
+{"Time":"2026-10-17T23:01:33.234739392Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.234796507Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.23481034Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/"}
+{"Time":"2026-10-17T23:01:33.234820295Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/\n"}
+{"Time":"2026-10-17T23:01:33.249159713Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/ (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.249231202Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.249251716Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth"}
+{"Time":"2026-10-17T23:01:33.249261897Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth\n"}
+{"Time":"2026-10-17T23:01:33.252879355Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.253183552Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.253209342Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine"}
+{"Time":"2026-10-17T23:01:33.253385899Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine\n"}
+{"Time":"2026-10-17T23:01:33.269081321Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer (0.04s)\n"}
+{"Time":"2026-10-17T23:01:33.269167309Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:33.26927768Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.269339683Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.269363308Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign"}
+{"Time":"2026-10-17T23:01:33.269416185Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign\n"}
+{"Time":"2026-10-17T23:01:33.274194044Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.276679814Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.27675444Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp"}
+{"Time":"2026-10-17T23:01:33.276767425Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp\n"}
+{"Time":"2026-10-17T23:01:33.284195755Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.284976992Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.28512336Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/"}
+{"Time":"2026-10-17T23:01:33.285142945Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/\n"}
+{"Time":"2026-10-17T23:01:33.299820771Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/ (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.299916201Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.299940511Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth"}
+{"Time":"2026-10-17T23:01:33.29995107Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth\n"}
+{"Time":"2026-10-17T23:01:33.304124226Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.304592799Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.326927234Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine"}
+{"Time":"2026-10-17T23:01:33.327007253Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine\n"}
+{"Time":"2026-10-17T23:01:33.335478301Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine (0.03s)\n"}
+{"Time":"2026-10-17T23:01:33.33593012Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:33.349367476Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign"}
+{"Time":"2026-10-17T23:01:33.349434988Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign\n"}
+{"Time":"2026-10-17T23:01:33.356585116Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy (1.48s)\n"}
+{"Time":"2026-10-17T23:01:33.356596656Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.35666528Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":1.48}
+{"Time":"2026-10-17T23:01:33.356676765Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.356684369Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion"}
+{"Time":"2026-10-17T23:01:33.3566914Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp"}
+{"Time":"2026-10-17T23:01:33.356761293Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp\n"}
+{"Time":"2026-10-17T23:01:33.356694694Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Output":"=== RUN TestRunVersion\n"}
+{"Time":"2026-10-17T23:01:33.3568016Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Output":"--- PASS: TestRunVersion (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.356846893Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.356860771Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy"}
+{"Time":"2026-10-17T23:01:33.356869815Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Output":"=== RUN TestRunTestPolicy\n"}
+{"Time":"2026-10-17T23:01:33.36223775Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.362646952Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.362855666Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/"}
+{"Time":"2026-10-17T23:01:33.362883574Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/\n"}
+{"Time":"2026-10-17T23:01:33.367399998Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/ (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.368645334Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.368701124Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience (0.21s)\n"}
+{"Time":"2026-10-17T23:01:33.368720069Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Elapsed":0.21}
+{"Time":"2026-10-17T23:01:33.36873364Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact"}
+{"Time":"2026-10-17T23:01:33.368743306Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Output":"=== RUN TestRuntimeRenameCustomAudienceAndInputBindingsStayExact\n"}
+{"Time":"2026-10-17T23:01:33.368756336Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Output":"--- PASS: TestRuntimeRenameCustomAudienceAndInputBindingsStayExact (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.368768582Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.368800422Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated"}
+{"Time":"2026-10-17T23:01:33.368812198Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Output":"=== RUN TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated\n"}
+{"Time":"2026-10-17T23:01:33.379866834Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Output":"--- PASS: TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated (0.01s)\n"}
+{"Time":"2026-10-17T23:01:33.380153177Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:33.381771259Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry"}
+{"Time":"2026-10-17T23:01:33.381825489Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Output":"=== RUN TestKubernetesTokenReviewerCapturesTokenExpiry\n"}
+{"Time":"2026-10-17T23:01:33.384468949Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Output":"--- PASS: TestKubernetesTokenReviewerCapturesTokenExpiry (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.385369286Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.385430855Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim"}
+{"Time":"2026-10-17T23:01:33.385447898Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Output":"=== RUN TestTokenExpiryReadsJWTClaim\n"}
+{"Time":"2026-10-17T23:01:33.385476879Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Output":"--- PASS: TestTokenExpiryReadsJWTClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:01:33.385489954Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Elapsed":0}
+{"Time":"2026-10-17T23:01:33.385500604Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:33.392581762Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Output":"ok \tgithub.com/netkingdom/access-engine/internal/callerauth\t0.346s\n"}
+{"Time":"2026-10-17T23:01:33.392725235Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Elapsed":0.346}
+{"Time":"2026-10-17T23:01:33.430002759Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Output":"--- PASS: TestRunTestPolicy (0.07s)\n"}
+{"Time":"2026-10-17T23:01:33.43051575Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:33.430785952Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck"}
+{"Time":"2026-10-17T23:01:33.430817287Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Output":"=== RUN TestRunCheck\n"}
+{"Time":"2026-10-17T23:01:33.530566921Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Output":"--- PASS: TestRunCheck (0.09s)\n"}
+{"Time":"2026-10-17T23:01:33.539942714Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Elapsed":0.09}
+{"Time":"2026-10-17T23:01:33.539991587Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck"}
+{"Time":"2026-10-17T23:01:33.540002976Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Output":"=== RUN TestRunBatchCheck\n"}
+{"Time":"2026-10-17T23:01:33.639062087Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Output":"--- PASS: TestRunBatchCheck (0.12s)\n"}
+{"Time":"2026-10-17T23:01:33.639221251Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Elapsed":0.12}
+{"Time":"2026-10-17T23:01:33.639243316Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden"}
+{"Time":"2026-10-17T23:01:33.639254065Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Output":"=== RUN TestRunCheckOpsWarden\n"}
+{"Time":"2026-10-17T23:01:34.854452297Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Output":"--- PASS: TestRunCheckOpsWarden (1.21s)\n"}
+{"Time":"2026-10-17T23:01:34.854524732Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Elapsed":1.21}
+{"Time":"2026-10-17T23:01:34.854543993Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract"}
+{"Time":"2026-10-17T23:01:34.854554507Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Output":"=== RUN TestRunRailiancePlatformCredentialGrantContract\n"}
+{"Time":"2026-10-17T23:01:35.075776894Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/decision"}
+{"Time":"2026-10-17T23:01:35.178817897Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect"}
+{"Time":"2026-10-17T23:01:35.178882298Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Output":"=== RUN TestRequiredCommitForEveryEffect\n"}
+{"Time":"2026-10-17T23:01:35.181240489Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow"}
+{"Time":"2026-10-17T23:01:35.181296126Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Output":"=== RUN TestRequiredCommitForEveryEffect/allow\n"}
+{"Time":"2026-10-17T23:01:35.181428363Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Output":"--- PASS: TestRequiredCommitForEveryEffect/allow (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.181466921Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.181479509Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny"}
+{"Time":"2026-10-17T23:01:35.182900015Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Output":"=== RUN TestRequiredCommitForEveryEffect/deny\n"}
+{"Time":"2026-10-17T23:01:35.182935714Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Output":"--- PASS: TestRequiredCommitForEveryEffect/deny (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.182969871Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.182983731Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact"}
+{"Time":"2026-10-17T23:01:35.18299255Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Output":"=== RUN TestRequiredCommitForEveryEffect/redact\n"}
+{"Time":"2026-10-17T23:01:35.183004741Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Output":"--- PASS: TestRequiredCommitForEveryEffect/redact (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.183058953Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.183073903Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only"}
+{"Time":"2026-10-17T23:01:35.183082858Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Output":"=== RUN TestRequiredCommitForEveryEffect/audit_only\n"}
+{"Time":"2026-10-17T23:01:35.18310045Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Output":"--- PASS: TestRequiredCommitForEveryEffect/audit_only (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.183111235Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.183121181Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable"}
+{"Time":"2026-10-17T23:01:35.183129901Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Output":"=== RUN TestRequiredCommitForEveryEffect/not_applicable\n"}
+{"Time":"2026-10-17T23:01:35.183141244Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Output":"--- PASS: TestRequiredCommitForEveryEffect/not_applicable (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.183152074Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.183163814Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Output":"--- PASS: TestRequiredCommitForEveryEffect (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.18841629Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.188486687Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime"}
+{"Time":"2026-10-17T23:01:35.18850006Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Output":"=== RUN TestTrustedTaskWholeOperationLifetime\n"}
+{"Time":"2026-10-17T23:01:35.188514469Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict"}
+{"Time":"2026-10-17T23:01:35.188524974Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/old-15s-conflict\n"}
+{"Time":"2026-10-17T23:01:35.188565444Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/old-15s-conflict (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.188578086Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.188589105Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve"}
+{"Time":"2026-10-17T23:01:35.188597671Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve\n"}
+{"Time":"2026-10-17T23:01:35.188611161Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.188622261Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.188843058Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup"}
+{"Time":"2026-10-17T23:01:35.188892283Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup\n"}
+{"Time":"2026-10-17T23:01:35.189408088Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.189528811Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.189641697Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation"}
+{"Time":"2026-10-17T23:01:35.189678596Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/expired-operation\n"}
+{"Time":"2026-10-17T23:01:35.189906949Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/expired-operation (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.191008893Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.191058839Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum"}
+{"Time":"2026-10-17T23:01:35.191070039Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/source-hard-maximum\n"}
+{"Time":"2026-10-17T23:01:35.191464083Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/source-hard-maximum (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.191523651Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.191539332Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass"}
+{"Time":"2026-10-17T23:01:35.191548485Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass\n"}
+{"Time":"2026-10-17T23:01:35.195921278Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.195997419Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.196016085Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact"}
+{"Time":"2026-10-17T23:01:35.196027384Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact\n"}
+{"Time":"2026-10-17T23:01:35.196053858Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.196067817Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.196079296Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit"}
+{"Time":"2026-10-17T23:01:35.196089323Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit\n"}
+{"Time":"2026-10-17T23:01:35.196103597Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.196115834Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.196137078Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl"}
+{"Time":"2026-10-17T23:01:35.196147088Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl\n"}
+{"Time":"2026-10-17T23:01:35.196161777Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl (0.00s)\n"}
+{"Time":"2026-10-17T23:01:35.196174211Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Elapsed":0}
+{"Time":"2026-10-17T23:01:35.196211299Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime (0.01s)\n"}
+{"Time":"2026-10-17T23:01:35.196226367Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:35.1962424Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash"}
+{"Time":"2026-10-17T23:01:35.196253058Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Output":"=== RUN TestAttributeContextCarriedWithoutViewHash\n"}
+{"Time":"2026-10-17T23:01:35.532676368Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Output":"--- PASS: TestRunRailiancePlatformCredentialGrantContract (0.68s)\n"}
+{"Time":"2026-10-17T23:01:35.532828245Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Elapsed":0.68}
+{"Time":"2026-10-17T23:01:35.532852321Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract"}
+{"Time":"2026-10-17T23:01:35.53286289Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Output":"=== RUN TestServeOpsWardenCheckContract\n"}
+{"Time":"2026-10-17T23:01:36.545589027Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Output":"--- PASS: TestServeOpsWardenCheckContract (1.01s)\n"}
+{"Time":"2026-10-17T23:01:36.545657711Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Elapsed":1.01}
+{"Time":"2026-10-17T23:01:36.545679506Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal"}
+{"Time":"2026-10-17T23:01:36.545689344Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Output":"=== RUN TestServeCallerAuthenticationBindsSystemToPrincipal\n"}
+{"Time":"2026-10-17T23:01:36.955502114Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/emission"}
+{"Time":"2026-10-17T23:01:36.980710014Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/layer"}
+{"Time":"2026-10-17T23:01:36.982825063Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild"}
+{"Time":"2026-10-17T23:01:36.982877354Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Output":"=== RUN TestOutboxLockChild\n"}
+{"Time":"2026-10-17T23:01:36.983304347Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Output":"--- PASS: TestOutboxLockChild (0.00s)\n"}
+{"Time":"2026-10-17T23:01:36.983478759Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Elapsed":0}
+{"Time":"2026-10-17T23:01:36.983601845Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease"}
+{"Time":"2026-10-17T23:01:36.983621601Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Output":"=== RUN TestActualProcessWriterExclusionAndCrashRelease\n"}
+{"Time":"2026-10-17T23:01:36.999839802Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms"}
+{"Time":"2026-10-17T23:01:36.999953951Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Output":"=== RUN TestLayerDeclarationConforms\n"}
+{"Time":"2026-10-17T23:01:37.05739515Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Output":"--- PASS: TestLayerDeclarationConforms (0.05s)\n"}
+{"Time":"2026-10-17T23:01:37.057664974Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:37.057898006Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass"}
+{"Time":"2026-10-17T23:01:37.057945617Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Output":"=== RUN TestEmissionInventoryIsPerEventClass\n"}
+{"Time":"2026-10-17T23:01:37.062998073Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Output":"--- PASS: TestEmissionInventoryIsPerEventClass (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073179744Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073341514Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected"}
+{"Time":"2026-10-17T23:01:37.073353029Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Output":"=== RUN TestVersionPinInDeclarationIsRejected\n"}
+{"Time":"2026-10-17T23:01:37.073369972Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Output":"--- PASS: TestVersionPinInDeclarationIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073380369Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.07338981Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected"}
+{"Time":"2026-10-17T23:01:37.073399062Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Output":"=== RUN TestEngineWithoutRoleIsRejected\n"}
+{"Time":"2026-10-17T23:01:37.073410595Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Output":"--- PASS: TestEngineWithoutRoleIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073421145Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073429783Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected"}
+{"Time":"2026-10-17T23:01:37.073437493Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Output":"=== RUN TestUnknownLayerIsRejected\n"}
+{"Time":"2026-10-17T23:01:37.073453905Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Output":"--- PASS: TestUnknownLayerIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073462976Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073471542Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy"}
+{"Time":"2026-10-17T23:01:37.073480199Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Output":"=== RUN TestVocabularyHasFourTokensIncludingTaxonomy\n"}
+{"Time":"2026-10-17T23:01:37.073512634Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Output":"--- PASS: TestVocabularyHasFourTokensIncludingTaxonomy (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073522932Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073533329Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase"}
+{"Time":"2026-10-17T23:01:37.073542337Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Output":"=== RUN TestVocabularyComparisonFoldsCase\n"}
+{"Time":"2026-10-17T23:01:37.073552427Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Output":"--- PASS: TestVocabularyComparisonFoldsCase (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073561787Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073570678Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken"}
+{"Time":"2026-10-17T23:01:37.073627856Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Output":"=== RUN TestPluralEnginesIsNotTheToken\n"}
+{"Time":"2026-10-17T23:01:37.073653141Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Output":"--- PASS: TestPluralEnginesIsNotTheToken (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073663961Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073674007Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected"}
+{"Time":"2026-10-17T23:01:37.073682312Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Output":"=== RUN TestEvidenceSourceWithoutEmissionGuaranteeIsRejected\n"}
+{"Time":"2026-10-17T23:01:37.073694701Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Output":"--- PASS: TestEvidenceSourceWithoutEmissionGuaranteeIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073704359Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073714747Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound"}
+{"Time":"2026-10-17T23:01:37.073723169Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Output":"=== RUN TestVersionAnywhereInDeclarationIsFound\n"}
+{"Time":"2026-10-17T23:01:37.07373334Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Output":"--- PASS: TestVersionAnywhereInDeclarationIsFound (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073746541Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073755423Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach"}
+{"Time":"2026-10-17T23:01:37.073779238Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Output":"=== RUN TestVersionPinsLeavesWhatA12DoesNotReach\n"}
+{"Time":"2026-10-17T23:01:37.073789644Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Output":"--- PASS: TestVersionPinsLeavesWhatA12DoesNotReach (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073798688Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073807381Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps"}
+{"Time":"2026-10-17T23:01:37.07381528Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Output":"=== RUN TestCheckRejectsVersionedStandardPathButNotStanceMaps\n"}
+{"Time":"2026-10-17T23:01:37.073834442Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Output":"--- PASS: TestCheckRejectsVersionedStandardPathButNotStanceMaps (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.073843991Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.073853206Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere"}
+{"Time":"2026-10-17T23:01:37.073861629Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Output":"=== RUN TestOwnDeclarationCarriesNoVersionAnywhere\n"}
+{"Time":"2026-10-17T23:01:37.084274488Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Output":"--- PASS: TestOwnDeclarationCarriesNoVersionAnywhere (0.01s)\n"}
+{"Time":"2026-10-17T23:01:37.087813235Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:37.087882731Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance"}
+{"Time":"2026-10-17T23:01:37.087895869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance\n"}
+{"Time":"2026-10-17T23:01:37.087911262Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees"}
+{"Time":"2026-10-17T23:01:37.087927511Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees\n"}
+{"Time":"2026-10-17T23:01:37.087950496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.087986871Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.087999135Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding"}
+{"Time":"2026-10-17T23:01:37.088007918Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding\n"}
+{"Time":"2026-10-17T23:01:37.088037278Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.088048144Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.088057711Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance"}
+{"Time":"2026-10-17T23:01:37.088065628Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance\n"}
+{"Time":"2026-10-17T23:01:37.129967762Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Output":"--- PASS: TestActualProcessWriterExclusionAndCrashRelease (0.12s)\n"}
+{"Time":"2026-10-17T23:01:37.130054671Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Elapsed":0.12}
+{"Time":"2026-10-17T23:01:37.130072561Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries"}
+{"Time":"2026-10-17T23:01:37.130082101Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Output":"=== RUN TestExactCapacityBatchEntryAndRestartBoundaries\n"}
+{"Time":"2026-10-17T23:01:37.129981118Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance (0.01s)\n"}
+{"Time":"2026-10-17T23:01:37.130119523Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:37.130137792Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source"}
+{"Time":"2026-10-17T23:01:37.130156466Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source\n"}
+{"Time":"2026-10-17T23:01:37.130175439Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.130239903Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.13025791Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused"}
+{"Time":"2026-10-17T23:01:37.13026718Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused\n"}
+{"Time":"2026-10-17T23:01:37.130304025Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.130317713Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.130328209Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance (0.02s)\n"}
+{"Time":"2026-10-17T23:01:37.130337298Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:37.130348137Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut"}
+{"Time":"2026-10-17T23:01:37.13035774Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Output":"=== RUN TestValidatedAgainstAcceptedCut\n"}
+{"Time":"2026-10-17T23:01:37.130368796Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Output":"--- PASS: TestValidatedAgainstAcceptedCut (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.130379228Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.130389571Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo"}
+{"Time":"2026-10-17T23:01:37.130397858Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Output":"=== RUN TestSurveyDetectsFormsDisagreeingWithinOneRepo\n"}
+{"Time":"2026-10-17T23:01:37.130408147Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Output":"--- PASS: TestSurveyDetectsFormsDisagreeingWithinOneRepo (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.130418336Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.130427958Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017"}
+{"Time":"2026-10-17T23:01:37.130436957Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Output":"=== RUN TestSurveyFoldsCaseAfterGHDEC017\n"}
+{"Time":"2026-10-17T23:01:37.130780615Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Output":"--- PASS: TestSurveyFoldsCaseAfterGHDEC017 (0.03s)\n"}
+{"Time":"2026-10-17T23:01:37.1308214Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:37.130846431Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement"}
+{"Time":"2026-10-17T23:01:37.130856558Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Output":"=== RUN TestSpellingDisagreementIsReportedButIsNotALayerDisagreement\n"}
+{"Time":"2026-10-17T23:01:37.132367894Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Output":"--- PASS: TestSpellingDisagreementIsReportedButIsNotALayerDisagreement (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.132452809Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.132470546Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope"}
+{"Time":"2026-10-17T23:01:37.132480294Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Output":"=== RUN TestTaxonomyVolunteerIsInVocabularyAndOutOfScope\n"}
+{"Time":"2026-10-17T23:01:37.134575055Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Output":"--- PASS: TestTaxonomyVolunteerIsInVocabularyAndOutOfScope (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.134651287Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.134667374Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope"}
+{"Time":"2026-10-17T23:01:37.134676238Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Output":"=== RUN TestRunStatesItsScope\n"}
+{"Time":"2026-10-17T23:01:37.134687698Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Output":"--- PASS: TestRunStatesItsScope (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.134696707Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.134706797Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration"}
+{"Time":"2026-10-17T23:01:37.134715048Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Output":"=== RUN TestSurveyReportsMissingDeclaration\n"}
+{"Time":"2026-10-17T23:01:37.134725868Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Output":"--- PASS: TestSurveyReportsMissingDeclaration (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.134735355Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.134753137Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement"}
+{"Time":"2026-10-17T23:01:37.134761658Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Output":"=== RUN TestSurveySingleFormIsNotDisagreement\n"}
+{"Time":"2026-10-17T23:01:37.134779548Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Output":"--- PASS: TestSurveySingleFormIsNotDisagreement (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.134795806Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.134806447Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed"}
+{"Time":"2026-10-17T23:01:37.134814616Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Output":"=== RUN TestPeerWithForeignFieldShapesIsStillSurveyed\n"}
+{"Time":"2026-10-17T23:01:37.13557826Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Output":"--- PASS: TestPeerWithForeignFieldShapesIsStillSurveyed (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.135669668Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.135770535Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration"}
+{"Time":"2026-10-17T23:01:37.135781067Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Output":"=== RUN TestSurveyFindsVersionInPeerDeclaration\n"}
+{"Time":"2026-10-17T23:01:37.16116388Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Output":"--- PASS: TestSurveyFindsVersionInPeerDeclaration (0.02s)\n"}
+{"Time":"2026-10-17T23:01:37.161320717Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:37.161348166Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:37.172121517Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Output":"ok \tgithub.com/netkingdom/access-engine/internal/layer\t0.191s\n"}
+{"Time":"2026-10-17T23:01:37.172197533Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Elapsed":0.192}
+{"Time":"2026-10-17T23:01:37.288706811Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Output":"--- PASS: TestExactCapacityBatchEntryAndRestartBoundaries (0.19s)\n"}
+{"Time":"2026-10-17T23:01:37.289437713Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Elapsed":0.19}
+{"Time":"2026-10-17T23:01:37.28952858Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence"}
+{"Time":"2026-10-17T23:01:37.28954142Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence\n"}
+{"Time":"2026-10-17T23:01:37.341386381Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file"}
+{"Time":"2026-10-17T23:01:37.341471297Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/file\n"}
+{"Time":"2026-10-17T23:01:37.341505833Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/file (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.34152503Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.341540125Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line"}
+{"Time":"2026-10-17T23:01:37.341549828Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/line\n"}
+{"Time":"2026-10-17T23:01:37.467997204Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/line (0.13s)\n"}
+{"Time":"2026-10-17T23:01:37.471835729Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Elapsed":0.13}
+{"Time":"2026-10-17T23:01:37.471964126Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn"}
+{"Time":"2026-10-17T23:01:37.47198317Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn\n"}
+{"Time":"2026-10-17T23:01:37.551094972Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Output":"--- PASS: TestServeCallerAuthenticationBindsSystemToPrincipal (1.00s)\n"}
+{"Time":"2026-10-17T23:01:37.551161988Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Elapsed":1}
+{"Time":"2026-10-17T23:01:37.551206074Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction"}
+{"Time":"2026-10-17T23:01:37.551219563Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Output":"=== RUN TestRunLoadRegistryOpsWardenProduction\n"}
+{"Time":"2026-10-17T23:01:37.551094934Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn (0.08s)\n"}
+{"Time":"2026-10-17T23:01:37.551248509Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Elapsed":0.08}
+{"Time":"2026-10-17T23:01:37.551535933Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt"}
+{"Time":"2026-10-17T23:01:37.551930745Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt\n"}
+{"Time":"2026-10-17T23:01:37.551739279Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Output":"--- PASS: TestRunLoadRegistryOpsWardenProduction (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.552554315Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.55269153Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors"}
+{"Time":"2026-10-17T23:01:37.552719889Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Output":"=== RUN TestOpsWardenProductionRegistryActors\n"}
+{"Time":"2026-10-17T23:01:37.563854065Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.563927709Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.56396541Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence (0.27s)\n"}
+{"Time":"2026-10-17T23:01:37.563980153Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Elapsed":0.27}
+{"Time":"2026-10-17T23:01:37.563993652Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback"}
+{"Time":"2026-10-17T23:01:37.564003039Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback\n"}
+{"Time":"2026-10-17T23:01:37.564013436Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full"}
+{"Time":"2026-10-17T23:01:37.564022679Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full\n"}
+{"Time":"2026-10-17T23:01:37.564035303Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.564051182Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.564061895Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null"}
+{"Time":"2026-10-17T23:01:37.564071399Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null\n"}
+{"Time":"2026-10-17T23:01:37.564083112Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.564093428Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.564105196Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.564116188Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.564126107Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases"}
+{"Time":"2026-10-17T23:01:37.564135052Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases\n"}
+{"Time":"2026-10-17T23:01:37.564145133Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink"}
+{"Time":"2026-10-17T23:01:37.56416828Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink\n"}
+{"Time":"2026-10-17T23:01:37.566120839Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.586021791Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.586089565Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable"}
+{"Time":"2026-10-17T23:01:37.586102406Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable\n"}
+{"Time":"2026-10-17T23:01:37.586124336Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.586139647Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.586153993Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink"}
+{"Time":"2026-10-17T23:01:37.586167763Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink\n"}
+{"Time":"2026-10-17T23:01:37.597995408Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink (0.02s)\n"}
+{"Time":"2026-10-17T23:01:37.598067682Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:37.603778846Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases (0.04s)\n"}
+{"Time":"2026-10-17T23:01:37.603847612Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:37.603865899Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion"}
+{"Time":"2026-10-17T23:01:37.603875647Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Output":"=== RUN TestPVCFSGroupPermissionWideningRetainsWriterExclusion\n"}
+{"Time":"2026-10-17T23:01:37.603890435Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Output":"--- PASS: TestPVCFSGroupPermissionWideningRetainsWriterExclusion (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.603925873Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.603937875Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs"}
+{"Time":"2026-10-17T23:01:37.603955458Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs\n"}
+{"Time":"2026-10-17T23:01:37.603967569Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink"}
+{"Time":"2026-10-17T23:01:37.603976351Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink\n"}
+{"Time":"2026-10-17T23:01:37.603988939Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.603999913Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.604010157Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink"}
+{"Time":"2026-10-17T23:01:37.604018723Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink\n"}
+{"Time":"2026-10-17T23:01:37.636667998Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink (0.01s)\n"}
+{"Time":"2026-10-17T23:01:37.636742697Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:37.636767269Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo"}
+{"Time":"2026-10-17T23:01:37.636777683Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo\n"}
+{"Time":"2026-10-17T23:01:37.638514621Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo (0.02s)\n"}
+{"Time":"2026-10-17T23:01:37.638606354Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:37.638707419Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink"}
+{"Time":"2026-10-17T23:01:37.638723632Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink\n"}
+{"Time":"2026-10-17T23:01:37.640204515Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.640513149Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.640554944Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink"}
+{"Time":"2026-10-17T23:01:37.640580012Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink\n"}
+{"Time":"2026-10-17T23:01:37.64061058Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.64063545Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.640650427Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo"}
+{"Time":"2026-10-17T23:01:37.640659715Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo\n"}
+{"Time":"2026-10-17T23:01:37.642233556Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo (0.00s)\n"}
+{"Time":"2026-10-17T23:01:37.642470259Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Elapsed":0}
+{"Time":"2026-10-17T23:01:37.642583056Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs (0.04s)\n"}
+{"Time":"2026-10-17T23:01:37.644084395Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:37.644159915Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature"}
+{"Time":"2026-10-17T23:01:37.644309682Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Output":"=== RUN TestOutboxReplayPreservesProducerNumericSignature\n"}
+{"Time":"2026-10-17T23:01:37.687846694Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Output":"--- PASS: TestOutboxReplayPreservesProducerNumericSignature (0.04s)\n"}
+{"Time":"2026-10-17T23:01:37.687926551Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:37.687945821Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart"}
+{"Time":"2026-10-17T23:01:37.687956786Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Output":"=== RUN TestHeartbeatScheduleSurvivesRestart\n"}
+{"Time":"2026-10-17T23:01:37.760917113Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Output":"--- PASS: TestHeartbeatScheduleSurvivesRestart (0.08s)\n"}
+{"Time":"2026-10-17T23:01:37.76105028Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Elapsed":0.08}
+{"Time":"2026-10-17T23:01:37.761080677Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs"}
+{"Time":"2026-10-17T23:01:37.761092147Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs\n"}
+{"Time":"2026-10-17T23:01:37.763961427Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request"}
+{"Time":"2026-10-17T23:01:37.764039985Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request\n"}
+{"Time":"2026-10-17T23:01:37.870527427Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request (0.10s)\n"}
+{"Time":"2026-10-17T23:01:37.870587897Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Elapsed":0.1}
+{"Time":"2026-10-17T23:01:37.870605814Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized"}
+{"Time":"2026-10-17T23:01:37.870616364Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized\n"}
+{"Time":"2026-10-17T23:01:37.893755899Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized (0.03s)\n"}
+{"Time":"2026-10-17T23:01:37.893893115Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:37.893918003Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden"}
+{"Time":"2026-10-17T23:01:37.893928688Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden\n"}
+{"Time":"2026-10-17T23:01:37.936357778Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden (0.05s)\n"}
+{"Time":"2026-10-17T23:01:37.936416111Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:37.936432531Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error"}
+{"Time":"2026-10-17T23:01:37.936441522Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error\n"}
+{"Time":"2026-10-17T23:01:37.972531947Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error (0.04s)\n"}
+{"Time":"2026-10-17T23:01:37.972675691Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:37.972703563Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found"}
+{"Time":"2026-10-17T23:01:37.972714123Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Found\n"}
+{"Time":"2026-10-17T23:01:37.99682442Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Found (0.02s)\n"}
+{"Time":"2026-10-17T23:01:37.997195877Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:37.997285175Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content"}
+{"Time":"2026-10-17T23:01:38.004418824Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content\n"}
+{"Time":"2026-10-17T23:01:38.027133373Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content (0.02s)\n"}
+{"Time":"2026-10-17T23:01:38.027225755Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:38.027249488Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs (0.25s)\n"}
+{"Time":"2026-10-17T23:01:38.027262157Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Elapsed":0.25}
+{"Time":"2026-10-17T23:01:38.027272248Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates"}
+{"Time":"2026-10-17T23:01:38.027285855Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Output":"=== RUN TestDrainAmbiguousAcceptanceReplaysAndTokenRotates\n"}
+{"Time":"2026-10-17T23:01:38.040358906Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Output":"--- PASS: TestDrainAmbiguousAcceptanceReplaysAndTokenRotates (0.02s)\n"}
+{"Time":"2026-10-17T23:01:38.040507866Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:38.040571158Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse"}
+{"Time":"2026-10-17T23:01:38.040733252Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Output":"=== RUN TestOutboxReportsLagAndRefusesSourceReuse\n"}
+{"Time":"2026-10-17T23:01:38.041958602Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Output":"--- PASS: TestOutboxReportsLagAndRefusesSourceReuse (0.01s)\n"}
+{"Time":"2026-10-17T23:01:38.042491918Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:38.042699107Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit"}
+{"Time":"2026-10-17T23:01:38.04272734Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Output":"=== RUN TestSlowReceiverDoesNotBlockDecisionCommit\n"}
+{"Time":"2026-10-17T23:01:38.055593607Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Output":"--- PASS: TestSlowReceiverDoesNotBlockDecisionCommit (0.01s)\n"}
+{"Time":"2026-10-17T23:01:38.056067806Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:38.056813271Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields"}
+{"Time":"2026-10-17T23:01:38.060593339Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Output":"=== RUN TestCommittedEventsCarryAuditCoreRequiredFields\n"}
+{"Time":"2026-10-17T23:01:38.064857118Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Output":"--- PASS: TestCommittedEventsCarryAuditCoreRequiredFields (0.01s)\n"}
+{"Time":"2026-10-17T23:01:38.08300832Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:38.083150125Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped"}
+{"Time":"2026-10-17T23:01:38.083164283Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Output":"=== RUN TestCountsSurviveRestartAndTornTailIsDropped\n"}
+{"Time":"2026-10-17T23:01:38.083182597Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Output":"--- PASS: TestCountsSurviveRestartAndTornTailIsDropped (0.00s)\n"}
+{"Time":"2026-10-17T23:01:38.083193652Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Elapsed":0}
+{"Time":"2026-10-17T23:01:38.083205762Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass"}
+{"Time":"2026-10-17T23:01:38.083214797Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Output":"=== RUN TestReleasedUncommittedIsReportedPerClass\n"}
+{"Time":"2026-10-17T23:01:38.083236015Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Output":"--- PASS: TestReleasedUncommittedIsReportedPerClass (0.00s)\n"}
+{"Time":"2026-10-17T23:01:38.083269505Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Elapsed":0}
+{"Time":"2026-10-17T23:01:38.083280389Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect"}
+{"Time":"2026-10-17T23:01:38.083292084Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Output":"=== RUN TestCadenceClassifiesEveryEffect\n"}
+{"Time":"2026-10-17T23:01:38.089803518Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Output":"--- PASS: TestCadenceClassifiesEveryEffect (0.02s)\n"}
+{"Time":"2026-10-17T23:01:38.089874366Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:38.089905476Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:38.126825398Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Output":"ok \tgithub.com/netkingdom/access-engine/internal/emission\t1.171s\n"}
+{"Time":"2026-10-17T23:01:38.126896022Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Elapsed":1.171}
+{"Time":"2026-10-17T23:01:38.534379931Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:01:38.534452971Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:01:38.593394198Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown (0.06s)\n"}
+{"Time":"2026-10-17T23:01:38.593466372Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Elapsed":0.06}
+{"Time":"2026-10-17T23:01:38.5934841Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:01:38.593493379Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:01:38.677204395Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown (0.09s)\n"}
+{"Time":"2026-10-17T23:01:38.67816438Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Elapsed":0.09}
+{"Time":"2026-10-17T23:01:38.678667164Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:01:38.678781007Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:01:38.708239262Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown (0.03s)\n"}
+{"Time":"2026-10-17T23:01:38.711659024Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:38.711778475Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow"}
+{"Time":"2026-10-17T23:01:38.711800586Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Output":"=== RUN TestOpsWardenProductionRegistryActors/admin_actor_allow\n"}
+{"Time":"2026-10-17T23:01:38.784526666Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Output":"--- PASS: TestOpsWardenProductionRegistryActors/admin_actor_allow (0.07s)\n"}
+{"Time":"2026-10-17T23:01:38.784642349Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:38.784660744Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:01:38.78467069Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:01:38.888804251Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown (0.11s)\n"}
+{"Time":"2026-10-17T23:01:38.888886912Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Elapsed":0.11}
+{"Time":"2026-10-17T23:01:38.888908679Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:01:38.888919608Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:01:38.962256467Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown (0.07s)\n"}
+{"Time":"2026-10-17T23:01:38.964176663Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:38.964291651Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown"}
+{"Time":"2026-10-17T23:01:38.964317107Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown\n"}
+{"Time":"2026-10-17T23:01:39.040538375Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown (0.07s)\n"}
+{"Time":"2026-10-17T23:01:39.040611099Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:39.040843474Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Output":"--- PASS: TestOpsWardenProductionRegistryActors (1.48s)\n"}
+{"Time":"2026-10-17T23:01:39.041271878Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Elapsed":1.48}
+{"Time":"2026-10-17T23:01:39.041315873Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor"}
+{"Time":"2026-10-17T23:01:39.042952581Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Output":"=== RUN TestRunValidateAccessDescriptor\n"}
+{"Time":"2026-10-17T23:01:39.042990039Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Output":"--- PASS: TestRunValidateAccessDescriptor (0.00s)\n"}
+{"Time":"2026-10-17T23:01:39.063865596Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Elapsed":0}
+{"Time":"2026-10-17T23:01:39.063946688Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions"}
+{"Time":"2026-10-17T23:01:39.063962441Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Output":"=== RUN TestOpsWardenFetchDecisions\n"}
+{"Time":"2026-10-17T23:01:39.7625446Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json"}
+{"Time":"2026-10-17T23:01:39.762619038Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json\n"}
+{"Time":"2026-10-17T23:01:39.798627283Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json (0.04s)\n"}
+{"Time":"2026-10-17T23:01:39.798699575Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:39.798722055Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json"}
+{"Time":"2026-10-17T23:01:39.798753038Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json\n"}
+{"Time":"2026-10-17T23:01:39.837579904Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json (0.04s)\n"}
+{"Time":"2026-10-17T23:01:39.837850358Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:39.838008927Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json"}
+{"Time":"2026-10-17T23:01:39.838033823Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json\n"}
+{"Time":"2026-10-17T23:01:39.872052318Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json (0.03s)\n"}
+{"Time":"2026-10-17T23:01:39.872120326Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:39.87213782Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json"}
+{"Time":"2026-10-17T23:01:39.872148225Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json\n"}
+{"Time":"2026-10-17T23:01:39.886680703Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json (0.02s)\n"}
+{"Time":"2026-10-17T23:01:39.887996094Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:39.888197269Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json"}
+{"Time":"2026-10-17T23:01:39.888220245Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json\n"}
+{"Time":"2026-10-17T23:01:39.899496982Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json (0.01s)\n"}
+{"Time":"2026-10-17T23:01:39.900276082Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:39.900376759Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Output":"--- PASS: TestOpsWardenFetchDecisions (0.84s)\n"}
+{"Time":"2026-10-17T23:01:39.900394126Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Elapsed":0.84}
+{"Time":"2026-10-17T23:01:39.9004285Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings"}
+{"Time":"2026-10-17T23:01:39.900439537Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Output":"=== RUN TestOpsWardenFetchCallerBindings\n"}
+{"Time":"2026-10-17T23:01:40.676469318Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Output":"--- PASS: TestOpsWardenFetchCallerBindings (0.78s)\n"}
+{"Time":"2026-10-17T23:01:40.676573891Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Elapsed":0.78}
+{"Time":"2026-10-17T23:01:40.676624703Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy"}
+{"Time":"2026-10-17T23:01:40.676636335Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Output":"=== RUN TestOpsWardenFetchRegistryMatchesPolicy\n"}
+{"Time":"2026-10-17T23:01:40.677906381Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Output":"--- PASS: TestOpsWardenFetchRegistryMatchesPolicy (0.00s)\n"}
+{"Time":"2026-10-17T23:01:40.677957554Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Elapsed":0}
+{"Time":"2026-10-17T23:01:40.677972297Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity"}
+{"Time":"2026-10-17T23:01:40.677982Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Output":"=== RUN TestActualHTTPAllEffectsWithheldAtOutboxCapacity\n"}
+{"Time":"2026-10-17T23:01:42.195004788Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/markitect"}
+{"Time":"2026-10-17T23:01:42.242063544Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport"}
+{"Time":"2026-10-17T23:01:42.242137116Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Output":"=== RUN TestActionVocabularySeparatesReadFromExport\n"}
+{"Time":"2026-10-17T23:01:42.242227487Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Output":"--- PASS: TestActionVocabularySeparatesReadFromExport (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.242240769Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.242253105Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary"}
+{"Time":"2026-10-17T23:01:42.242262113Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Output":"=== RUN TestActionDefinitionsMirrorVocabulary\n"}
+{"Time":"2026-10-17T23:01:42.242511657Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Output":"--- PASS: TestActionDefinitionsMirrorVocabulary (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.249118978Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.249142333Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates"}
+{"Time":"2026-10-17T23:01:42.249187428Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Output":"=== RUN TestMarkitectCheckFixturePackageValidates\n"}
+{"Time":"2026-10-17T23:01:42.401945155Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Output":"--- PASS: TestMarkitectCheckFixturePackageValidates (0.16s)\n"}
+{"Time":"2026-10-17T23:01:42.402158368Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Elapsed":0.16}
+{"Time":"2026-10-17T23:01:42.402299614Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract"}
+{"Time":"2026-10-17T23:01:42.402319416Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Output":"=== RUN TestGatewayDecisionAllowContract\n"}
+{"Time":"2026-10-17T23:01:42.402555407Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Output":"--- PASS: TestGatewayDecisionAllowContract (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.407787891Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Output":"--- PASS: TestActualHTTPAllEffectsWithheldAtOutboxCapacity (1.73s)\n"}
+{"Time":"2026-10-17T23:01:42.407858739Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Elapsed":1.73}
+{"Time":"2026-10-17T23:01:42.407875232Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins"}
+{"Time":"2026-10-17T23:01:42.407885872Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Output":"=== RUN TestReadbackPinMatchesParticipantPins\n"}
+{"Time":"2026-10-17T23:01:42.407978092Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00"}
+{"Time":"2026-10-17T23:01:42.407991014Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Output":"=== RUN TestReadbackPinMatchesParticipantPins/#00\n"}
+{"Time":"2026-10-17T23:01:42.408005892Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Output":"--- PASS: TestReadbackPinMatchesParticipantPins/#00 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.408018273Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.408030419Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/"}
+{"Time":"2026-10-17T23:01:42.408039689Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Output":"=== RUN TestReadbackPinMatchesParticipantPins/access-engine/\n"}
+{"Time":"2026-10-17T23:01:42.408058039Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Output":"--- PASS: TestReadbackPinMatchesParticipantPins/access-engine/ (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.408070383Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.408081556Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Output":"--- PASS: TestReadbackPinMatchesParticipantPins (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.408120988Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.408134063Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted"}
+{"Time":"2026-10-17T23:01:42.408144866Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Output":"=== RUN TestReadbackRowsInRequestOrderAndNeverOmitted\n"}
+{"Time":"2026-10-17T23:01:42.426626524Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.426696687Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract"}
+{"Time":"2026-10-17T23:01:42.426718437Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Output":"=== RUN TestGatewayDecisionDenyContract\n"}
+{"Time":"2026-10-17T23:01:42.426736291Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Output":"--- PASS: TestGatewayDecisionDenyContract (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.426747905Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.426757635Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract"}
+{"Time":"2026-10-17T23:01:42.426765669Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Output":"=== RUN TestGatewayDecisionRedactContract\n"}
+{"Time":"2026-10-17T23:01:42.426775868Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Output":"--- PASS: TestGatewayDecisionRedactContract (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.426785507Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.426802865Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract"}
+{"Time":"2026-10-17T23:01:42.426810963Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Output":"=== RUN TestGatewayDecisionAuditDeniedContract\n"}
+{"Time":"2026-10-17T23:01:42.426822901Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Output":"--- PASS: TestGatewayDecisionAuditDeniedContract (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.42683301Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.426842271Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape"}
+{"Time":"2026-10-17T23:01:42.426849908Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Output":"=== RUN TestImportResourceManifestLoadsPinnedMarkitectShape\n"}
+{"Time":"2026-10-17T23:01:42.426864083Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Output":"--- PASS: TestImportResourceManifestLoadsPinnedMarkitectShape (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.426895085Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.426905842Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources"}
+{"Time":"2026-10-17T23:01:42.426913922Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Output":"=== RUN TestImportNamespaceResourceManifestClassifiesAllResources\n"}
+{"Time":"2026-10-17T23:01:42.426925383Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Output":"--- PASS: TestImportNamespaceResourceManifestClassifiesAllResources (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.426935238Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.426943904Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings"}
+{"Time":"2026-10-17T23:01:42.426952597Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Output":"=== RUN TestImportAmbiguousManifestReportsClassificationWarnings\n"}
+{"Time":"2026-10-17T23:01:42.436361111Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Output":"--- PASS: TestImportAmbiguousManifestReportsClassificationWarnings (0.02s)\n"}
+{"Time":"2026-10-17T23:01:42.436428046Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:42.436444304Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType"}
+{"Time":"2026-10-17T23:01:42.436453916Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Output":"=== RUN TestImportRejectsUnknownMarkitectResourceType\n"}
+{"Time":"2026-10-17T23:01:42.436466234Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Output":"--- PASS: TestImportRejectsUnknownMarkitectResourceType (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.436476243Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.43648517Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:42.451965962Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Output":"ok \tgithub.com/netkingdom/access-engine/internal/markitect\t0.257s\n"}
+{"Time":"2026-10-17T23:01:42.452033411Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Elapsed":0.257}
+{"Time":"2026-10-17T23:01:42.488546096Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Output":"--- PASS: TestReadbackRowsInRequestOrderAndNeverOmitted (0.07s)\n"}
+{"Time":"2026-10-17T23:01:42.488608739Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:42.488625619Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA"}
+{"Time":"2026-10-17T23:01:42.488654303Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Output":"=== RUN TestReadbackDeniesWithoutMFA\n"}
+{"Time":"2026-10-17T23:01:42.553081775Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Output":"--- PASS: TestReadbackDeniesWithoutMFA (0.07s)\n"}
+{"Time":"2026-10-17T23:01:42.553269271Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:42.553419417Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection"}
+{"Time":"2026-10-17T23:01:42.553439769Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Output":"=== RUN TestReadbackSystemsProjection\n"}
+{"Time":"2026-10-17T23:01:42.595989023Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Output":"--- PASS: TestReadbackSystemsProjection (0.04s)\n"}
+{"Time":"2026-10-17T23:01:42.596055931Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:42.596080458Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries"}
+{"Time":"2026-10-17T23:01:42.596090891Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Output":"=== RUN TestReadbackRefusesDuplicateSystemAcrossRegistries\n"}
+{"Time":"2026-10-17T23:01:42.596105102Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Output":"--- PASS: TestReadbackRefusesDuplicateSystemAcrossRegistries (0.00s)\n"}
+{"Time":"2026-10-17T23:01:42.59611586Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Elapsed":0}
+{"Time":"2026-10-17T23:01:42.596126275Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape"}
+{"Time":"2026-10-17T23:01:42.596134796Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Output":"=== RUN TestReadbackHTTPCallerAndRequestShape\n"}
+{"Time":"2026-10-17T23:01:42.658789005Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Output":"--- PASS: TestReadbackHTTPCallerAndRequestShape (0.07s)\n"}
+{"Time":"2026-10-17T23:01:42.658859988Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:42.658883334Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin"}
+{"Time":"2026-10-17T23:01:42.65889245Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Output":"=== RUN TestReadbackPrincipalCannotCheckOnEnforcementPin\n"}
+{"Time":"2026-10-17T23:01:42.907914869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Output":"--- PASS: TestAttributeContextCarriedWithoutViewHash (7.71s)\n"}
+{"Time":"2026-10-17T23:01:42.90796798Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Elapsed":7.71}
+{"Time":"2026-10-17T23:01:42.907996493Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld"}
+{"Time":"2026-10-17T23:01:42.90800459Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Output":"=== RUN TestUncommittedDenyIsWithheld\n"}
+{"Time":"2026-10-17T23:01:42.966848319Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Output":"--- PASS: TestUncommittedDenyIsWithheld (0.06s)\n"}
+{"Time":"2026-10-17T23:01:42.967077312Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Elapsed":0.06}
+{"Time":"2026-10-17T23:01:42.967342761Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld"}
+{"Time":"2026-10-17T23:01:42.967367027Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Output":"=== RUN TestUncommittedAllowIsWithheld\n"}
+{"Time":"2026-10-17T23:01:43.008402478Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Output":"--- PASS: TestUncommittedAllowIsWithheld (0.04s)\n"}
+{"Time":"2026-10-17T23:01:43.008456284Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:43.008472343Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow"}
+{"Time":"2026-10-17T23:01:43.00848045Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Output":"=== RUN TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow\n"}
+{"Time":"2026-10-17T23:01:43.074941479Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Output":"--- PASS: TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow (0.07s)\n"}
+{"Time":"2026-10-17T23:01:43.075051165Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:43.075083392Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit"}
+{"Time":"2026-10-17T23:01:43.075095088Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Output":"=== RUN TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit\n"}
+{"Time":"2026-10-17T23:01:43.106668207Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Output":"--- PASS: TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit (0.03s)\n"}
+{"Time":"2026-10-17T23:01:43.106900771Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:43.106927183Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext"}
+{"Time":"2026-10-17T23:01:43.106937354Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Output":"=== RUN TestCheckUsesExplicitCaringContext\n"}
+{"Time":"2026-10-17T23:01:43.18318547Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Output":"--- PASS: TestCheckUsesExplicitCaringContext (0.08s)\n"}
+{"Time":"2026-10-17T23:01:43.183256905Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Elapsed":0.08}
+{"Time":"2026-10-17T23:01:43.183317735Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest"}
+{"Time":"2026-10-17T23:01:43.183333948Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Output":"=== RUN TestCallerProvenanceDoesNotChangeRequestDigest\n"}
+{"Time":"2026-10-17T23:01:43.254783283Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Output":"--- PASS: TestCallerProvenanceDoesNotChangeRequestDigest (0.07s)\n"}
+{"Time":"2026-10-17T23:01:43.254879741Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:43.254898235Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor"}
+{"Time":"2026-10-17T23:01:43.25491682Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Output":"=== RUN TestCheckMatchesRegistryRelationshipDescriptor\n"}
+{"Time":"2026-10-17T23:01:43.290838673Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Output":"--- PASS: TestCheckMatchesRegistryRelationshipDescriptor (0.04s)\n"}
+{"Time":"2026-10-17T23:01:43.290911226Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:43.290935013Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder"}
+{"Time":"2026-10-17T23:01:43.290946754Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Output":"=== RUN TestBatchCheckPreservesResourceOrder\n"}
+{"Time":"2026-10-17T23:01:43.313510935Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Output":"--- PASS: TestReadbackPrincipalCannotCheckOnEnforcementPin (0.65s)\n"}
+{"Time":"2026-10-17T23:01:43.313585643Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Elapsed":0.65}
+{"Time":"2026-10-17T23:01:43.313609043Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects"}
+{"Time":"2026-10-17T23:01:43.313619773Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Output":"=== RUN TestReadbackWithholdsUncommittedEffects\n"}
+{"Time":"2026-10-17T23:01:43.363122047Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Output":"--- PASS: TestBatchCheckPreservesResourceOrder (0.07s)\n"}
+{"Time":"2026-10-17T23:01:43.363253635Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:43.363269407Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources"}
+{"Time":"2026-10-17T23:01:43.36329351Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Output":"=== RUN TestListAllowedReturnsOnlyAllowedResources\n"}
+{"Time":"2026-10-17T23:01:43.40663737Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Output":"--- PASS: TestReadbackWithholdsUncommittedEffects (0.09s)\n"}
+{"Time":"2026-10-17T23:01:43.406793837Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Elapsed":0.09}
+{"Time":"2026-10-17T23:01:43.406815939Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas"}
+{"Time":"2026-10-17T23:01:43.406828274Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Output":"=== RUN TestReadbackShapesMatchSchemas\n"}
+{"Time":"2026-10-17T23:01:43.432636863Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Output":"--- PASS: TestListAllowedReturnsOnlyAllowedResources (0.07s)\n"}
+{"Time":"2026-10-17T23:01:43.435866648Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:43.435945089Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision"}
+{"Time":"2026-10-17T23:01:43.435958389Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Output":"=== RUN TestExplainUsesRecordedDecision\n"}
+{"Time":"2026-10-17T23:01:43.453980748Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Output":"--- PASS: TestReadbackShapesMatchSchemas (0.05s)\n"}
+{"Time":"2026-10-17T23:01:43.455768528Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:43.455849431Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue"}
+{"Time":"2026-10-17T23:01:43.455861235Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Output":"=== RUN TestReadbackInformedDecisionCatalogue\n"}
+{"Time":"2026-10-17T23:01:43.482400756Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Output":"--- PASS: TestExplainUsesRecordedDecision (0.05s)\n"}
+{"Time":"2026-10-17T23:01:43.482601353Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:43.482724295Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest"}
+{"Time":"2026-10-17T23:01:43.482741517Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Output":"=== RUN TestCheckRecordsRegistrySnapshotDigest\n"}
+{"Time":"2026-10-17T23:01:43.631400633Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Output":"--- PASS: TestCheckRecordsRegistrySnapshotDigest (0.15s)\n"}
+{"Time":"2026-10-17T23:01:43.631635776Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Elapsed":0.15}
+{"Time":"2026-10-17T23:01:43.6319422Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes"}
+{"Time":"2026-10-17T23:01:43.631975348Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Output":"=== RUN TestCheckAllowLifetimes\n"}
+{"Time":"2026-10-17T23:01:43.660938091Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Output":"--- PASS: TestReadbackInformedDecisionCatalogue (0.21s)\n"}
+{"Time":"2026-10-17T23:01:43.661262315Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Elapsed":0.21}
+{"Time":"2026-10-17T23:01:43.661416167Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP"}
+{"Time":"2026-10-17T23:01:43.661436402Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Output":"=== RUN TestEnforcementWithholdsUncommittedDenyHTTP\n"}
+{"Time":"2026-10-17T23:01:43.785699375Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Output":"--- PASS: TestCheckAllowLifetimes (0.15s)\n"}
+{"Time":"2026-10-17T23:01:43.785770205Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Elapsed":0.15}
+{"Time":"2026-10-17T23:01:43.785788438Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog"}
+{"Time":"2026-10-17T23:01:43.785802505Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Output":"=== RUN TestCheckWritesDecisionLog\n"}
+{"Time":"2026-10-17T23:01:43.831486319Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Output":"--- PASS: TestCheckWritesDecisionLog (0.05s)\n"}
+{"Time":"2026-10-17T23:01:43.831627899Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:43.831857703Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes"}
+{"Time":"2026-10-17T23:01:43.83188388Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Output":"=== RUN TestRegistryFactsOverrideCallerSuppliedAttributes\n"}
+{"Time":"2026-10-17T23:01:43.983940188Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Output":"--- PASS: TestRegistryFactsOverrideCallerSuppliedAttributes (0.15s)\n"}
+{"Time":"2026-10-17T23:01:43.984030027Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Elapsed":0.15}
+{"Time":"2026-10-17T23:01:43.98405789Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved"}
+{"Time":"2026-10-17T23:01:43.984067647Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Output":"=== RUN TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved\n"}
+{"Time":"2026-10-17T23:01:44.064958429Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Output":"--- PASS: TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved (0.08s)\n"}
+{"Time":"2026-10-17T23:01:44.065031793Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Elapsed":0.08}
+{"Time":"2026-10-17T23:01:44.065048213Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride"}
+{"Time":"2026-10-17T23:01:44.065057501Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Output":"=== RUN TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride\n"}
+{"Time":"2026-10-17T23:01:44.133159993Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Output":"--- PASS: TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride (0.06s)\n"}
+{"Time":"2026-10-17T23:01:44.133235991Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Elapsed":0.06}
+{"Time":"2026-10-17T23:01:44.13548051Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer"}
+{"Time":"2026-10-17T23:01:44.135539781Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Output":"=== RUN TestSubmittedRequestDigestIsComputableByTheConsumer\n"}
+{"Time":"2026-10-17T23:01:44.195755188Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Output":"--- PASS: TestSubmittedRequestDigestIsComputableByTheConsumer (0.06s)\n"}
+{"Time":"2026-10-17T23:01:44.195830554Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Elapsed":0.06}
+{"Time":"2026-10-17T23:01:44.19584619Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope"}
+{"Time":"2026-10-17T23:01:44.195855216Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Output":"=== RUN TestSignerAuthenticatesReturnedAndRecordedEnvelope\n"}
+{"Time":"2026-10-17T23:01:44.271048196Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Output":"--- PASS: TestSignerAuthenticatesReturnedAndRecordedEnvelope (0.08s)\n"}
+{"Time":"2026-10-17T23:01:44.271123806Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Elapsed":0.08}
+{"Time":"2026-10-17T23:01:44.271141182Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration"}
+{"Time":"2026-10-17T23:01:44.271152571Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Output":"=== RUN TestSignerRejectsInvalidConfiguration\n"}
+{"Time":"2026-10-17T23:01:44.275814194Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Output":"--- PASS: TestEnforcementWithholdsUncommittedDenyHTTP (0.61s)\n"}
+{"Time":"2026-10-17T23:01:44.275965025Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Elapsed":0.61}
+{"Time":"2026-10-17T23:01:44.276071275Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial"}
+{"Time":"2026-10-17T23:01:44.276097146Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial\n"}
+{"Time":"2026-10-17T23:01:44.27621006Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden"}
+{"Time":"2026-10-17T23:01:44.276228987Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden\n"}
+{"Time":"2026-10-17T23:01:44.302975906Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Output":"--- PASS: TestSignerRejectsInvalidConfiguration (0.03s)\n"}
+{"Time":"2026-10-17T23:01:44.303221284Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:44.303319445Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:44.31023607Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/policy"}
+{"Time":"2026-10-17T23:01:44.314759806Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Output":"ok \tgithub.com/netkingdom/access-engine/internal/decision\t9.239s\n"}
+{"Time":"2026-10-17T23:01:44.31485189Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Elapsed":9.239}
+{"Time":"2026-10-17T23:01:44.328662549Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/readback"}
+{"Time":"2026-10-17T23:01:44.328732162Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/readback","Output":"? \tgithub.com/netkingdom/access-engine/internal/readback\t[no test files]\n"}
+{"Time":"2026-10-17T23:01:44.328759773Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/readback","Elapsed":0}
+{"Time":"2026-10-17T23:01:44.355967678Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission"}
+{"Time":"2026-10-17T23:01:44.356026632Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Output":"=== RUN TestInformedDecisionAttributeAdmission\n"}
+{"Time":"2026-10-17T23:01:44.649530744Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/registry"}
+{"Time":"2026-10-17T23:01:44.671128786Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode"}
+{"Time":"2026-10-17T23:01:44.671201844Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Output":"=== RUN TestTaskRegistryNumericSourceAndStrictDecode\n"}
+{"Time":"2026-10-17T23:01:44.676413363Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Output":"--- PASS: TestTaskRegistryNumericSourceAndStrictDecode (0.01s)\n"}
+{"Time":"2026-10-17T23:01:44.676471695Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:44.676494996Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse"}
+{"Time":"2026-10-17T23:01:44.676503959Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Output":"=== RUN TestRegistryManifestsParse\n"}
+{"Time":"2026-10-17T23:01:44.678021589Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Output":"--- PASS: TestRegistryManifestsParse (0.00s)\n"}
+{"Time":"2026-10-17T23:01:44.678073681Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Elapsed":0}
+{"Time":"2026-10-17T23:01:44.678087306Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse"}
+{"Time":"2026-10-17T23:01:44.67809645Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Output":"=== RUN TestExpandedRegistryExamplesParse\n"}
+{"Time":"2026-10-17T23:01:44.679878132Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Output":"--- PASS: TestExpandedRegistryExamplesParse (0.00s)\n"}
+{"Time":"2026-10-17T23:01:44.688532797Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Elapsed":0}
+{"Time":"2026-10-17T23:01:44.688604169Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests"}
+{"Time":"2026-10-17T23:01:44.688615233Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Output":"=== RUN TestStoreImportsManifests\n"}
+{"Time":"2026-10-17T23:01:44.689433053Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Output":"--- PASS: TestStoreImportsManifests (0.00s)\n"}
+{"Time":"2026-10-17T23:01:44.689485785Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Elapsed":0}
+{"Time":"2026-10-17T23:01:44.689504722Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot"}
+{"Time":"2026-10-17T23:01:44.689514424Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Output":"=== RUN TestStoreLoadsAndSavesDeterministicSnapshot\n"}
+{"Time":"2026-10-17T23:01:44.691249751Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Output":"--- PASS: TestStoreLoadsAndSavesDeterministicSnapshot (0.00s)\n"}
+{"Time":"2026-10-17T23:01:44.69131592Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Elapsed":0}
+{"Time":"2026-10-17T23:01:44.691329509Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges"}
+{"Time":"2026-10-17T23:01:44.691339049Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Output":"=== RUN TestStoreDigestChangesWhenSnapshotChanges\n"}
+{"Time":"2026-10-17T23:01:44.696135272Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Output":"--- PASS: TestStoreDigestChangesWhenSnapshotChanges (0.00s)\n"}
+{"Time":"2026-10-17T23:01:44.696203037Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Elapsed":0}
+{"Time":"2026-10-17T23:01:44.696218664Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords"}
+{"Time":"2026-10-17T23:01:44.696227645Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Output":"=== RUN TestStoreRejectsInvalidRecords\n"}
+{"Time":"2026-10-17T23:01:44.696241036Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Output":"--- PASS: TestStoreRejectsInvalidRecords (0.00s)\n"}
+{"Time":"2026-10-17T23:01:44.696252857Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Elapsed":0}
+{"Time":"2026-10-17T23:01:44.696263272Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:44.698375395Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Output":"ok \tgithub.com/netkingdom/access-engine/internal/registry\t0.049s\n"}
+{"Time":"2026-10-17T23:01:44.698715228Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Elapsed":0.049}
+{"Time":"2026-10-17T23:01:45.701018555Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":" runtime_rename_test.go:106: 10 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:01:45.701095337Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden (1.42s)\n"}
+{"Time":"2026-10-17T23:01:45.701108628Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Elapsed":1.42}
+{"Time":"2026-10-17T23:01:45.701184256Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch"}
+{"Time":"2026-10-17T23:01:45.701203391Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch\n"}
+{"Time":"2026-10-17T23:01:45.882534028Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/schemaguard"}
+{"Time":"2026-10-17T23:01:45.895212541Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas"}
+{"Time":"2026-10-17T23:01:45.895282983Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas\n"}
+{"Time":"2026-10-17T23:01:45.902805461Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json"}
+{"Time":"2026-10-17T23:01:45.902865237Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json\n"}
+{"Time":"2026-10-17T23:01:45.903050523Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:45.903166295Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:45.903297767Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json"}
+{"Time":"2026-10-17T23:01:45.903316929Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json\n"}
+{"Time":"2026-10-17T23:01:45.906093454Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:45.908956025Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:45.909142474Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json"}
+{"Time":"2026-10-17T23:01:45.909164981Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json\n"}
+{"Time":"2026-10-17T23:01:45.91230403Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:45.9130066Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:45.913198027Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json"}
+{"Time":"2026-10-17T23:01:45.913223519Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json\n"}
+{"Time":"2026-10-17T23:01:45.917047247Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:45.917267295Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:45.917416991Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas (0.02s)\n"}
+{"Time":"2026-10-17T23:01:45.917627002Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:45.91789174Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime"}
+{"Time":"2026-10-17T23:01:45.917996728Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Output":"=== RUN TestEveryAllowExampleStatesItsLifetime\n"}
+{"Time":"2026-10-17T23:01:45.928020069Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Output":"--- PASS: TestEveryAllowExampleStatesItsLifetime (0.01s)\n"}
+{"Time":"2026-10-17T23:01:45.92808566Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:45.928115462Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete"}
+{"Time":"2026-10-17T23:01:45.928136454Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":"=== RUN TestApprovalClaimsInFixturesAreComplete\n"}
+{"Time":"2026-10-17T23:01:45.928176437Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":" examples_test.go:91: approval-engine not checked out at /work/home/approval-engine/schemas/approval_claim.schema.json\n"}
+{"Time":"2026-10-17T23:01:45.928196969Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":"--- SKIP: TestApprovalClaimsInFixturesAreComplete (0.00s)\n"}
+{"Time":"2026-10-17T23:01:45.928209377Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Elapsed":0}
+{"Time":"2026-10-17T23:01:45.928226699Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds"}
+{"Time":"2026-10-17T23:01:45.9282377Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Output":"=== RUN TestArrayLengthBounds\n"}
+{"Time":"2026-10-17T23:01:45.928251199Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Output":"--- PASS: TestArrayLengthBounds (0.00s)\n"}
+{"Time":"2026-10-17T23:01:45.928264842Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Elapsed":0}
+{"Time":"2026-10-17T23:01:45.928272624Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:45.929562352Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Output":"ok \tgithub.com/netkingdom/access-engine/internal/schemaguard\t0.047s\n"}
+{"Time":"2026-10-17T23:01:45.92964495Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Elapsed":0.047}
+{"Time":"2026-10-17T23:01:46.710485407Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/sign"}
+{"Time":"2026-10-17T23:01:46.739851625Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility"}
+{"Time":"2026-10-17T23:01:46.739917063Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility\n"}
+{"Time":"2026-10-17T23:01:46.774714514Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1"}
+{"Time":"2026-10-17T23:01:46.774784073Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1\n"}
+{"Time":"2026-10-17T23:01:46.783770826Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.783861088Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.783877491Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0"}
+{"Time":"2026-10-17T23:01:46.783886499Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1.0\n"}
+{"Time":"2026-10-17T23:01:46.791848481Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1.0 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.791946976Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.791965101Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0"}
+{"Time":"2026-10-17T23:01:46.791973748Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/-0.0\n"}
+{"Time":"2026-10-17T23:01:46.791991476Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/-0.0 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.792045399Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.792071351Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07"}
+{"Time":"2026-10-17T23:01:46.792080071Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1e-07\n"}
+{"Time":"2026-10-17T23:01:46.792092018Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1e-07 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.792100964Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.792111929Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20"}
+{"Time":"2026-10-17T23:01:46.792120197Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1e+20\n"}
+{"Time":"2026-10-17T23:01:46.792131189Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1e+20 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.792140477Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.792148737Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993"}
+{"Time":"2026-10-17T23:01:46.792158872Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993\n"}
+{"Time":"2026-10-17T23:01:46.792169765Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.792179846Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.792189495Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308"}
+{"Time":"2026-10-17T23:01:46.792213805Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308\n"}
+{"Time":"2026-10-17T23:01:46.799778655Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308 (0.01s)\n"}
+{"Time":"2026-10-17T23:01:46.79984568Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:46.799860333Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324"}
+{"Time":"2026-10-17T23:01:46.799870839Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/5e-324\n"}
+{"Time":"2026-10-17T23:01:46.79988441Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/5e-324 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.799894482Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.799904374Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true"}
+{"Time":"2026-10-17T23:01:46.799912534Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/true\n"}
+{"Time":"2026-10-17T23:01:46.799923445Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/true (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.799933409Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.799943346Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\""}
+{"Time":"2026-10-17T23:01:46.799953112Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"\n"}
+{"Time":"2026-10-17T23:01:46.799966025Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\" (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.799977206Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.799987215Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]"}
+{"Time":"2026-10-17T23:01:46.8000169Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]\n"}
+{"Time":"2026-10-17T23:01:46.800028785Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0] (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.800038686Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.800047946Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}"}
+{"Time":"2026-10-17T23:01:46.800056675Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}\n"}
+{"Time":"2026-10-17T23:01:46.800072554Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0} (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.800093033Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.811811831Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility (0.07s)\n"}
+{"Time":"2026-10-17T23:01:46.811883194Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:46.811899028Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip"}
+{"Time":"2026-10-17T23:01:46.811907901Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Output":"=== RUN TestSignAndVerifyRoundTrip\n"}
+{"Time":"2026-10-17T23:01:46.81192021Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Output":"--- PASS: TestSignAndVerifyRoundTrip (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.811931689Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.81194746Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification"}
+{"Time":"2026-10-17T23:01:46.811956748Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Output":"=== RUN TestAlteredEnvelopeFailsVerification\n"}
+{"Time":"2026-10-17T23:01:46.811969137Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Output":"--- PASS: TestAlteredEnvelopeFailsVerification (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.811979255Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.811997406Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify"}
+{"Time":"2026-10-17T23:01:46.812010337Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Output":"=== RUN TestUnsignedEnvelopeDoesNotVerify\n"}
+{"Time":"2026-10-17T23:01:46.812091826Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Output":"--- PASS: TestUnsignedEnvelopeDoesNotVerify (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.812116624Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.812128256Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure"}
+{"Time":"2026-10-17T23:01:46.812187075Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Output":"=== RUN TestReplayFixturesProveSuccessAndFailure\n"}
+{"Time":"2026-10-17T23:01:46.836340395Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Output":"--- PASS: TestReplayFixturesProveSuccessAndFailure (0.03s)\n"}
+{"Time":"2026-10-17T23:01:46.836849645Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:46.836898672Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures"}
+{"Time":"2026-10-17T23:01:46.836911639Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":"=== RUN TestWriteReplaySignatureFixtures\n"}
+{"Time":"2026-10-17T23:01:46.83692723Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":" write_fixtures_test.go:15: set UPDATE_FIXTURES=1 to regenerate signed replay fixtures\n"}
+{"Time":"2026-10-17T23:01:46.836943307Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":"--- SKIP: TestWriteReplaySignatureFixtures (0.00s)\n"}
+{"Time":"2026-10-17T23:01:46.836954074Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Elapsed":0}
+{"Time":"2026-10-17T23:01:46.836964507Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:46.849129292Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Output":"ok \tgithub.com/netkingdom/access-engine/internal/sign\t0.139s\n"}
+{"Time":"2026-10-17T23:01:46.849204478Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Elapsed":0.139}
+{"Time":"2026-10-17T23:01:47.199768892Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":" runtime_rename_test.go:106: 14 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:01:47.199847387Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch (1.50s)\n"}
+{"Time":"2026-10-17T23:01:47.199860759Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Elapsed":1.5}
+{"Time":"2026-10-17T23:01:47.199881391Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine"}
+{"Time":"2026-10-17T23:01:47.199916396Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine\n"}
+{"Time":"2026-10-17T23:01:48.589626454Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/taskexecution"}
+{"Time":"2026-10-17T23:01:48.607197484Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary"}
+{"Time":"2026-10-17T23:01:48.607272589Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary\n"}
+{"Time":"2026-10-17T23:01:48.679303259Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect"}
+{"Time":"2026-10-17T23:01:48.679359148Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/redirect\n"}
+{"Time":"2026-10-17T23:01:48.680188733Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/redirect (0.00s)\n"}
+{"Time":"2026-10-17T23:01:48.680264523Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Elapsed":0}
+{"Time":"2026-10-17T23:01:48.680279149Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status"}
+{"Time":"2026-10-17T23:01:48.680288869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/status\n"}
+{"Time":"2026-10-17T23:01:48.68155125Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/status (0.00s)\n"}
+{"Time":"2026-10-17T23:01:48.68162952Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Elapsed":0}
+{"Time":"2026-10-17T23:01:48.681645435Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large"}
+{"Time":"2026-10-17T23:01:48.681654804Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/large\n"}
+{"Time":"2026-10-17T23:01:48.709958837Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/large (0.03s)\n"}
+{"Time":"2026-10-17T23:01:48.710026304Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:48.710043211Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate"}
+{"Time":"2026-10-17T23:01:48.710052869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/duplicate\n"}
+{"Time":"2026-10-17T23:01:48.748094294Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/duplicate (0.03s)\n"}
+{"Time":"2026-10-17T23:01:48.748213294Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:48.748250761Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8"}
+{"Time":"2026-10-17T23:01:48.748260491Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/invalid-utf8\n"}
+{"Time":"2026-10-17T23:01:48.748272673Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/invalid-utf8 (0.00s)\n"}
+{"Time":"2026-10-17T23:01:48.748282321Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Elapsed":0}
+{"Time":"2026-10-17T23:01:48.748298507Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media"}
+{"Time":"2026-10-17T23:01:48.748307903Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/media\n"}
+{"Time":"2026-10-17T23:01:48.748328012Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/media (0.00s)\n"}
+{"Time":"2026-10-17T23:01:48.748348201Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Elapsed":0}
+{"Time":"2026-10-17T23:01:48.748358508Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media"}
+{"Time":"2026-10-17T23:01:48.748366218Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/duplicate-media\n"}
+{"Time":"2026-10-17T23:01:48.763811016Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/duplicate-media (0.02s)\n"}
+{"Time":"2026-10-17T23:01:48.763886337Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:48.763907897Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed"}
+{"Time":"2026-10-17T23:01:48.76391842Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/compressed\n"}
+{"Time":"2026-10-17T23:01:48.778974238Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/compressed (0.02s)\n"}
+{"Time":"2026-10-17T23:01:48.779273611Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:48.779975378Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow"}
+{"Time":"2026-10-17T23:01:48.78026338Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/slow\n"}
+{"Time":"2026-10-17T23:01:48.830551236Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/slow (0.05s)\n"}
+{"Time":"2026-10-17T23:01:48.830723114Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:48.835894258Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary (0.22s)\n"}
+{"Time":"2026-10-17T23:01:48.835968326Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Elapsed":0.22}
+{"Time":"2026-10-17T23:01:48.8359882Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract"}
+{"Time":"2026-10-17T23:01:48.835999579Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Output":"=== RUN TestCryptographicInitiatorContract\n"}
+{"Time":"2026-10-17T23:01:49.604624823Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa"}
+{"Time":"2026-10-17T23:01:49.605065144Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Output":"=== RUN TestCryptographicInitiatorContract/old_mfa\n"}
+{"Time":"2026-10-17T23:01:49.62649078Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Output":"--- PASS: TestCryptographicInitiatorContract/old_mfa (0.01s)\n"}
+{"Time":"2026-10-17T23:01:49.626563585Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:49.626582756Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant"}
+{"Time":"2026-10-17T23:01:49.626595073Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Output":"=== RUN TestCryptographicInitiatorContract/foreign_tenant\n"}
+{"Time":"2026-10-17T23:01:49.627960023Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Output":"--- PASS: TestCryptographicInitiatorContract/foreign_tenant (0.02s)\n"}
+{"Time":"2026-10-17T23:01:49.631781181Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:49.631847106Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer"}
+{"Time":"2026-10-17T23:01:49.631858207Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Output":"=== RUN TestCryptographicInitiatorContract/issuer\n"}
+{"Time":"2026-10-17T23:01:49.633276863Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Output":"--- PASS: TestCryptographicInitiatorContract/issuer (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.633571394Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.633794751Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience"}
+{"Time":"2026-10-17T23:01:49.633815572Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Output":"=== RUN TestCryptographicInitiatorContract/audience\n"}
+{"Time":"2026-10-17T23:01:49.638678808Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Output":"--- PASS: TestCryptographicInitiatorContract/audience (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.643757007Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.64381699Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired"}
+{"Time":"2026-10-17T23:01:49.643827089Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Output":"=== RUN TestCryptographicInitiatorContract/expired\n"}
+{"Time":"2026-10-17T23:01:49.644130331Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Output":"--- PASS: TestCryptographicInitiatorContract/expired (0.01s)\n"}
+{"Time":"2026-10-17T23:01:49.644392444Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:49.644565169Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa"}
+{"Time":"2026-10-17T23:01:49.644592573Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Output":"=== RUN TestCryptographicInitiatorContract/no_mfa\n"}
+{"Time":"2026-10-17T23:01:49.649239919Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Output":"--- PASS: TestCryptographicInitiatorContract/no_mfa (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.649492555Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.650271941Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service"}
+{"Time":"2026-10-17T23:01:49.650313141Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Output":"=== RUN TestCryptographicInitiatorContract/service\n"}
+{"Time":"2026-10-17T23:01:49.65413771Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Output":"--- PASS: TestCryptographicInitiatorContract/service (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.65420717Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.654226917Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant"}
+{"Time":"2026-10-17T23:01:49.654235366Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Output":"=== RUN TestCryptographicInitiatorContract/registered_tenant\n"}
+{"Time":"2026-10-17T23:01:49.65866812Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Output":"--- PASS: TestCryptographicInitiatorContract/registered_tenant (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.663752661Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.663827676Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future"}
+{"Time":"2026-10-17T23:01:49.663839119Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Output":"=== RUN TestCryptographicInitiatorContract/future\n"}
+{"Time":"2026-10-17T23:01:49.664850845Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Output":"--- PASS: TestCryptographicInitiatorContract/future (0.01s)\n"}
+{"Time":"2026-10-17T23:01:49.667771171Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:49.667841722Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Output":"--- PASS: TestCryptographicInitiatorContract (0.83s)\n"}
+{"Time":"2026-10-17T23:01:49.66786037Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Elapsed":0.83}
+{"Time":"2026-10-17T23:01:49.667873445Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON"}
+{"Time":"2026-10-17T23:01:49.667886691Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Output":"=== RUN TestStrictClaimJSON\n"}
+{"Time":"2026-10-17T23:01:49.66790037Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Output":"--- PASS: TestStrictClaimJSON (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.667912381Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.667922571Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding"}
+{"Time":"2026-10-17T23:01:49.667931218Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Output":"=== RUN TestServicePilotAuthenticatedBinding\n"}
+{"Time":"2026-10-17T23:01:49.667942851Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Output":"--- PASS: TestServicePilotAuthenticatedBinding (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.667954708Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.667965574Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals"}
+{"Time":"2026-10-17T23:01:49.667977865Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Output":"=== RUN TestServicePilotRefusals\n"}
+{"Time":"2026-10-17T23:01:49.667989587Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject"}
+{"Time":"2026-10-17T23:01:49.668000245Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Output":"=== RUN TestServicePilotRefusals/subject\n"}
+{"Time":"2026-10-17T23:01:49.668013699Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Output":"--- PASS: TestServicePilotRefusals/subject (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.66806608Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668080012Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant"}
+{"Time":"2026-10-17T23:01:49.668091924Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Output":"=== RUN TestServicePilotRefusals/foreigntenant\n"}
+{"Time":"2026-10-17T23:01:49.668103376Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Output":"--- PASS: TestServicePilotRefusals/foreigntenant (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668128128Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668140987Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal"}
+{"Time":"2026-10-17T23:01:49.668160302Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Output":"=== RUN TestServicePilotRefusals/wrong_service_principal\n"}
+{"Time":"2026-10-17T23:01:49.668178093Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Output":"--- PASS: TestServicePilotRefusals/wrong_service_principal (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668190536Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668201393Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience"}
+{"Time":"2026-10-17T23:01:49.668212493Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Output":"=== RUN TestServicePilotRefusals/wrong_audience\n"}
+{"Time":"2026-10-17T23:01:49.66822739Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Output":"--- PASS: TestServicePilotRefusals/wrong_audience (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668238138Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668248779Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport"}
+{"Time":"2026-10-17T23:01:49.66825794Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Output":"=== RUN TestServicePilotRefusals/expired_transport\n"}
+{"Time":"2026-10-17T23:01:49.668270555Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Output":"--- PASS: TestServicePilotRefusals/expired_transport (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668285479Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668297129Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry"}
+{"Time":"2026-10-17T23:01:49.668305768Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Output":"=== RUN TestServicePilotRefusals/missing_expiry\n"}
+{"Time":"2026-10-17T23:01:49.668347869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Output":"--- PASS: TestServicePilotRefusals/missing_expiry (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668362468Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668435138Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified"}
+{"Time":"2026-10-17T23:01:49.668465734Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Output":"=== RUN TestServicePilotRefusals/caller_verified\n"}
+{"Time":"2026-10-17T23:01:49.668487339Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Output":"--- PASS: TestServicePilotRefusals/caller_verified (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668499233Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668510504Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection"}
+{"Time":"2026-10-17T23:01:49.668520514Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Output":"=== RUN TestServicePilotRefusals/human_projection\n"}
+{"Time":"2026-10-17T23:01:49.668532083Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Output":"--- PASS: TestServicePilotRefusals/human_projection (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668543174Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668553832Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human"}
+{"Time":"2026-10-17T23:01:49.668562714Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Output":"=== RUN TestServicePilotRefusals/human\n"}
+{"Time":"2026-10-17T23:01:49.668575077Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Output":"--- PASS: TestServicePilotRefusals/human (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668586448Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668595672Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply"}
+{"Time":"2026-10-17T23:01:49.668609721Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Output":"=== RUN TestServicePilotRefusals/legacy_apply\n"}
+{"Time":"2026-10-17T23:01:49.66862194Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Output":"--- PASS: TestServicePilotRefusals/legacy_apply (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668632454Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.668643617Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation"}
+{"Time":"2026-10-17T23:01:49.668672328Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Output":"=== RUN TestServicePilotRefusals/delegation\n"}
+{"Time":"2026-10-17T23:01:49.668689614Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Output":"--- PASS: TestServicePilotRefusals/delegation (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.668701481Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.671534502Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding"}
+{"Time":"2026-10-17T23:01:49.671589742Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Output":"=== RUN TestServicePilotRefusals/forged_binding\n"}
+{"Time":"2026-10-17T23:01:49.671606911Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Output":"--- PASS: TestServicePilotRefusals/forged_binding (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.671617677Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.671628543Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime"}
+{"Time":"2026-10-17T23:01:49.671637515Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Output":"=== RUN TestServicePilotRefusals/lifetime\n"}
+{"Time":"2026-10-17T23:01:49.67165958Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Output":"--- PASS: TestServicePilotRefusals/lifetime (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.671670049Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.671719834Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Output":"--- PASS: TestServicePilotRefusals (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.671729771Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.671737552Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode"}
+{"Time":"2026-10-17T23:01:49.671745298Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Output":"=== RUN TestServiceInputRuntimeRecheckAndStrictHTTPDecode\n"}
+{"Time":"2026-10-17T23:01:49.671758328Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Output":"--- PASS: TestServiceInputRuntimeRecheckAndStrictHTTPDecode (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.671785443Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.671809059Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:49.680690844Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Output":"ok \tgithub.com/netkingdom/access-engine/internal/taskexecution\t1.091s\n"}
+{"Time":"2026-10-17T23:01:49.680896933Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Elapsed":1.091}
+{"Time":"2026-10-17T23:01:49.872618284Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Output":"--- PASS: TestInformedDecisionAttributeAdmission (5.52s)\n"}
+{"Time":"2026-10-17T23:01:49.872703794Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Elapsed":5.52}
+{"Time":"2026-10-17T23:01:49.872725156Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild"}
+{"Time":"2026-10-17T23:01:49.872738655Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Output":"=== RUN TestSittingImagePinMatchesRecordedBuild\n"}
+{"Time":"2026-10-17T23:01:49.872779052Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Output":"--- PASS: TestSittingImagePinMatchesRecordedBuild (0.00s)\n"}
+{"Time":"2026-10-17T23:01:49.872803164Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Elapsed":0}
+{"Time":"2026-10-17T23:01:49.872871371Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator"}
+{"Time":"2026-10-17T23:01:49.872904112Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":"=== RUN TestAdmissionSetGenerator\n"}
+{"Time":"2026-10-17T23:01:50.205013379Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/api"}
+{"Time":"2026-10-17T23:01:50.229803191Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim"}
+{"Time":"2026-10-17T23:01:50.229877367Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Output":"=== RUN TestApprovalBindingDigestSurvivesAttachingTheClaim\n"}
+{"Time":"2026-10-17T23:01:50.232178073Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Output":"--- PASS: TestApprovalBindingDigestSurvivesAttachingTheClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.235769436Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.235840627Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached"}
+{"Time":"2026-10-17T23:01:50.235853035Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Output":"=== RUN TestRequestDigestStillMovesWhenTheClaimIsAttached\n"}
+{"Time":"2026-10-17T23:01:50.235872187Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Output":"--- PASS: TestRequestDigestStillMovesWhenTheClaimIsAttached (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.235884009Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.235894415Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest"}
+{"Time":"2026-10-17T23:01:50.235902539Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Output":"=== RUN TestTheTwoDigestsDisagreeOnAClaimBearingRequest\n"}
+{"Time":"2026-10-17T23:01:50.235913522Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Output":"--- PASS: TestTheTwoDigestsDisagreeOnAClaimBearingRequest (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.235944713Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.235956985Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim"}
+{"Time":"2026-10-17T23:01:50.236160739Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Output":"=== RUN TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim\n"}
+{"Time":"2026-10-17T23:01:50.236188819Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Output":"--- PASS: TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.236199459Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.236211759Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent"}
+{"Time":"2026-10-17T23:01:50.236220505Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Output":"=== RUN TestBindingOmitsApprovalDigestWhenNoClaimIsPresent\n"}
+{"Time":"2026-10-17T23:01:50.236231678Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Output":"--- PASS: TestBindingOmitsApprovalDigestWhenNoClaimIsPresent (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.236240948Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.236249947Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest"}
+{"Time":"2026-10-17T23:01:50.236257837Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Output":"=== RUN TestOtherContextClaimsStillBindUnderTheApprovalDigest\n"}
+{"Time":"2026-10-17T23:01:50.236268117Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Output":"--- PASS: TestOtherContextClaimsStillBindUnderTheApprovalDigest (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.236275709Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.236287711Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant"}
+{"Time":"2026-10-17T23:01:50.236295087Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Output":"=== RUN TestDecisionEffectsListsEveryConstant\n"}
+{"Time":"2026-10-17T23:01:50.243794553Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Output":"--- PASS: TestDecisionEffectsListsEveryConstant (0.01s)\n"}
+{"Time":"2026-10-17T23:01:50.243875825Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:50.24389377Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection"}
+{"Time":"2026-10-17T23:01:50.243904807Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Output":"=== RUN TestRestrictsSplitsByDirection\n"}
+{"Time":"2026-10-17T23:01:50.243940984Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Output":"--- PASS: TestRestrictsSplitsByDirection (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.243950966Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.243959722Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding"}
+{"Time":"2026-10-17T23:01:50.243968216Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding\n"}
+{"Time":"2026-10-17T23:01:50.243978829Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action"}
+{"Time":"2026-10-17T23:01:50.243987008Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/action\n"}
+{"Time":"2026-10-17T23:01:50.243998433Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/action (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244008523Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244018054Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant"}
+{"Time":"2026-10-17T23:01:50.244025701Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/tenant\n"}
+{"Time":"2026-10-17T23:01:50.244040697Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/tenant (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244049615Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244057929Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog"}
+{"Time":"2026-10-17T23:01:50.244065404Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/catalog\n"}
+{"Time":"2026-10-17T23:01:50.244075909Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/catalog (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244085287Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244094313Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr"}
+{"Time":"2026-10-17T23:01:50.244101942Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/ccr\n"}
+{"Time":"2026-10-17T23:01:50.244137731Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/ccr (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244156731Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244167993Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source"}
+{"Time":"2026-10-17T23:01:50.244177037Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/source\n"}
+{"Time":"2026-10-17T23:01:50.244189454Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/source (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244199851Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244208282Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target"}
+{"Time":"2026-10-17T23:01:50.244215758Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/target\n"}
+{"Time":"2026-10-17T23:01:50.244226227Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/target (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244236732Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.24424629Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body"}
+{"Time":"2026-10-17T23:01:50.244254216Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/body\n"}
+{"Time":"2026-10-17T23:01:50.24426473Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/body (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244273838Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244282629Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal"}
+{"Time":"2026-10-17T23:01:50.244291358Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/principal\n"}
+{"Time":"2026-10-17T23:01:50.244302936Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/principal (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.24432832Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244338374Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id"}
+{"Time":"2026-10-17T23:01:50.244345822Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id\n"}
+{"Time":"2026-10-17T23:01:50.244355904Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.24436484Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.2443731Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method"}
+{"Time":"2026-10-17T23:01:50.244380692Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/method\n"}
+{"Time":"2026-10-17T23:01:50.244391296Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/method (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.24440191Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.244412361Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.244422911Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.247900169Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment"}
+{"Time":"2026-10-17T23:01:50.247961811Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Output":"=== RUN TestExecutionContractApprovalJoinAndEnrichment\n"}
+{"Time":"2026-10-17T23:01:50.24872908Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Output":"--- PASS: TestExecutionContractApprovalJoinAndEnrichment (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.248898532Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.249160907Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet"}
+{"Time":"2026-10-17T23:01:50.249188184Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Output":"=== RUN TestPurposeEntersDigestsOnlyWhenSet\n"}
+{"Time":"2026-10-17T23:01:50.249419684Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Output":"--- PASS: TestPurposeEntersDigestsOnlyWhenSet (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.255818619Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.25589862Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses"}
+{"Time":"2026-10-17T23:01:50.255911289Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Output":"=== RUN TestCaringAccessDescriptorExampleParses\n"}
+{"Time":"2026-10-17T23:01:50.255935392Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Output":"--- PASS: TestCaringAccessDescriptorExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.255954896Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.255965221Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses"}
+{"Time":"2026-10-17T23:01:50.255972868Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Output":"=== RUN TestCheckRequestExampleParses\n"}
+{"Time":"2026-10-17T23:01:50.255984779Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Output":"--- PASS: TestCheckRequestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.255995095Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.2560045Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse"}
+{"Time":"2026-10-17T23:01:50.256012616Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Output":"=== RUN TestRegistryExamplesParse\n"}
+{"Time":"2026-10-17T23:01:50.256022977Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Output":"--- PASS: TestRegistryExamplesParse (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.256032201Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.256045177Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse"}
+{"Time":"2026-10-17T23:01:50.256053139Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Output":"=== RUN TestDecisionAndAuditExamplesParse\n"}
+{"Time":"2026-10-17T23:01:50.256063356Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Output":"--- PASS: TestDecisionAndAuditExamplesParse (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.256072671Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.256081724Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses"}
+{"Time":"2026-10-17T23:01:50.256089731Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Output":"=== RUN TestActionAuthorizationExampleParses\n"}
+{"Time":"2026-10-17T23:01:50.256099912Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Output":"--- PASS: TestActionAuthorizationExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.256109163Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.256140706Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction"}
+{"Time":"2026-10-17T23:01:50.256150643Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Output":"=== RUN TestRequestDigestIgnoresIDAndChangesWithAction\n"}
+{"Time":"2026-10-17T23:01:50.256162546Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Output":"--- PASS: TestRequestDigestIgnoresIDAndChangesWithAction (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.256171536Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.256181337Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone"}
+{"Time":"2026-10-17T23:01:50.256189327Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Output":"=== RUN TestApplyAllowLifetimeDefaultDeclaredAndNone\n"}
+{"Time":"2026-10-17T23:01:50.256199507Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Output":"--- PASS: TestApplyAllowLifetimeDefaultDeclaredAndNone (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.256208371Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.256217262Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON"}
+{"Time":"2026-10-17T23:01:50.256229246Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Output":"=== RUN TestSchemaFilesAreJSON\n"}
+{"Time":"2026-10-17T23:01:50.256239183Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json"}
+{"Time":"2026-10-17T23:01:50.256247236Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/action_authorization.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.264061772Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/action_authorization.schema.json (0.01s)\n"}
+{"Time":"2026-10-17T23:01:50.267777853Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:50.267844517Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json"}
+{"Time":"2026-10-17T23:01:50.267856835Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/audit_event.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.26787303Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/audit_event.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.267882417Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.267988379Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json"}
+{"Time":"2026-10-17T23:01:50.268009705Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/caring_access_descriptor.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.26818323Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/caring_access_descriptor.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.268221004Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.268240373Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json"}
+{"Time":"2026-10-17T23:01:50.268249588Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/caring_profile.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.268270842Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/caring_profile.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.268282077Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.268292168Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json"}
+{"Time":"2026-10-17T23:01:50.268300355Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/check_request.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.268314152Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/check_request.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.26832646Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.268336118Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json"}
+{"Time":"2026-10-17T23:01:50.26834674Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/decision_envelope.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.268357759Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/decision_envelope.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.268367543Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.268376939Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json"}
+{"Time":"2026-10-17T23:01:50.268384919Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/policy_fixture.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.268395442Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/policy_fixture.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.268404676Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.268413549Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json"}
+{"Time":"2026-10-17T23:01:50.268439302Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/policy_package.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.271756894Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/policy_package.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.271819177Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.27183236Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json"}
+{"Time":"2026-10-17T23:01:50.271841089Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/protected_system_manifest.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.271917402Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/protected_system_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.27193283Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.27194485Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json"}
+{"Time":"2026-10-17T23:01:50.271953795Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_request.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.271969494Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_request.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.271979278Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.271988403Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json"}
+{"Time":"2026-10-17T23:01:50.271996284Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_response.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.272007439Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_response.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.27201724Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.272026384Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json"}
+{"Time":"2026-10-17T23:01:50.272041704Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_systems.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.272052904Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_systems.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.272084121Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.272095294Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json"}
+{"Time":"2026-10-17T23:01:50.272105069Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/relationship_fact.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.272116349Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/relationship_fact.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.272136268Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.272145926Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json"}
+{"Time":"2026-10-17T23:01:50.272154636Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/resource_manifest.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.274312861Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/resource_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.274553333Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.274755509Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json"}
+{"Time":"2026-10-17T23:01:50.274781938Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/subject_manifest.schema.json\n"}
+{"Time":"2026-10-17T23:01:50.280167553Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/subject_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.280240133Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.28037186Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Output":"--- PASS: TestSchemaFilesAreJSON (0.02s)\n"}
+{"Time":"2026-10-17T23:01:50.280390606Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:50.280403708Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses"}
+{"Time":"2026-10-17T23:01:50.280511474Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Output":"=== RUN TestResourceManifestExampleParses\n"}
+{"Time":"2026-10-17T23:01:50.280529391Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Output":"--- PASS: TestResourceManifestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.280541429Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.280553341Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields"}
+{"Time":"2026-10-17T23:01:50.280588075Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Output":"=== RUN TestResourceManifestRequiredFields\n"}
+{"Time":"2026-10-17T23:01:50.280603188Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Output":"--- PASS: TestResourceManifestRequiredFields (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.280613405Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.280622972Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses"}
+{"Time":"2026-10-17T23:01:50.280631259Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Output":"=== RUN TestMarkitectProtectedSystemNamespaceExampleParses\n"}
+{"Time":"2026-10-17T23:01:50.280642783Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Output":"--- PASS: TestMarkitectProtectedSystemNamespaceExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.280660466Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.280670222Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses"}
+{"Time":"2026-10-17T23:01:50.280677824Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Output":"=== RUN TestMarkitectNamespaceResourceManifestExampleParses\n"}
+{"Time":"2026-10-17T23:01:50.280687761Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Output":"--- PASS: TestMarkitectNamespaceResourceManifestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:01:50.280696607Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:01:50.280705065Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:50.29141541Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/api\t0.086s\n"}
+{"Time":"2026-10-17T23:01:50.291477124Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Elapsed":0.086}
+{"Time":"2026-10-17T23:01:51.136444557Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":"--- PASS: TestAdmissionSetGenerator (1.26s)\n"}
+{"Time":"2026-10-17T23:01:51.136530735Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Elapsed":1.26}
+{"Time":"2026-10-17T23:01:51.136554342Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle"}
+{"Time":"2026-10-17T23:01:51.136600348Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Output":"=== RUN TestInformedDecisionLifecycle\n"}
+{"Time":"2026-10-17T23:01:51.233858332Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":" runtime_rename_test.go:106: 31 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:01:51.233934374Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine (4.04s)\n"}
+{"Time":"2026-10-17T23:01:51.233971552Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Elapsed":4.04}
+{"Time":"2026-10-17T23:01:51.233994105Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine"}
+{"Time":"2026-10-17T23:01:51.234005052Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine\n"}
+{"Time":"2026-10-17T23:01:51.269958861Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access"}
+{"Time":"2026-10-17T23:01:51.270019276Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Output":"=== RUN TestInformedDecisionLifecycle/readback_application_access\n"}
+{"Time":"2026-10-17T23:01:51.302165335Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Output":"--- PASS: TestInformedDecisionLifecycle/readback_application_access (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.302228041Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.302246202Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose"}
+{"Time":"2026-10-17T23:01:51.302255021Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Output":"=== RUN TestInformedDecisionLifecycle/application_access_without_readback_purpose\n"}
+{"Time":"2026-10-17T23:01:51.347794173Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_without_readback_purpose (0.04s)\n"}
+{"Time":"2026-10-17T23:01:51.347864868Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:51.347881523Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access"}
+{"Time":"2026-10-17T23:01:51.347898565Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Output":"=== RUN TestInformedDecisionLifecycle/workload_application_access\n"}
+{"Time":"2026-10-17T23:01:51.363776923Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Output":"--- PASS: TestInformedDecisionLifecycle/workload_application_access (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.36384238Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.363858196Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group"}
+{"Time":"2026-10-17T23:01:51.363878737Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Output":"=== RUN TestInformedDecisionLifecycle/application_access_outside_group\n"}
+{"Time":"2026-10-17T23:01:51.387519424Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_outside_group (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.387700842Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.387727326Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA"}
+{"Time":"2026-10-17T23:01:51.387736505Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Output":"=== RUN TestInformedDecisionLifecycle/application_access_stale_MFA\n"}
+{"Time":"2026-10-17T23:01:51.411767379Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_stale_MFA (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.411831528Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.411847056Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp"}
+{"Time":"2026-10-17T23:01:51.411855929Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Output":"=== RUN TestInformedDecisionLifecycle/application_access_without_otp\n"}
+{"Time":"2026-10-17T23:01:51.439781852Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_without_otp (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.439857515Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.439879743Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application"}
+{"Time":"2026-10-17T23:01:51.439890176Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Output":"=== RUN TestInformedDecisionLifecycle/application_access_other_application\n"}
+{"Time":"2026-10-17T23:01:51.463801276Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_other_application (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.463863892Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.463877571Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant"}
+{"Time":"2026-10-17T23:01:51.463886057Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Output":"=== RUN TestInformedDecisionLifecycle/application_access_foreign_tenant\n"}
+{"Time":"2026-10-17T23:01:51.48380677Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_foreign_tenant (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.483873353Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.483889521Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration"}
+{"Time":"2026-10-17T23:01:51.483898097Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Output":"=== RUN TestInformedDecisionLifecycle/human_registration\n"}
+{"Time":"2026-10-17T23:01:51.503805982Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Output":"--- PASS: TestInformedDecisionLifecycle/human_registration (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.503870348Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.503886281Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration"}
+{"Time":"2026-10-17T23:01:51.503904821Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Output":"=== RUN TestInformedDecisionLifecycle/workload_registration\n"}
+{"Time":"2026-10-17T23:01:51.542478147Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Output":"--- PASS: TestInformedDecisionLifecycle/workload_registration (0.04s)\n"}
+{"Time":"2026-10-17T23:01:51.542548897Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:51.542565227Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload"}
+{"Time":"2026-10-17T23:01:51.542575047Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Output":"=== RUN TestInformedDecisionLifecycle/foreign_workload\n"}
+{"Time":"2026-10-17T23:01:51.563507705Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Output":"--- PASS: TestInformedDecisionLifecycle/foreign_workload (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.563599356Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.56364446Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience"}
+{"Time":"2026-10-17T23:01:51.563660538Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Output":"=== RUN TestInformedDecisionLifecycle/wrong_workload_audience\n"}
+{"Time":"2026-10-17T23:01:51.599791167Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_workload_audience (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.599918969Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.599983785Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID"}
+{"Time":"2026-10-17T23:01:51.59999833Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Output":"=== RUN TestInformedDecisionLifecycle/missing_workload_UID\n"}
+{"Time":"2026-10-17T23:01:51.60770714Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Output":"--- PASS: TestInformedDecisionLifecycle/missing_workload_UID (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.60777678Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.607795211Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant"}
+{"Time":"2026-10-17T23:01:51.607805455Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Output":"=== RUN TestInformedDecisionLifecycle/wrong_tenant\n"}
+{"Time":"2026-10-17T23:01:51.641346999Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_tenant (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.641421256Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.641449859Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group"}
+{"Time":"2026-10-17T23:01:51.641474025Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Output":"=== RUN TestInformedDecisionLifecycle/outside_human_group\n"}
+{"Time":"2026-10-17T23:01:51.666750691Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Output":"--- PASS: TestInformedDecisionLifecycle/outside_human_group (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.667031214Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.667123596Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA"}
+{"Time":"2026-10-17T23:01:51.667140359Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Output":"=== RUN TestInformedDecisionLifecycle/stale_author_MFA\n"}
+{"Time":"2026-10-17T23:01:51.707830496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/stale_author_MFA (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.707895249Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.70791276Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA"}
+{"Time":"2026-10-17T23:01:51.707923635Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Output":"=== RUN TestInformedDecisionLifecycle/future_author_MFA\n"}
+{"Time":"2026-10-17T23:01:51.713466719Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/future_author_MFA (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.713563384Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.713583357Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity"}
+{"Time":"2026-10-17T23:01:51.71359333Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Output":"=== RUN TestInformedDecisionLifecycle/asserted_identity\n"}
+{"Time":"2026-10-17T23:01:51.751861593Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Output":"--- PASS: TestInformedDecisionLifecycle/asserted_identity (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.751934362Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.751954182Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read"}
+{"Time":"2026-10-17T23:01:51.75196264Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Output":"=== RUN TestInformedDecisionLifecycle/owner_read\n"}
+{"Time":"2026-10-17T23:01:51.775700315Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Output":"--- PASS: TestInformedDecisionLifecycle/owner_read (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.77592534Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.776098967Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read"}
+{"Time":"2026-10-17T23:01:51.776118787Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Output":"=== RUN TestInformedDecisionLifecycle/foreign_unpublished_read\n"}
+{"Time":"2026-10-17T23:01:51.782579835Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/decisionpep"}
+{"Time":"2026-10-17T23:01:51.782919335Z","Action":"start","Package":"github.com/netkingdom/access-engine/testsupport/signfixture"}
+{"Time":"2026-10-17T23:01:51.782957658Z","Action":"output","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Output":"? \tgithub.com/netkingdom/access-engine/testsupport/signfixture\t[no test files]\n"}
+{"Time":"2026-10-17T23:01:51.782974448Z","Action":"skip","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.782999868Z","Action":"start","Package":"github.com/netkingdom/access-engine/tools"}
+{"Time":"2026-10-17T23:01:51.783013781Z","Action":"output","Package":"github.com/netkingdom/access-engine/tools","Output":"? \tgithub.com/netkingdom/access-engine/tools\t[no test files]\n"}
+{"Time":"2026-10-17T23:01:51.783034206Z","Action":"skip","Package":"github.com/netkingdom/access-engine/tools","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.792960825Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision"}
+{"Time":"2026-10-17T23:01:51.793022828Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"=== RUN TestAuthenticDecisionProducerCanonicalPrecision\n"}
+{"Time":"2026-10-17T23:01:51.794765934Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Output":"--- PASS: TestInformedDecisionLifecycle/foreign_unpublished_read (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.794863122Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.794882464Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator"}
+{"Time":"2026-10-17T23:01:51.794891517Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Output":"=== RUN TestInformedDecisionLifecycle/published_collaborator\n"}
+{"Time":"2026-10-17T23:01:51.804115116Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"--- PASS: TestAuthenticDecisionProducerCanonicalPrecision (0.01s)\n"}
+{"Time":"2026-10-17T23:01:51.804289672Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:51.804598008Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings"}
+{"Time":"2026-10-17T23:01:51.804623256Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"=== RUN TestDecisionAdverseBindings\n"}
+{"Time":"2026-10-17T23:01:51.805022549Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired"}
+{"Time":"2026-10-17T23:01:51.805052098Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"=== RUN TestDecisionAdverseBindings/expired\n"}
+{"Time":"2026-10-17T23:01:51.811884594Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"--- PASS: TestDecisionAdverseBindings/expired (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.811961755Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.811983315Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned"}
+{"Time":"2026-10-17T23:01:51.811998879Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"=== RUN TestDecisionAdverseBindings/unsigned\n"}
+{"Time":"2026-10-17T23:01:51.812010421Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"--- PASS: TestDecisionAdverseBindings/unsigned (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.812020574Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.812029646Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy"}
+{"Time":"2026-10-17T23:01:51.812038248Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"=== RUN TestDecisionAdverseBindings/policy\n"}
+{"Time":"2026-10-17T23:01:51.814200927Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"--- PASS: TestDecisionAdverseBindings/policy (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.815790722Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.815838496Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant"}
+{"Time":"2026-10-17T23:01:51.815863762Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"=== RUN TestDecisionAdverseBindings/tenant\n"}
+{"Time":"2026-10-17T23:01:51.833141737Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Output":"--- PASS: TestInformedDecisionLifecycle/published_collaborator (0.04s)\n"}
+{"Time":"2026-10-17T23:01:51.833208753Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:51.833231278Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor"}
+{"Time":"2026-10-17T23:01:51.833300945Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Output":"=== RUN TestInformedDecisionLifecycle/new_revision_editor\n"}
+{"Time":"2026-10-17T23:01:51.833828148Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"--- PASS: TestDecisionAdverseBindings/tenant (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.834036094Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.834153436Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor"}
+{"Time":"2026-10-17T23:01:51.834170893Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"=== RUN TestDecisionAdverseBindings/actor\n"}
+{"Time":"2026-10-17T23:01:51.837120291Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"--- PASS: TestDecisionAdverseBindings/actor (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.837529395Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.837812356Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context"}
+{"Time":"2026-10-17T23:01:51.837848948Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"=== RUN TestDecisionAdverseBindings/context\n"}
+{"Time":"2026-10-17T23:01:51.842813354Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"--- PASS: TestDecisionAdverseBindings/context (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.842881722Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.842895843Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile"}
+{"Time":"2026-10-17T23:01:51.842903742Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"=== RUN TestDecisionAdverseBindings/legacy-numeric-profile\n"}
+{"Time":"2026-10-17T23:01:51.847779017Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"--- PASS: TestDecisionAdverseBindings/legacy-numeric-profile (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.847847242Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.847881381Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience"}
+{"Time":"2026-10-17T23:01:51.847891643Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"=== RUN TestDecisionAdverseBindings/caller-audience\n"}
+{"Time":"2026-10-17T23:01:51.848293596Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"--- PASS: TestDecisionAdverseBindings/caller-audience (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.848480054Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.848653808Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision"}
+{"Time":"2026-10-17T23:01:51.848675404Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"=== RUN TestDecisionAdverseBindings/stale-decision\n"}
+{"Time":"2026-10-17T23:01:51.852645491Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"--- PASS: TestDecisionAdverseBindings/stale-decision (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.855735423Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.855797452Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect"}
+{"Time":"2026-10-17T23:01:51.855807885Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"=== RUN TestDecisionAdverseBindings/effect\n"}
+{"Time":"2026-10-17T23:01:51.855823494Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"--- PASS: TestDecisionAdverseBindings/effect (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.855873693Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.855884126Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator"}
+{"Time":"2026-10-17T23:01:51.85589207Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"=== RUN TestDecisionAdverseBindings/evaluator\n"}
+{"Time":"2026-10-17T23:01:51.858450074Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"--- PASS: TestDecisionAdverseBindings/evaluator (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.858671854Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.858810034Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource"}
+{"Time":"2026-10-17T23:01:51.858827879Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"=== RUN TestDecisionAdverseBindings/resource\n"}
+{"Time":"2026-10-17T23:01:51.861463576Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"--- PASS: TestDecisionAdverseBindings/resource (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.861629836Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.86380334Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted"}
+{"Time":"2026-10-17T23:01:51.863856596Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"=== RUN TestDecisionAdverseBindings/submitted\n"}
+{"Time":"2026-10-17T23:01:51.870295462Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"--- PASS: TestDecisionAdverseBindings/submitted (0.01s)\n"}
+{"Time":"2026-10-17T23:01:51.870607639Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:51.870777263Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn"}
+{"Time":"2026-10-17T23:01:51.870798165Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"=== RUN TestDecisionAdverseBindings/caller-warn\n"}
+{"Time":"2026-10-17T23:01:51.875782575Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Output":"--- PASS: TestInformedDecisionLifecycle/new_revision_editor (0.04s)\n"}
+{"Time":"2026-10-17T23:01:51.875861792Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:51.875875922Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action"}
+{"Time":"2026-10-17T23:01:51.87588529Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Output":"=== RUN TestInformedDecisionLifecycle/unknown_action\n"}
+{"Time":"2026-10-17T23:01:51.875926283Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"--- PASS: TestDecisionAdverseBindings/caller-warn (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.875951621Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.875963506Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin"}
+{"Time":"2026-10-17T23:01:51.875970954Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"=== RUN TestDecisionAdverseBindings/future-begin\n"}
+{"Time":"2026-10-17T23:01:51.876950246Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"--- PASS: TestDecisionAdverseBindings/future-begin (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.877244136Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.877459378Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry"}
+{"Time":"2026-10-17T23:01:51.877486574Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"=== RUN TestDecisionAdverseBindings/subnanosecond-expiry\n"}
+{"Time":"2026-10-17T23:01:51.880354356Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"--- PASS: TestDecisionAdverseBindings/subnanosecond-expiry (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.880547894Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.883759973Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation"}
+{"Time":"2026-10-17T23:01:51.88382487Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"=== RUN TestDecisionAdverseBindings/obligation\n"}
+{"Time":"2026-10-17T23:01:51.883846376Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"--- PASS: TestDecisionAdverseBindings/obligation (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.883858892Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.883871273Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version"}
+{"Time":"2026-10-17T23:01:51.883879993Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"=== RUN TestDecisionAdverseBindings/version\n"}
+{"Time":"2026-10-17T23:01:51.886317562Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"--- PASS: TestDecisionAdverseBindings/version (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.886515004Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.886653761Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry"}
+{"Time":"2026-10-17T23:01:51.886672382Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"=== RUN TestDecisionAdverseBindings/registry\n"}
+{"Time":"2026-10-17T23:01:51.88949681Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"--- PASS: TestDecisionAdverseBindings/registry (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.889691384Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.889841161Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal"}
+{"Time":"2026-10-17T23:01:51.88986181Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"=== RUN TestDecisionAdverseBindings/caller-principal\n"}
+{"Time":"2026-10-17T23:01:51.892954564Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"--- PASS: TestDecisionAdverseBindings/caller-principal (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.893200564Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.89333631Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL"}
+{"Time":"2026-10-17T23:01:51.893356553Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"=== RUN TestDecisionAdverseBindings/missing-TTL\n"}
+{"Time":"2026-10-17T23:01:51.89659949Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"--- PASS: TestDecisionAdverseBindings/missing-TTL (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.897671902Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.897854943Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL"}
+{"Time":"2026-10-17T23:01:51.897886954Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"=== RUN TestDecisionAdverseBindings/excess-TTL\n"}
+{"Time":"2026-10-17T23:01:51.899197341Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Output":"--- PASS: TestInformedDecisionLifecycle/unknown_action (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.899251399Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.899268243Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance"}
+{"Time":"2026-10-17T23:01:51.899278622Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Output":"=== RUN TestInformedDecisionLifecycle/agent_acceptance\n"}
+{"Time":"2026-10-17T23:01:51.901041476Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"--- PASS: TestDecisionAdverseBindings/excess-TTL (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.901257484Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.901383771Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest"}
+{"Time":"2026-10-17T23:01:51.90140222Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"=== RUN TestDecisionAdverseBindings/policy-digest\n"}
+{"Time":"2026-10-17T23:01:51.904154374Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"--- PASS: TestDecisionAdverseBindings/policy-digest (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.907238905Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.907306084Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action"}
+{"Time":"2026-10-17T23:01:51.907317094Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"=== RUN TestDecisionAdverseBindings/action\n"}
+{"Time":"2026-10-17T23:01:51.907334019Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"--- PASS: TestDecisionAdverseBindings/action (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.90746412Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.907572895Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose"}
+{"Time":"2026-10-17T23:01:51.907589099Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"=== RUN TestDecisionAdverseBindings/purpose\n"}
+{"Time":"2026-10-17T23:01:51.910533375Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"--- PASS: TestDecisionAdverseBindings/purpose (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.915792473Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Output":"--- PASS: TestInformedDecisionLifecycle/agent_acceptance (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.915878164Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.91589646Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded"}
+{"Time":"2026-10-17T23:01:51.915905153Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Output":"=== RUN TestInformedDecisionLifecycle/human_acceptance_excluded\n"}
+{"Time":"2026-10-17T23:01:51.915934991Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.915946199Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired"}
+{"Time":"2026-10-17T23:01:51.915955244Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"=== RUN TestDecisionAdverseBindings/caller-expired\n"}
+{"Time":"2026-10-17T23:01:51.915978075Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"--- PASS: TestDecisionAdverseBindings/caller-expired (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.915987994Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.916001538Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"--- PASS: TestDecisionAdverseBindings (0.11s)\n"}
+{"Time":"2026-10-17T23:01:51.916019888Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Elapsed":0.11}
+{"Time":"2026-10-17T23:01:51.916029573Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay"}
+{"Time":"2026-10-17T23:01:51.916037508Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"=== RUN TestSignatureForgeryAndReplay\n"}
+{"Time":"2026-10-17T23:01:51.91604694Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload"}
+{"Time":"2026-10-17T23:01:51.916054758Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"=== RUN TestSignatureForgeryAndReplay/forged-payload\n"}
+{"Time":"2026-10-17T23:01:51.919115939Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"--- PASS: TestSignatureForgeryAndReplay/forged-payload (0.01s)\n"}
+{"Time":"2026-10-17T23:01:51.926670046Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:51.9267358Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key"}
+{"Time":"2026-10-17T23:01:51.926748451Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"=== RUN TestSignatureForgeryAndReplay/wrong-key\n"}
+{"Time":"2026-10-17T23:01:51.926800066Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"--- PASS: TestSignatureForgeryAndReplay/wrong-key (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.926816739Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.926828858Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay"}
+{"Time":"2026-10-17T23:01:51.926837082Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"=== RUN TestSignatureForgeryAndReplay/replay\n"}
+{"Time":"2026-10-17T23:01:51.93134759Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"--- PASS: TestSignatureForgeryAndReplay/replay (0.01s)\n"}
+{"Time":"2026-10-17T23:01:51.931521812Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Elapsed":0.01}
+{"Time":"2026-10-17T23:01:51.931631408Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"--- PASS: TestSignatureForgeryAndReplay (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.934343652Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.934497658Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse"}
+{"Time":"2026-10-17T23:01:51.934526134Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"=== RUN TestUnavailableAndPublicTokenFileRefuse\n"}
+{"Time":"2026-10-17T23:01:51.934564124Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"--- PASS: TestUnavailableAndPublicTokenFileRefuse (0.00s)\n"}
+{"Time":"2026-10-17T23:01:51.934577109Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Elapsed":0}
+{"Time":"2026-10-17T23:01:51.934596523Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"PASS\n"}
+{"Time":"2026-10-17T23:01:51.944022572Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/decisionpep\t0.161s\n"}
+{"Time":"2026-10-17T23:01:51.944133502Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Elapsed":0.162}
+{"Time":"2026-10-17T23:01:51.945980079Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Output":"--- PASS: TestInformedDecisionLifecycle/human_acceptance_excluded (0.03s)\n"}
+{"Time":"2026-10-17T23:01:51.946136952Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:51.946360454Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group"}
+{"Time":"2026-10-17T23:01:51.946433457Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Output":"=== RUN TestInformedDecisionLifecycle/publish_initial_group\n"}
+{"Time":"2026-10-17T23:01:51.970686692Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Output":"--- PASS: TestInformedDecisionLifecycle/publish_initial_group (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.97077222Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.970792221Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group"}
+{"Time":"2026-10-17T23:01:51.970801626Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Output":"=== RUN TestInformedDecisionLifecycle/publish_other_group\n"}
+{"Time":"2026-10-17T23:01:51.973183902Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":" runtime_rename_test.go:106: 8 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:01:51.973258492Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine (0.74s)\n"}
+{"Time":"2026-10-17T23:01:51.973277393Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Elapsed":0.74}
+{"Time":"2026-10-17T23:01:51.973458125Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine"}
+{"Time":"2026-10-17T23:01:51.973478703Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine\n"}
+{"Time":"2026-10-17T23:01:51.991190804Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Output":"--- PASS: TestInformedDecisionLifecycle/publish_other_group (0.02s)\n"}
+{"Time":"2026-10-17T23:01:51.99126608Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:51.991282257Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing"}
+{"Time":"2026-10-17T23:01:51.991331085Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Output":"=== RUN TestInformedDecisionLifecycle/review_routing\n"}
+{"Time":"2026-10-17T23:01:52.007002912Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Output":"--- PASS: TestInformedDecisionLifecycle/review_routing (0.02s)\n"}
+{"Time":"2026-10-17T23:01:52.00708331Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:52.007116448Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing"}
+{"Time":"2026-10-17T23:01:52.007128838Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Output":"=== RUN TestInformedDecisionLifecycle/wrong_review_routing\n"}
+{"Time":"2026-10-17T23:01:52.031924215Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_review_routing (0.02s)\n"}
+{"Time":"2026-10-17T23:01:52.032001439Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:52.032020104Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Output":"--- PASS: TestInformedDecisionLifecycle (0.89s)\n"}
+{"Time":"2026-10-17T23:01:52.032037968Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Elapsed":0.89}
+{"Time":"2026-10-17T23:01:52.032050357Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins"}
+{"Time":"2026-10-17T23:01:52.032058536Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Output":"=== RUN TestInformedDecisionLifecycleReleasePins\n"}
+{"Time":"2026-10-17T23:02:00.038973017Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Output":"--- PASS: TestInformedDecisionLifecycleReleasePins (4.45s)\n"}
+{"Time":"2026-10-17T23:02:00.053493889Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Elapsed":4.45}
+{"Time":"2026-10-17T23:02:00.053565071Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs"}
+{"Time":"2026-10-17T23:02:00.053576478Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Output":"=== RUN TestT03ReviewActs\n"}
+{"Time":"2026-10-17T23:02:00.295165068Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":" runtime_rename_test.go:106: 41 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:02:00.295236124Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine (4.76s)\n"}
+{"Time":"2026-10-17T23:02:00.295326504Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Elapsed":4.76}
+{"Time":"2026-10-17T23:02:00.295344611Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle"}
+{"Time":"2026-10-17T23:02:00.295354385Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle\n"}
+{"Time":"2026-10-17T23:02:00.572278563Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":" runtime_rename_test.go:106: 2 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:02:00.572355822Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle (0.28s)\n"}
+{"Time":"2026-10-17T23:02:00.572371197Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Elapsed":0.28}
+{"Time":"2026-10-17T23:02:00.572398997Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting"}
+{"Time":"2026-10-17T23:02:00.572492199Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting\n"}
+{"Time":"2026-10-17T23:02:05.347104344Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Output":"--- PASS: TestT03ReviewActs (5.29s)\n"}
+{"Time":"2026-10-17T23:02:05.347173199Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Elapsed":5.29}
+{"Time":"2026-10-17T23:02:05.347186157Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords"}
+{"Time":"2026-10-17T23:02:05.347195418Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Output":"=== RUN TestWP0094ExactRecords\n"}
+{"Time":"2026-10-17T23:02:05.857674552Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":" runtime_rename_test.go:106: 4 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:02:05.857763084Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting (5.29s)\n"}
+{"Time":"2026-10-17T23:02:05.85778615Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Elapsed":5.29}
+{"Time":"2026-10-17T23:02:05.858029787Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03"}
+{"Time":"2026-10-17T23:02:05.858057253Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03\n"}
+{"Time":"2026-10-17T23:02:05.913704517Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":" runtime_rename_test.go:106: 1 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:02:05.91532351Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03 (0.06s)\n"}
+{"Time":"2026-10-17T23:02:05.915366062Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Elapsed":0.06}
+{"Time":"2026-10-17T23:02:05.91538086Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial (18.08s)\n"}
+{"Time":"2026-10-17T23:02:05.915390725Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Elapsed":18.08}
+{"Time":"2026-10-17T23:02:05.915400815Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary"}
+{"Time":"2026-10-17T23:02:05.915420112Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Output":"=== RUN TestRuntimeRenameReadbackRoutesPreserveCallerBoundary\n"}
+{"Time":"2026-10-17T23:02:06.037413499Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Output":"--- PASS: TestRuntimeRenameReadbackRoutesPreserveCallerBoundary (0.12s)\n"}
+{"Time":"2026-10-17T23:02:06.037475547Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Elapsed":0.12}
+{"Time":"2026-10-17T23:02:06.037489361Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny"}
+{"Time":"2026-10-17T23:02:06.037497711Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny\n"}
+{"Time":"2026-10-17T23:02:06.146071284Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign"}
+{"Time":"2026-10-17T23:02:06.146257977Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign\n"}
+{"Time":"2026-10-17T23:02:06.148532989Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign (0.00s)\n"}
+{"Time":"2026-10-17T23:02:06.148586065Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Elapsed":0}
+{"Time":"2026-10-17T23:02:06.148601917Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience"}
+{"Time":"2026-10-17T23:02:06.148612062Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience\n"}
+{"Time":"2026-10-17T23:02:06.15960134Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience (0.01s)\n"}
+{"Time":"2026-10-17T23:02:06.159803083Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:06.159966259Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience"}
+{"Time":"2026-10-17T23:02:06.15998451Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience\n"}
+{"Time":"2026-10-17T23:02:06.165475085Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience (0.00s)\n"}
+{"Time":"2026-10-17T23:02:06.165604853Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Elapsed":0}
+{"Time":"2026-10-17T23:02:06.165657748Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired"}
+{"Time":"2026-10-17T23:02:06.165679993Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired\n"}
+{"Time":"2026-10-17T23:02:06.167471298Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired (0.00s)\n"}
+{"Time":"2026-10-17T23:02:06.167638406Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Elapsed":0}
+{"Time":"2026-10-17T23:02:06.168681386Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry"}
+{"Time":"2026-10-17T23:02:06.168738952Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry\n"}
+{"Time":"2026-10-17T23:02:06.170418379Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry (0.00s)\n"}
+{"Time":"2026-10-17T23:02:06.171155223Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Elapsed":0}
+{"Time":"2026-10-17T23:02:06.173946577Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated"}
+{"Time":"2026-10-17T23:02:06.174010076Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated\n"}
+{"Time":"2026-10-17T23:02:06.177016065Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated (0.00s)\n"}
+{"Time":"2026-10-17T23:02:06.177123488Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Elapsed":0}
+{"Time":"2026-10-17T23:02:06.373807712Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny (0.34s)\n"}
+{"Time":"2026-10-17T23:02:06.373902042Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Elapsed":0.34}
+{"Time":"2026-10-17T23:02:06.37393738Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse"}
+{"Time":"2026-10-17T23:02:06.374468185Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Output":"=== RUN TestServicePilotGenericEngineAndCLIBypassesRefuse\n"}
+{"Time":"2026-10-17T23:02:06.457390361Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Output":"--- PASS: TestServicePilotGenericEngineAndCLIBypassesRefuse (0.08s)\n"}
+{"Time":"2026-10-17T23:02:06.457458594Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Elapsed":0.08}
+{"Time":"2026-10-17T23:02:06.457496584Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass"}
+{"Time":"2026-10-17T23:02:06.457506701Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Output":"=== RUN TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass\n"}
+{"Time":"2026-10-17T23:02:06.503329686Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Output":"--- PASS: TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass (0.05s)\n"}
+{"Time":"2026-10-17T23:02:06.50349848Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Elapsed":0.05}
+{"Time":"2026-10-17T23:02:06.503610258Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord"}
+{"Time":"2026-10-17T23:02:06.503629699Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord\n"}
+{"Time":"2026-10-17T23:02:06.50387367Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned"}
+{"Time":"2026-10-17T23:02:06.503897313Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned\n"}
+{"Time":"2026-10-17T23:02:06.582750202Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned (0.08s)\n"}
+{"Time":"2026-10-17T23:02:06.582935759Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Elapsed":0.08}
+{"Time":"2026-10-17T23:02:06.583031045Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow"}
+{"Time":"2026-10-17T23:02:06.583043344Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow\n"}
+{"Time":"2026-10-17T23:02:06.632277013Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow (0.05s)\n"}
+{"Time":"2026-10-17T23:02:06.632493661Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Elapsed":0.05}
+{"Time":"2026-10-17T23:02:06.632602391Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord (0.13s)\n"}
+{"Time":"2026-10-17T23:02:06.632709516Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Elapsed":0.13}
+{"Time":"2026-10-17T23:02:06.632867128Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI"}
+{"Time":"2026-10-17T23:02:06.632885857Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Output":"=== RUN TestServicePilotChildCLI\n"}
+{"Time":"2026-10-17T23:02:06.633072866Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Output":"--- PASS: TestServicePilotChildCLI (0.00s)\n"}
+{"Time":"2026-10-17T23:02:06.633338451Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Elapsed":0}
+{"Time":"2026-10-17T23:02:06.633544919Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals"}
+{"Time":"2026-10-17T23:02:06.633566416Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals\n"}
+{"Time":"2026-10-17T23:02:06.785027625Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T23:02:06.792101756Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect"}
+{"Time":"2026-10-17T23:02:06.792180522Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/redirect\n"}
+{"Time":"2026-10-17T23:02:06.802575424Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/redirect (0.01s)\n"}
+{"Time":"2026-10-17T23:02:06.802689105Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:06.802708708Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate"}
+{"Time":"2026-10-17T23:02:06.802717671Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T23:02:06.815341732Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate (0.01s)\n"}
+{"Time":"2026-10-17T23:02:06.815481924Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:06.815502528Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed"}
+{"Time":"2026-10-17T23:02:06.815510193Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/changed\n"}
+{"Time":"2026-10-17T23:02:06.824186262Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/changed (0.01s)\n"}
+{"Time":"2026-10-17T23:02:06.82427345Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:06.824289474Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired"}
+{"Time":"2026-10-17T23:02:06.824296011Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/expired\n"}
+{"Time":"2026-10-17T23:02:06.837054868Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/expired (0.01s)\n"}
+{"Time":"2026-10-17T23:02:06.837116366Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:06.837129279Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh"}
+{"Time":"2026-10-17T23:02:06.837136592Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T23:02:06.872355701Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh (0.04s)\n"}
+{"Time":"2026-10-17T23:02:06.87242334Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Elapsed":0.04}
+{"Time":"2026-10-17T23:02:06.872451582Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale"}
+{"Time":"2026-10-17T23:02:06.872461816Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T23:02:06.889816309Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale (0.02s)\n"}
+{"Time":"2026-10-17T23:02:06.889879538Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:06.889897726Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T23:02:06.889905553Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T23:02:06.897063156Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind (0.01s)\n"}
+{"Time":"2026-10-17T23:02:06.897135366Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:07.101748642Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals (0.47s)\n"}
+{"Time":"2026-10-17T23:02:07.101827876Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Elapsed":0.47}
+{"Time":"2026-10-17T23:02:07.101850582Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals"}
+{"Time":"2026-10-17T23:02:07.101861348Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals\n"}
+{"Time":"2026-10-17T23:02:07.266245048Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T23:02:07.274461808Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect"}
+{"Time":"2026-10-17T23:02:07.274564686Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect\n"}
+{"Time":"2026-10-17T23:02:07.297419813Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect (0.02s)\n"}
+{"Time":"2026-10-17T23:02:07.297495152Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:07.297517443Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate"}
+{"Time":"2026-10-17T23:02:07.297526388Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T23:02:07.302378957Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate (0.01s)\n"}
+{"Time":"2026-10-17T23:02:07.302456298Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:07.302474612Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed"}
+{"Time":"2026-10-17T23:02:07.302483566Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed\n"}
+{"Time":"2026-10-17T23:02:07.312247979Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed (0.01s)\n"}
+{"Time":"2026-10-17T23:02:07.312331614Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:07.312346943Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired"}
+{"Time":"2026-10-17T23:02:07.312354942Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired\n"}
+{"Time":"2026-10-17T23:02:07.319454318Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired (0.01s)\n"}
+{"Time":"2026-10-17T23:02:07.319514265Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:07.319531533Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh"}
+{"Time":"2026-10-17T23:02:07.319539892Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T23:02:07.367013072Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh (0.05s)\n"}
+{"Time":"2026-10-17T23:02:07.367072568Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Elapsed":0.05}
+{"Time":"2026-10-17T23:02:07.367085868Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act"}
+{"Time":"2026-10-17T23:02:07.367093939Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act\n"}
+{"Time":"2026-10-17T23:02:07.375217634Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act (0.01s)\n"}
+{"Time":"2026-10-17T23:02:07.375303857Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:07.375321016Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale"}
+{"Time":"2026-10-17T23:02:07.375329592Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T23:02:07.384178912Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale (0.01s)\n"}
+{"Time":"2026-10-17T23:02:07.384242898Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:07.384260653Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T23:02:07.384269346Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T23:02:07.397875484Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind (0.01s)\n"}
+{"Time":"2026-10-17T23:02:07.397945467Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:07.621404015Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals (0.52s)\n"}
+{"Time":"2026-10-17T23:02:07.621467506Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Elapsed":0.52}
+{"Time":"2026-10-17T23:02:07.621487885Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse"}
+{"Time":"2026-10-17T23:02:07.621495901Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Output":"=== RUN TestTrustedServiceMissingAndGenericAdmissionRefuse\n"}
+{"Time":"2026-10-17T23:02:07.700550003Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Output":"--- PASS: TestTrustedServiceMissingAndGenericAdmissionRefuse (0.08s)\n"}
+{"Time":"2026-10-17T23:02:07.700639635Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Elapsed":0.08}
+{"Time":"2026-10-17T23:02:07.700663639Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"PASS\n"}
+{"Time":"2026-10-17T23:02:07.708429798Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/access-engine\t32.586s\n"}
+{"Time":"2026-10-17T23:02:07.708497527Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":32.601}
+{"Time":"2026-10-17T23:02:08.42975983Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Output":"--- PASS: TestWP0094ExactRecords (3.09s)\n"}
+{"Time":"2026-10-17T23:02:08.43002833Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Elapsed":3.09}
+{"Time":"2026-10-17T23:02:08.430063732Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T23:02:08.430097402Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Output":"=== RUN TestLoadPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T23:02:08.448156646Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Output":"--- PASS: TestLoadPolicyPackageMarkdownValidates (0.02s)\n"}
+{"Time":"2026-10-17T23:02:08.448417774Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:08.448446908Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T23:02:08.448455637Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Output":"=== RUN TestRedactPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T23:02:08.462169932Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Output":"--- PASS: TestRedactPolicyPackageMarkdownValidates (0.01s)\n"}
+{"Time":"2026-10-17T23:02:08.462322053Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:08.462347815Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T23:02:08.462358194Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Output":"=== RUN TestOpsWardenPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T23:02:08.801502938Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Output":"--- PASS: TestOpsWardenPolicyPackageMarkdownValidates (0.34s)\n"}
+{"Time":"2026-10-17T23:02:08.801581929Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Elapsed":0.34}
+{"Time":"2026-10-17T23:02:08.801601415Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced"}
+{"Time":"2026-10-17T23:02:08.801621136Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Output":"=== RUN TestCaringFindingsAreAdvisoryUntilEnforced\n"}
+{"Time":"2026-10-17T23:02:08.811573309Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Output":"--- PASS: TestCaringFindingsAreAdvisoryUntilEnforced (0.01s)\n"}
+{"Time":"2026-10-17T23:02:08.811726963Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:08.811835278Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead"}
+{"Time":"2026-10-17T23:02:08.811964233Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Output":"=== RUN TestValidateFlagsUndeclaredAttributeRead\n"}
+{"Time":"2026-10-17T23:02:08.819188643Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Output":"--- PASS: TestValidateFlagsUndeclaredAttributeRead (0.01s)\n"}
+{"Time":"2026-10-17T23:02:08.819495464Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:08.819670354Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared"}
+{"Time":"2026-10-17T23:02:08.819729146Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Output":"=== RUN TestOpsWardenAttributeReadsAreDeclared\n"}
+{"Time":"2026-10-17T23:02:09.194683948Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Output":"--- PASS: TestOpsWardenAttributeReadsAreDeclared (0.37s)\n"}
+{"Time":"2026-10-17T23:02:09.194974105Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Elapsed":0.37}
+{"Time":"2026-10-17T23:02:09.195225938Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage"}
+{"Time":"2026-10-17T23:02:09.195253901Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Output":"=== RUN TestFixtureMismatchInvalidatesPackage\n"}
+{"Time":"2026-10-17T23:02:09.198979116Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Output":"--- PASS: TestFixtureMismatchInvalidatesPackage (0.00s)\n"}
+{"Time":"2026-10-17T23:02:09.199247442Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Elapsed":0}
+{"Time":"2026-10-17T23:02:09.199386245Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses"}
+{"Time":"2026-10-17T23:02:09.199405785Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Output":"=== RUN TestPolicyPackageMetadataParses\n"}
+{"Time":"2026-10-17T23:02:09.201370734Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Output":"--- PASS: TestPolicyPackageMetadataParses (0.00s)\n"}
+{"Time":"2026-10-17T23:02:09.201426839Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Elapsed":0}
+{"Time":"2026-10-17T23:02:09.201438462Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses"}
+{"Time":"2026-10-17T23:02:09.201447074Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Output":"=== RUN TestPolicyFixtureParses\n"}
+{"Time":"2026-10-17T23:02:09.201458021Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Output":"--- PASS: TestPolicyFixtureParses (0.00s)\n"}
+{"Time":"2026-10-17T23:02:09.201466777Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Elapsed":0}
+{"Time":"2026-10-17T23:02:09.201475262Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal"}
+{"Time":"2026-10-17T23:02:09.201482494Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Output":"=== RUN TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal\n"}
+{"Time":"2026-10-17T23:02:10.585720709Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Output":"--- PASS: TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal (1.38s)\n"}
+{"Time":"2026-10-17T23:02:10.585947989Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Elapsed":1.38}
+{"Time":"2026-10-17T23:02:10.586082472Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal"}
+{"Time":"2026-10-17T23:02:10.586100362Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal\n"}
+{"Time":"2026-10-17T23:02:11.236824898Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant"}
+{"Time":"2026-10-17T23:02:11.236886486Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant\n"}
+{"Time":"2026-10-17T23:02:11.268766796Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant (0.03s)\n"}
+{"Time":"2026-10-17T23:02:11.26910001Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant","Elapsed":0.03}
+{"Time":"2026-10-17T23:02:11.273440247Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply"}
+{"Time":"2026-10-17T23:02:11.273501032Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply\n"}
+{"Time":"2026-10-17T23:02:11.293682401Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply (0.02s)\n"}
+{"Time":"2026-10-17T23:02:11.294140372Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:11.294478311Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller"}
+{"Time":"2026-10-17T23:02:11.294518041Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller\n"}
+{"Time":"2026-10-17T23:02:11.325471355Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller (0.03s)\n"}
+{"Time":"2026-10-17T23:02:11.325553277Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller","Elapsed":0.03}
+{"Time":"2026-10-17T23:02:11.325574386Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control"}
+{"Time":"2026-10-17T23:02:11.325585604Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control\n"}
+{"Time":"2026-10-17T23:02:11.357414498Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control (0.03s)\n"}
+{"Time":"2026-10-17T23:02:11.35752276Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control","Elapsed":0.03}
+{"Time":"2026-10-17T23:02:11.357543409Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed"}
+{"Time":"2026-10-17T23:02:11.357555799Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed\n"}
+{"Time":"2026-10-17T23:02:11.39300048Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed (0.04s)\n"}
+{"Time":"2026-10-17T23:02:11.393066189Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed","Elapsed":0.04}
+{"Time":"2026-10-17T23:02:11.393084945Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation"}
+{"Time":"2026-10-17T23:02:11.393095387Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation\n"}
+{"Time":"2026-10-17T23:02:11.413436774Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation (0.02s)\n"}
+{"Time":"2026-10-17T23:02:11.413537929Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:11.413559192Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human"}
+{"Time":"2026-10-17T23:02:11.413568507Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/human\n"}
+{"Time":"2026-10-17T23:02:11.432518219Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/human (0.02s)\n"}
+{"Time":"2026-10-17T23:02:11.432605272Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:11.432632215Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest"}
+{"Time":"2026-10-17T23:02:11.432650782Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest\n"}
+{"Time":"2026-10-17T23:02:11.452947641Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest (0.02s)\n"}
+{"Time":"2026-10-17T23:02:11.453259846Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:11.45347938Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation"}
+{"Time":"2026-10-17T23:02:11.453509641Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation\n"}
+{"Time":"2026-10-17T23:02:11.477247179Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation (0.02s)\n"}
+{"Time":"2026-10-17T23:02:11.477348993Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation","Elapsed":0.02}
+{"Time":"2026-10-17T23:02:11.477372789Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal (0.89s)\n"}
+{"Time":"2026-10-17T23:02:11.477385945Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Elapsed":0.89}
+{"Time":"2026-10-17T23:02:11.47739737Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission"}
+{"Time":"2026-10-17T23:02:11.477406838Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Output":"=== RUN TestTaskExecutionPackageClosedAdmission\n"}
+{"Time":"2026-10-17T23:02:11.578197041Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Output":"--- PASS: TestTaskExecutionPackageClosedAdmission (0.10s)\n"}
+{"Time":"2026-10-17T23:02:11.578445655Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Elapsed":0.1}
+{"Time":"2026-10-17T23:02:11.578677192Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch"}
+{"Time":"2026-10-17T23:02:11.578698319Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Output":"=== RUN TestTaskExecutionSourceHasNoActivationSwitch\n"}
+{"Time":"2026-10-17T23:02:11.578971722Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Output":"--- PASS: TestTaskExecutionSourceHasNoActivationSwitch (0.00s)\n"}
+{"Time":"2026-10-17T23:02:11.578996736Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Elapsed":0}
+{"Time":"2026-10-17T23:02:11.579009036Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection"}
+{"Time":"2026-10-17T23:02:11.579016781Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Output":"=== RUN TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection\n"}
+{"Time":"2026-10-17T23:02:11.934867007Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Output":"--- PASS: TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection (0.36s)\n"}
+{"Time":"2026-10-17T23:02:11.934977035Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Elapsed":0.36}
+{"Time":"2026-10-17T23:02:11.934997883Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Output":"PASS\n"}
+{"Time":"2026-10-17T23:02:11.943655135Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Output":"ok \tgithub.com/netkingdom/access-engine/internal/policy\t24.076s\n"}
+{"Time":"2026-10-17T23:02:11.943719491Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Elapsed":24.076}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-test.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-test.jsonl
new file mode 100644
index 00000000..c58bdcb5
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-test.jsonl
@@ -0,0 +1,2049 @@
+{"Time":"2026-10-17T22:56:52.696434958Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"}
+{"Time":"2026-10-17T22:56:52.73136416Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration"}
+{"Time":"2026-10-17T22:56:52.731433638Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Output":"=== RUN TestEnvelopeSigningStartupConfiguration\n"}
+{"Time":"2026-10-17T22:56:52.791465487Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Output":"--- PASS: TestEnvelopeSigningStartupConfiguration (0.06s)\n"}
+{"Time":"2026-10-17T22:56:52.791676526Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Elapsed":0.06}
+{"Time":"2026-10-17T22:56:52.791823823Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"}
+{"Time":"2026-10-17T22:56:52.791845807Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"}
+{"Time":"2026-10-17T22:56:52.821833464Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/flex-auth"}
+{"Time":"2026-10-17T22:56:52.847581599Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement"}
+{"Time":"2026-10-17T22:56:52.847652664Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Output":"=== RUN TestRetiredBinaryNamesReplacement\n"}
+{"Time":"2026-10-17T22:56:52.877332975Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Output":"--- PASS: TestRetiredBinaryNamesReplacement (0.03s)\n"}
+{"Time":"2026-10-17T22:56:52.88035739Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:52.8804251Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:52.880716916Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/flex-auth\t0.050s\n"}
+{"Time":"2026-10-17T22:56:52.880754843Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Elapsed":0.059}
+{"Time":"2026-10-17T22:56:52.881365572Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters"}
+{"Time":"2026-10-17T22:56:52.881414563Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters","Output":"? \tgithub.com/netkingdom/access-engine/internal/adapters\t[no test files]\n"}
+{"Time":"2026-10-17T22:56:52.881433328Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/adapters","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.881451732Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/directory"}
+{"Time":"2026-10-17T22:56:52.895511804Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage"}
+{"Time":"2026-10-17T22:56:52.895590109Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Output":"=== RUN TestGraphResolverDetectsTokenOverage\n"}
+{"Time":"2026-10-17T22:56:52.895686278Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Output":"--- PASS: TestGraphResolverDetectsTokenOverage (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.895706883Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.895747244Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance"}
+{"Time":"2026-10-17T22:56:52.895760716Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Output":"=== RUN TestSCIMResolverCarriesDescriptorProvenance\n"}
+{"Time":"2026-10-17T22:56:52.895780527Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Output":"--- PASS: TestSCIMResolverCarriesDescriptorProvenance (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.895793349Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.895804251Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim"}
+{"Time":"2026-10-17T22:56:52.895816515Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Output":"=== RUN TestLDAPResolverUsesDistinguishedNameClaim\n"}
+{"Time":"2026-10-17T22:56:52.895829193Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Output":"--- PASS: TestLDAPResolverUsesDistinguishedNameClaim (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.895840167Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.89585152Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject"}
+{"Time":"2026-10-17T22:56:52.895860185Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Output":"=== RUN TestMergeResultsAndApplyToSubject\n"}
+{"Time":"2026-10-17T22:56:52.896085129Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Output":"--- PASS: TestMergeResultsAndApplyToSubject (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.896168512Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.896185509Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:52.904392979Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/directory\t0.023s\n"}
+{"Time":"2026-10-17T22:56:52.904470437Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Elapsed":0.023}
+{"Time":"2026-10-17T22:56:52.907018513Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak"}
+{"Time":"2026-10-17T22:56:52.920714187Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape"}
+{"Time":"2026-10-17T22:56:52.920780482Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Output":"=== RUN TestBuildAuthorizationRequestUsesUMAPermissionShape\n"}
+{"Time":"2026-10-17T22:56:52.921055589Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Output":"--- PASS: TestBuildAuthorizationRequestUsesUMAPermissionShape (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.921091027Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.921110865Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest"}
+{"Time":"2026-10-17T22:56:52.921120116Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Output":"=== RUN TestResourceRegistrationsFromManifest\n"}
+{"Time":"2026-10-17T22:56:52.921134003Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Output":"--- PASS: TestResourceRegistrationsFromManifest (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.921144364Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.921154607Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow"}
+{"Time":"2026-10-17T22:56:52.921164292Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Output":"=== RUN TestAdapterCheckWrapsKeycloakAllow\n"}
+{"Time":"2026-10-17T22:56:52.921999893Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Output":"--- PASS: TestAdapterCheckWrapsKeycloakAllow (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.922073231Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.926697209Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak"}
+{"Time":"2026-10-17T22:56:52.926770132Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Output":"=== RUN TestAdapterFailsClosedOnUnavailableKeycloak\n"}
+{"Time":"2026-10-17T22:56:52.926942914Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Output":"--- PASS: TestAdapterFailsClosedOnUnavailableKeycloak (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.926963626Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.927054484Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient"}
+{"Time":"2026-10-17T22:56:52.927070102Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Output":"=== RUN TestRegisterResourceManifestDelegatesToClient\n"}
+{"Time":"2026-10-17T22:56:52.927084394Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Output":"--- PASS: TestRegisterResourceManifestDelegatesToClient (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.927096451Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.927107722Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:52.931774958Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/keycloak\t0.025s\n"}
+{"Time":"2026-10-17T22:56:52.932067Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Elapsed":0.025}
+{"Time":"2026-10-17T22:56:52.936528014Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship"}
+{"Time":"2026-10-17T22:56:52.964674205Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry"}
+{"Time":"2026-10-17T22:56:52.964741573Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Output":"=== RUN TestSnapshotToTuplesMapsCanonicalRegistry\n"}
+{"Time":"2026-10-17T22:56:52.966872191Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Output":"--- PASS: TestSnapshotToTuplesMapsCanonicalRegistry (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.966931245Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.966953887Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple"}
+{"Time":"2026-10-17T22:56:52.966966619Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Output":"=== RUN TestAdapterCheckPreservesCARINGFromMatchedTuple\n"}
+{"Time":"2026-10-17T22:56:52.967529975Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Output":"--- PASS: TestAdapterCheckPreservesCARINGFromMatchedTuple (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.968344718Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.968419678Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend"}
+{"Time":"2026-10-17T22:56:52.968434115Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Output":"=== RUN TestAdapterCheckFailsClosedOnStaleBackend\n"}
+{"Time":"2026-10-17T22:56:52.968901948Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Output":"--- PASS: TestAdapterCheckFailsClosedOnStaleBackend (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.96908305Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.971855612Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder"}
+{"Time":"2026-10-17T22:56:52.971920726Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Output":"=== RUN TestBatchCheckPreservesBackendOrder\n"}
+{"Time":"2026-10-17T22:56:52.971944017Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Output":"--- PASS: TestBatchCheckPreservesBackendOrder (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.971956984Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.971969383Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults"}
+{"Time":"2026-10-17T22:56:52.972001006Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Output":"=== RUN TestListAllowedReturnsEnvelopeResults\n"}
+{"Time":"2026-10-17T22:56:52.972014036Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Output":"--- PASS: TestListAllowedReturnsEnvelopeResults (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.972024622Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.972033621Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples"}
+{"Time":"2026-10-17T22:56:52.972041313Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Output":"=== RUN TestImportTuplesDelegatesSnapshotTuples\n"}
+{"Time":"2026-10-17T22:56:52.972052774Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Output":"--- PASS: TestImportTuplesDelegatesSnapshotTuples (0.00s)\n"}
+{"Time":"2026-10-17T22:56:52.972062242Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Elapsed":0}
+{"Time":"2026-10-17T22:56:52.972070277Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:52.972226843Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/relationship\t0.036s\n"}
+{"Time":"2026-10-17T22:56:52.972251884Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Elapsed":0.036}
+{"Time":"2026-10-17T22:56:52.974665558Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/rule"}
+{"Time":"2026-10-17T22:56:52.975090657Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins"}
+{"Time":"2026-10-17T22:56:52.975134337Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins\n"}
+{"Time":"2026-10-17T22:56:52.993525159Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz"}
+{"Time":"2026-10-17T22:56:52.999803329Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck"}
+{"Time":"2026-10-17T22:56:52.999868271Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Output":"=== RUN TestCanonicalInputFromCheck\n"}
+{"Time":"2026-10-17T22:56:53.001423241Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Output":"--- PASS: TestCanonicalInputFromCheck (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.001652523Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.001785681Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures"}
+{"Time":"2026-10-17T22:56:53.001805131Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Output":"=== RUN TestPolicyArtifactFromPackagePreservesRegoAndFixtures\n"}
+{"Time":"2026-10-17T22:56:53.006174667Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins (0.03s)\n"}
+{"Time":"2026-10-17T22:56:53.007282914Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:53.007680926Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners"}
+{"Time":"2026-10-17T22:56:53.007713577Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners\n"}
+{"Time":"2026-10-17T22:56:53.021695471Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry"}
+{"Time":"2026-10-17T22:56:53.021761775Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Output":"=== RUN TestSnapshotToDirectoryMapsCanonicalRegistry\n"}
+{"Time":"2026-10-17T22:56:53.024066458Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Output":"--- PASS: TestSnapshotToDirectoryMapsCanonicalRegistry (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.030006327Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.030079619Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope"}
+{"Time":"2026-10-17T22:56:53.030092776Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Output":"=== RUN TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope\n"}
+{"Time":"2026-10-17T22:56:53.03011237Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Output":"--- PASS: TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.03012356Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.030134138Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz"}
+{"Time":"2026-10-17T22:56:53.030151884Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Output":"=== RUN TestAdapterCheckFailsClosedOnUnavailableTopaz\n"}
+{"Time":"2026-10-17T22:56:53.030165491Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Output":"--- PASS: TestAdapterCheckFailsClosedOnUnavailableTopaz (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.030175933Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.030186564Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations"}
+{"Time":"2026-10-17T22:56:53.030195708Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Output":"=== RUN TestImportDirectoryWritesObjectsAndRelations\n"}
+{"Time":"2026-10-17T22:56:53.030230018Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Output":"--- PASS: TestImportDirectoryWritesObjectsAndRelations (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.030242336Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.030252651Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle"}
+{"Time":"2026-10-17T22:56:53.030261984Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Output":"=== RUN TestImportPolicyWritesTopazBundle\n"}
+{"Time":"2026-10-17T22:56:53.036321025Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners (0.03s)\n"}
+{"Time":"2026-10-17T22:56:53.036396662Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:53.036421847Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers"}
+{"Time":"2026-10-17T22:56:53.036433434Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers\n"}
+{"Time":"2026-10-17T22:56:53.082014575Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Output":"--- PASS: TestPolicyArtifactFromPackagePreservesRegoAndFixtures (0.05s)\n"}
+{"Time":"2026-10-17T22:56:53.082098418Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Elapsed":0.05}
+{"Time":"2026-10-17T22:56:53.082119482Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult"}
+{"Time":"2026-10-17T22:56:53.082129401Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Output":"=== RUN TestAdapterCheckWrapsRuleResult\n"}
+{"Time":"2026-10-17T22:56:53.08214308Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Output":"--- PASS: TestAdapterCheckWrapsRuleResult (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.08215565Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.082167156Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy"}
+{"Time":"2026-10-17T22:56:53.082175894Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Output":"=== RUN TestAdapterFailsClosedOnStalePolicy\n"}
+{"Time":"2026-10-17T22:56:53.082270214Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Output":"--- PASS: TestAdapterFailsClosedOnStalePolicy (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.082293145Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.082330864Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder"}
+{"Time":"2026-10-17T22:56:53.082344823Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Output":"=== RUN TestBatchCheckPreservesOrder\n"}
+{"Time":"2026-10-17T22:56:53.082358583Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Output":"--- PASS: TestBatchCheckPreservesOrder (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.08236935Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.08237944Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations"}
+{"Time":"2026-10-17T22:56:53.082389395Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Output":"=== RUN TestEvaluateFixturesComparesExpectations\n"}
+{"Time":"2026-10-17T22:56:53.082403372Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Output":"--- PASS: TestEvaluateFixturesComparesExpectations (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.082416708Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.082427881Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact"}
+{"Time":"2026-10-17T22:56:53.082437133Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Output":"=== RUN TestImportPolicyDelegatesArtifact\n"}
+{"Time":"2026-10-17T22:56:53.082491975Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers (0.04s)\n"}
+{"Time":"2026-10-17T22:56:53.082512598Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Elapsed":0.04}
+{"Time":"2026-10-17T22:56:53.082527539Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource"}
+{"Time":"2026-10-17T22:56:53.08253717Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource\n"}
+{"Time":"2026-10-17T22:56:53.108256381Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Output":"--- PASS: TestImportPolicyDelegatesArtifact (0.05s)\n"}
+{"Time":"2026-10-17T22:56:53.108586637Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Elapsed":0.05}
+{"Time":"2026-10-17T22:56:53.109127041Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:53.115112612Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Output":"--- PASS: TestImportPolicyWritesTopazBundle (0.09s)\n"}
+{"Time":"2026-10-17T22:56:53.115212911Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Elapsed":0.09}
+{"Time":"2026-10-17T22:56:53.115258998Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape"}
+{"Time":"2026-10-17T22:56:53.115280838Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Output":"=== RUN TestHTTPClientUsesTopazDirectoryRESTShape\n"}
+{"Time":"2026-10-17T22:56:53.121041451Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource (0.04s)\n"}
+{"Time":"2026-10-17T22:56:53.121349327Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Elapsed":0.04}
+{"Time":"2026-10-17T22:56:53.12371985Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut"}
+{"Time":"2026-10-17T22:56:53.12379233Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut\n"}
+{"Time":"2026-10-17T22:56:53.124024508Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/rule\t0.149s\n"}
+{"Time":"2026-10-17T22:56:53.124069071Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Elapsed":0.149}
+{"Time":"2026-10-17T22:56:53.133289836Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Output":"--- PASS: TestHTTPClientUsesTopazDirectoryRESTShape (0.02s)\n"}
+{"Time":"2026-10-17T22:56:53.133681473Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:53.133982586Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample"}
+{"Time":"2026-10-17T22:56:53.134092804Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":"=== RUN TestTopazDockerComposeExample\n"}
+{"Time":"2026-10-17T22:56:53.134403204Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":" integration_test.go:17: set ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 to run the examples/topaz docker-compose integration\n"}
+{"Time":"2026-10-17T22:56:53.134663767Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":"--- SKIP: TestTopazDockerComposeExample (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.135106144Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.13515288Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:53.140276575Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/audit"}
+{"Time":"2026-10-17T22:56:53.145313769Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/topaz\t0.152s\n"}
+{"Time":"2026-10-17T22:56:53.145388107Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Elapsed":0.152}
+{"Time":"2026-10-17T22:56:53.150088822Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut (0.03s)\n"}
+{"Time":"2026-10-17T22:56:53.15044485Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:53.150671417Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant"}
+{"Time":"2026-10-17T22:56:53.150737325Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant\n"}
+{"Time":"2026-10-17T22:56:53.158175141Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions"}
+{"Time":"2026-10-17T22:56:53.158237135Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Output":"=== RUN TestJSONLDecisionLogRoundTripsDecisions\n"}
+{"Time":"2026-10-17T22:56:53.158440853Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Output":"--- PASS: TestJSONLDecisionLogRoundTripsDecisions (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.158719233Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.158873672Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:53.162628252Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/callerauth"}
+{"Time":"2026-10-17T22:56:53.165246883Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Output":"ok \tgithub.com/netkingdom/access-engine/internal/audit\t0.025s\n"}
+{"Time":"2026-10-17T22:56:53.165308389Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/audit","Elapsed":0.025}
+{"Time":"2026-10-17T22:56:53.170623742Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/decision"}
+{"Time":"2026-10-17T22:56:53.175235912Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding"}
+{"Time":"2026-10-17T22:56:53.175323974Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Output":"=== RUN TestAuthenticatorEnforcesAudienceAndSystemBinding\n"}
+{"Time":"2026-10-17T22:56:53.176486279Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Output":"--- PASS: TestAuthenticatorEnforcesAudienceAndSystemBinding (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.181585463Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.181683355Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure"}
+{"Time":"2026-10-17T22:56:53.181698576Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Output":"=== RUN TestAuthenticatorRejectsMissingTokenAndReviewerFailure\n"}
+{"Time":"2026-10-17T22:56:53.181714121Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Output":"--- PASS: TestAuthenticatorRejectsMissingTokenAndReviewerFailure (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.18174863Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.181761606Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure"}
+{"Time":"2026-10-17T22:56:53.181780425Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Output":"=== RUN TestAuthenticatorWarnModePermitsButRecordsFailure\n"}
+{"Time":"2026-10-17T22:56:53.181794781Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Output":"--- PASS: TestAuthenticatorWarnModePermitsButRecordsFailure (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.181806233Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.181816593Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal"}
+{"Time":"2026-10-17T22:56:53.181825457Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Output":"=== RUN TestAuthenticatorWarnModeKeepsObservedPrincipal\n"}
+{"Time":"2026-10-17T22:56:53.181837351Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Output":"--- PASS: TestAuthenticatorWarnModeKeepsObservedPrincipal (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.181848118Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.18185782Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence"}
+{"Time":"2026-10-17T22:56:53.181884358Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Output":"=== RUN TestDisabledRecordStatesAbsence\n"}
+{"Time":"2026-10-17T22:56:53.181897938Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Output":"--- PASS: TestDisabledRecordStatesAbsence (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182037841Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182054387Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary"}
+{"Time":"2026-10-17T22:56:53.182063982Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Output":"=== RUN TestOpenRouterNativeCallerBoundary\n"}
+{"Time":"2026-10-17T22:56:53.182080086Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller"}
+{"Time":"2026-10-17T22:56:53.182090727Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Output":"=== RUN TestOpenRouterNativeCallerBoundary/native_lifecycle_caller\n"}
+{"Time":"2026-10-17T22:56:53.18213969Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/native_lifecycle_caller (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.18215401Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182187545Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system"}
+{"Time":"2026-10-17T22:56:53.182198934Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_own_system\n"}
+{"Time":"2026-10-17T22:56:53.182211441Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_own_system (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182222451Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182233308Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner"}
+{"Time":"2026-10-17T22:56:53.182243254Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner\n"}
+{"Time":"2026-10-17T22:56:53.182257492Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182269088Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182280837Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine"}
+{"Time":"2026-10-17T22:56:53.182289737Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine\n"}
+{"Time":"2026-10-17T22:56:53.18230238Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182312281Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182322145Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller"}
+{"Time":"2026-10-17T22:56:53.182331271Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Output":"=== RUN TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller\n"}
+{"Time":"2026-10-17T22:56:53.182343147Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182353697Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182379892Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner"}
+{"Time":"2026-10-17T22:56:53.182390758Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner\n"}
+{"Time":"2026-10-17T22:56:53.182402805Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182415203Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182425222Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner"}
+{"Time":"2026-10-17T22:56:53.182433617Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner\n"}
+{"Time":"2026-10-17T22:56:53.182445988Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182457612Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.18246873Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Output":"--- PASS: TestOpenRouterNativeCallerBoundary (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182478514Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182488505Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding"}
+{"Time":"2026-10-17T22:56:53.182506873Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding\n"}
+{"Time":"2026-10-17T22:56:53.182520029Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden"}
+{"Time":"2026-10-17T22:56:53.182529596Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/ops-warden\n"}
+{"Time":"2026-10-17T22:56:53.182546837Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/ops-warden (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182558289Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182569407Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch"}
+{"Time":"2026-10-17T22:56:53.182594015Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch\n"}
+{"Time":"2026-10-17T22:56:53.182609552Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182619561Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182629354Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine"}
+{"Time":"2026-10-17T22:56:53.182637821Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/secrets-engine\n"}
+{"Time":"2026-10-17T22:56:53.182649201Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/secrets-engine (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.182659291Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.182668444Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine"}
+{"Time":"2026-10-17T22:56:53.182676704Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/user-engine\n"}
+{"Time":"2026-10-17T22:56:53.181590241Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant (0.03s)\n"}
+{"Time":"2026-10-17T22:56:53.182713422Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:53.182728796Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer"}
+{"Time":"2026-10-17T22:56:53.182737786Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer\n"}
+{"Time":"2026-10-17T22:56:53.182850482Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/user-engine (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.183214157Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.183581781Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine"}
+{"Time":"2026-10-17T22:56:53.183671548Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/tenant-engine\n"}
+{"Time":"2026-10-17T22:56:53.185253741Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/tenant-engine (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.185830926Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.186257722Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle"}
+{"Time":"2026-10-17T22:56:53.186361149Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle\n"}
+{"Time":"2026-10-17T22:56:53.188263753Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.188497363Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.188674435Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting"}
+{"Time":"2026-10-17T22:56:53.188698195Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting\n"}
+{"Time":"2026-10-17T22:56:53.189865532Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.190280443Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.190488912Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03"}
+{"Time":"2026-10-17T22:56:53.190516307Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03\n"}
+{"Time":"2026-10-17T22:56:53.191404064Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03 (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.191745196Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.191931276Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback"}
+{"Time":"2026-10-17T22:56:53.19195546Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/application-readback\n"}
+{"Time":"2026-10-17T22:56:53.192915562Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/application-readback (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.193166206Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.193276451Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding (0.02s)\n"}
+{"Time":"2026-10-17T22:56:53.193497905Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:53.193622416Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience"}
+{"Time":"2026-10-17T22:56:53.193642226Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience\n"}
+{"Time":"2026-10-17T22:56:53.198006646Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth"}
+{"Time":"2026-10-17T22:56:53.198082968Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth\n"}
+{"Time":"2026-10-17T22:56:53.206003581Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect"}
+{"Time":"2026-10-17T22:56:53.206117631Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Output":"=== RUN TestRequiredCommitForEveryEffect\n"}
+{"Time":"2026-10-17T22:56:53.206213917Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow"}
+{"Time":"2026-10-17T22:56:53.206230464Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Output":"=== RUN TestRequiredCommitForEveryEffect/allow\n"}
+{"Time":"2026-10-17T22:56:53.20624839Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Output":"--- PASS: TestRequiredCommitForEveryEffect/allow (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206260482Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206274053Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny"}
+{"Time":"2026-10-17T22:56:53.206283422Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Output":"=== RUN TestRequiredCommitForEveryEffect/deny\n"}
+{"Time":"2026-10-17T22:56:53.206297354Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Output":"--- PASS: TestRequiredCommitForEveryEffect/deny (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206307516Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206317291Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact"}
+{"Time":"2026-10-17T22:56:53.20632556Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Output":"=== RUN TestRequiredCommitForEveryEffect/redact\n"}
+{"Time":"2026-10-17T22:56:53.206379095Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Output":"--- PASS: TestRequiredCommitForEveryEffect/redact (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206393613Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206404614Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only"}
+{"Time":"2026-10-17T22:56:53.206413162Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Output":"=== RUN TestRequiredCommitForEveryEffect/audit_only\n"}
+{"Time":"2026-10-17T22:56:53.206425985Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Output":"--- PASS: TestRequiredCommitForEveryEffect/audit_only (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206436454Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206447256Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable"}
+{"Time":"2026-10-17T22:56:53.206503578Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Output":"=== RUN TestRequiredCommitForEveryEffect/not_applicable\n"}
+{"Time":"2026-10-17T22:56:53.206531721Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Output":"--- PASS: TestRequiredCommitForEveryEffect/not_applicable (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206544823Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206557853Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Output":"--- PASS: TestRequiredCommitForEveryEffect (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206568908Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206579242Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime"}
+{"Time":"2026-10-17T22:56:53.206589035Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Output":"=== RUN TestTrustedTaskWholeOperationLifetime\n"}
+{"Time":"2026-10-17T22:56:53.206599386Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict"}
+{"Time":"2026-10-17T22:56:53.206608602Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/old-15s-conflict\n"}
+{"Time":"2026-10-17T22:56:53.206621641Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/old-15s-conflict (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206632976Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206664852Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve"}
+{"Time":"2026-10-17T22:56:53.206685176Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve\n"}
+{"Time":"2026-10-17T22:56:53.206701326Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206713797Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206724492Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup"}
+{"Time":"2026-10-17T22:56:53.206733238Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup\n"}
+{"Time":"2026-10-17T22:56:53.206745917Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206766052Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206783726Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation"}
+{"Time":"2026-10-17T22:56:53.206792698Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/expired-operation\n"}
+{"Time":"2026-10-17T22:56:53.206807054Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/expired-operation (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206817279Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206826026Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum"}
+{"Time":"2026-10-17T22:56:53.206834177Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/source-hard-maximum\n"}
+{"Time":"2026-10-17T22:56:53.206845521Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/source-hard-maximum (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206855323Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206864998Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass"}
+{"Time":"2026-10-17T22:56:53.20687352Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass\n"}
+{"Time":"2026-10-17T22:56:53.206906216Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206920364Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206930446Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact"}
+{"Time":"2026-10-17T22:56:53.206939355Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact\n"}
+{"Time":"2026-10-17T22:56:53.206951925Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206961483Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.206970013Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit"}
+{"Time":"2026-10-17T22:56:53.206977876Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit\n"}
+{"Time":"2026-10-17T22:56:53.206988769Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.206998147Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.20701565Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl"}
+{"Time":"2026-10-17T22:56:53.207024784Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl\n"}
+{"Time":"2026-10-17T22:56:53.207037931Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.207049374Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.20706235Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.207074478Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.207097427Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash"}
+{"Time":"2026-10-17T22:56:53.207106444Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Output":"=== RUN TestAttributeContextCarriedWithoutViewHash\n"}
+{"Time":"2026-10-17T22:56:53.207153343Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer (0.03s)\n"}
+{"Time":"2026-10-17T22:56:53.207167365Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:53.207179809Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance"}
+{"Time":"2026-10-17T22:56:53.207188564Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance\n"}
+{"Time":"2026-10-17T22:56:53.21249306Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth (0.02s)\n"}
+{"Time":"2026-10-17T22:56:53.212564061Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:53.21258986Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine"}
+{"Time":"2026-10-17T22:56:53.212601303Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine\n"}
+{"Time":"2026-10-17T22:56:53.216759607Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.216852755Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.216872476Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign"}
+{"Time":"2026-10-17T22:56:53.216884478Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign\n"}
+{"Time":"2026-10-17T22:56:53.224480419Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.224583225Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.224605903Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp"}
+{"Time":"2026-10-17T22:56:53.224637896Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp\n"}
+{"Time":"2026-10-17T22:56:53.230022039Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance (0.02s)\n"}
+{"Time":"2026-10-17T22:56:53.230103573Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:53.230127388Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider"}
+{"Time":"2026-10-17T22:56:53.230137469Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/outsider\n"}
+{"Time":"2026-10-17T22:56:53.230348734Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.230408167Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.230427013Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/"}
+{"Time":"2026-10-17T22:56:53.230436201Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/\n"}
+{"Time":"2026-10-17T22:56:53.238561182Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/ (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.238709515Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.238741004Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth"}
+{"Time":"2026-10-17T22:56:53.238751545Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth\n"}
+{"Time":"2026-10-17T22:56:53.247071268Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.247158013Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.247184524Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine"}
+{"Time":"2026-10-17T22:56:53.247219845Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine\n"}
+{"Time":"2026-10-17T22:56:53.261838551Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.261956731Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.261985992Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign"}
+{"Time":"2026-10-17T22:56:53.261997101Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign\n"}
+{"Time":"2026-10-17T22:56:53.266520706Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.266600275Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.266619202Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp"}
+{"Time":"2026-10-17T22:56:53.266631114Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp\n"}
+{"Time":"2026-10-17T22:56:53.271073098Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/outsider (0.04s)\n"}
+{"Time":"2026-10-17T22:56:53.271175128Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Elapsed":0.04}
+{"Time":"2026-10-17T22:56:53.2712108Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups"}
+{"Time":"2026-10-17T22:56:53.271224732Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups\n"}
+{"Time":"2026-10-17T22:56:53.278516043Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.27952256Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.282299197Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/"}
+{"Time":"2026-10-17T22:56:53.282412706Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/\n"}
+{"Time":"2026-10-17T22:56:53.294880698Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups (0.03s)\n"}
+{"Time":"2026-10-17T22:56:53.295086927Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:53.295112067Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer"}
+{"Time":"2026-10-17T22:56:53.295123168Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer\n"}
+{"Time":"2026-10-17T22:56:53.295203205Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/ (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.295233737Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.295246902Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth"}
+{"Time":"2026-10-17T22:56:53.295256244Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth\n"}
+{"Time":"2026-10-17T22:56:53.295278336Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.295290591Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.295300961Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine"}
+{"Time":"2026-10-17T22:56:53.295309653Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine\n"}
+{"Time":"2026-10-17T22:56:53.295321583Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.295333387Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.295343775Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign"}
+{"Time":"2026-10-17T22:56:53.295352765Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign\n"}
+{"Time":"2026-10-17T22:56:53.300523697Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.300597107Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.300610894Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp"}
+{"Time":"2026-10-17T22:56:53.30062093Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp\n"}
+{"Time":"2026-10-17T22:56:53.300634636Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.30064635Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.300658117Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/"}
+{"Time":"2026-10-17T22:56:53.300687676Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/\n"}
+{"Time":"2026-10-17T22:56:53.30488733Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/ (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.30497559Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.304998188Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience (0.11s)\n"}
+{"Time":"2026-10-17T22:56:53.305011037Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Elapsed":0.11}
+{"Time":"2026-10-17T22:56:53.305024446Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact"}
+{"Time":"2026-10-17T22:56:53.305035239Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Output":"=== RUN TestRuntimeRenameCustomAudienceAndInputBindingsStayExact\n"}
+{"Time":"2026-10-17T22:56:53.305047674Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Output":"--- PASS: TestRuntimeRenameCustomAudienceAndInputBindingsStayExact (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.305058441Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.305101165Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated"}
+{"Time":"2026-10-17T22:56:53.305112075Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Output":"=== RUN TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated\n"}
+{"Time":"2026-10-17T22:56:53.315126362Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Output":"--- PASS: TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.316268307Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.316379859Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry"}
+{"Time":"2026-10-17T22:56:53.316660142Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Output":"=== RUN TestKubernetesTokenReviewerCapturesTokenExpiry\n"}
+{"Time":"2026-10-17T22:56:53.320911965Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Output":"--- PASS: TestKubernetesTokenReviewerCapturesTokenExpiry (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.320987944Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.321014121Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim"}
+{"Time":"2026-10-17T22:56:53.321024852Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Output":"=== RUN TestTokenExpiryReadsJWTClaim\n"}
+{"Time":"2026-10-17T22:56:53.321038937Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Output":"--- PASS: TestTokenExpiryReadsJWTClaim (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.321051525Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.321061732Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:53.325299544Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer (0.03s)\n"}
+{"Time":"2026-10-17T22:56:53.325379933Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:53.325398842Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action"}
+{"Time":"2026-10-17T22:56:53.325410186Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action\n"}
+{"Time":"2026-10-17T22:56:53.325532693Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Output":"ok \tgithub.com/netkingdom/access-engine/internal/callerauth\t0.163s\n"}
+{"Time":"2026-10-17T22:56:53.325630422Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Elapsed":0.163}
+{"Time":"2026-10-17T22:56:53.332711387Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/emission"}
+{"Time":"2026-10-17T22:56:53.365179565Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action (0.04s)\n"}
+{"Time":"2026-10-17T22:56:53.365252948Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Elapsed":0.04}
+{"Time":"2026-10-17T22:56:53.372952157Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild"}
+{"Time":"2026-10-17T22:56:53.373016585Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Output":"=== RUN TestOutboxLockChild\n"}
+{"Time":"2026-10-17T22:56:53.373110311Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Output":"--- PASS: TestOutboxLockChild (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.373124369Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.373137921Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease"}
+{"Time":"2026-10-17T22:56:53.37314959Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Output":"=== RUN TestActualProcessWriterExclusionAndCrashRelease\n"}
+{"Time":"2026-10-17T22:56:53.425323636Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy (0.63s)\n"}
+{"Time":"2026-10-17T22:56:53.425406938Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":0.63}
+{"Time":"2026-10-17T22:56:53.425432375Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion"}
+{"Time":"2026-10-17T22:56:53.425443295Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Output":"=== RUN TestRunVersion\n"}
+{"Time":"2026-10-17T22:56:53.425458453Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Output":"--- PASS: TestRunVersion (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.42546949Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.425479824Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy"}
+{"Time":"2026-10-17T22:56:53.425489499Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Output":"=== RUN TestRunTestPolicy\n"}
+{"Time":"2026-10-17T22:56:53.477604719Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Output":"--- PASS: TestRunTestPolicy (0.06s)\n"}
+{"Time":"2026-10-17T22:56:53.484725983Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Elapsed":0.06}
+{"Time":"2026-10-17T22:56:53.484822567Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck"}
+{"Time":"2026-10-17T22:56:53.484844307Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Output":"=== RUN TestRunCheck\n"}
+{"Time":"2026-10-17T22:56:53.506012208Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Output":"--- PASS: TestActualProcessWriterExclusionAndCrashRelease (0.13s)\n"}
+{"Time":"2026-10-17T22:56:53.50608083Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Elapsed":0.13}
+{"Time":"2026-10-17T22:56:53.50609826Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries"}
+{"Time":"2026-10-17T22:56:53.506107917Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Output":"=== RUN TestExactCapacityBatchEntryAndRestartBoundaries\n"}
+{"Time":"2026-10-17T22:56:53.573534748Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Output":"--- PASS: TestRunCheck (0.09s)\n"}
+{"Time":"2026-10-17T22:56:53.573614902Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Elapsed":0.09}
+{"Time":"2026-10-17T22:56:53.57369952Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck"}
+{"Time":"2026-10-17T22:56:53.573710945Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Output":"=== RUN TestRunBatchCheck\n"}
+{"Time":"2026-10-17T22:56:53.63001343Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Output":"--- PASS: TestRunBatchCheck (0.05s)\n"}
+{"Time":"2026-10-17T22:56:53.630093674Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Elapsed":0.05}
+{"Time":"2026-10-17T22:56:53.630114233Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden"}
+{"Time":"2026-10-17T22:56:53.630126046Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Output":"=== RUN TestRunCheckOpsWarden\n"}
+{"Time":"2026-10-17T22:56:53.682020043Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Output":"--- PASS: TestExactCapacityBatchEntryAndRestartBoundaries (0.17s)\n"}
+{"Time":"2026-10-17T22:56:53.682092803Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Elapsed":0.17}
+{"Time":"2026-10-17T22:56:53.682109404Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence"}
+{"Time":"2026-10-17T22:56:53.682120053Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence\n"}
+{"Time":"2026-10-17T22:56:53.716995345Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file"}
+{"Time":"2026-10-17T22:56:53.717093372Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/file\n"}
+{"Time":"2026-10-17T22:56:53.71711623Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/file (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.717130153Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.717166105Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line"}
+{"Time":"2026-10-17T22:56:53.717177214Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/line\n"}
+{"Time":"2026-10-17T22:56:53.765573624Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/line (0.05s)\n"}
+{"Time":"2026-10-17T22:56:53.7701549Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Elapsed":0.05}
+{"Time":"2026-10-17T22:56:53.770292476Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn"}
+{"Time":"2026-10-17T22:56:53.770316967Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn\n"}
+{"Time":"2026-10-17T22:56:53.802813852Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn (0.04s)\n"}
+{"Time":"2026-10-17T22:56:53.804776255Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Elapsed":0.04}
+{"Time":"2026-10-17T22:56:53.804886842Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt"}
+{"Time":"2026-10-17T22:56:53.804918799Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt\n"}
+{"Time":"2026-10-17T22:56:53.804961316Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.804979963Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.805018954Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence (0.13s)\n"}
+{"Time":"2026-10-17T22:56:53.805031912Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Elapsed":0.13}
+{"Time":"2026-10-17T22:56:53.805042579Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback"}
+{"Time":"2026-10-17T22:56:53.805052634Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback\n"}
+{"Time":"2026-10-17T22:56:53.805069568Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full"}
+{"Time":"2026-10-17T22:56:53.805176377Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full\n"}
+{"Time":"2026-10-17T22:56:53.815349417Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.815431032Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.81544839Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null"}
+{"Time":"2026-10-17T22:56:53.815458291Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null\n"}
+{"Time":"2026-10-17T22:56:53.816313226Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.816378808Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.816393714Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.816405021Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.816421595Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases"}
+{"Time":"2026-10-17T22:56:53.816431496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases\n"}
+{"Time":"2026-10-17T22:56:53.8164421Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink"}
+{"Time":"2026-10-17T22:56:53.816451487Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink\n"}
+{"Time":"2026-10-17T22:56:53.817198547Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.82609316Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.826989418Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable"}
+{"Time":"2026-10-17T22:56:53.827068075Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable\n"}
+{"Time":"2026-10-17T22:56:53.827093278Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.827116426Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.827190133Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink"}
+{"Time":"2026-10-17T22:56:53.827208293Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink\n"}
+{"Time":"2026-10-17T22:56:53.827223875Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.82723457Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.827247104Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.827258583Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.827270999Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion"}
+{"Time":"2026-10-17T22:56:53.82728044Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Output":"=== RUN TestPVCFSGroupPermissionWideningRetainsWriterExclusion\n"}
+{"Time":"2026-10-17T22:56:53.844781063Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Output":"--- PASS: TestPVCFSGroupPermissionWideningRetainsWriterExclusion (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.844857647Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.844873193Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs"}
+{"Time":"2026-10-17T22:56:53.844884446Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs\n"}
+{"Time":"2026-10-17T22:56:53.844897115Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink"}
+{"Time":"2026-10-17T22:56:53.844907161Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink\n"}
+{"Time":"2026-10-17T22:56:53.844948234Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.844964492Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.844977315Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink"}
+{"Time":"2026-10-17T22:56:53.844987838Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink\n"}
+{"Time":"2026-10-17T22:56:53.845003997Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.845016305Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.845029687Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo"}
+{"Time":"2026-10-17T22:56:53.845040589Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo\n"}
+{"Time":"2026-10-17T22:56:53.845054241Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.845066504Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.845089679Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink"}
+{"Time":"2026-10-17T22:56:53.845101563Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink\n"}
+{"Time":"2026-10-17T22:56:53.845115531Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.845126974Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.846338964Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink"}
+{"Time":"2026-10-17T22:56:53.846547092Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink\n"}
+{"Time":"2026-10-17T22:56:53.848068446Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.854165936Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.854236406Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo"}
+{"Time":"2026-10-17T22:56:53.854247596Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo\n"}
+{"Time":"2026-10-17T22:56:53.854266064Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo (0.00s)\n"}
+{"Time":"2026-10-17T22:56:53.854277696Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Elapsed":0}
+{"Time":"2026-10-17T22:56:53.854295667Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs (0.02s)\n"}
+{"Time":"2026-10-17T22:56:53.854310582Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:53.854322935Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature"}
+{"Time":"2026-10-17T22:56:53.854332043Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Output":"=== RUN TestOutboxReplayPreservesProducerNumericSignature\n"}
+{"Time":"2026-10-17T22:56:53.863386834Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Output":"--- PASS: TestOutboxReplayPreservesProducerNumericSignature (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.863640129Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.866001494Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart"}
+{"Time":"2026-10-17T22:56:53.866064633Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Output":"=== RUN TestHeartbeatScheduleSurvivesRestart\n"}
+{"Time":"2026-10-17T22:56:53.872510136Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Output":"--- PASS: TestHeartbeatScheduleSurvivesRestart (0.01s)\n"}
+{"Time":"2026-10-17T22:56:53.872845208Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:53.873023939Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs"}
+{"Time":"2026-10-17T22:56:53.873041027Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs\n"}
+{"Time":"2026-10-17T22:56:53.875795461Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request"}
+{"Time":"2026-10-17T22:56:53.875920395Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request\n"}
+{"Time":"2026-10-17T22:56:53.9380427Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request (0.06s)\n"}
+{"Time":"2026-10-17T22:56:53.938136065Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Elapsed":0.06}
+{"Time":"2026-10-17T22:56:53.938157634Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized"}
+{"Time":"2026-10-17T22:56:53.938165668Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized\n"}
+{"Time":"2026-10-17T22:56:53.975749754Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized (0.04s)\n"}
+{"Time":"2026-10-17T22:56:53.975821559Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Elapsed":0.04}
+{"Time":"2026-10-17T22:56:53.975838736Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden"}
+{"Time":"2026-10-17T22:56:53.975848944Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden\n"}
+{"Time":"2026-10-17T22:56:53.993999586Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden (0.02s)\n"}
+{"Time":"2026-10-17T22:56:53.994084285Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:53.994101075Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error"}
+{"Time":"2026-10-17T22:56:53.99411103Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error\n"}
+{"Time":"2026-10-17T22:56:54.006161797Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error (0.01s)\n"}
+{"Time":"2026-10-17T22:56:54.006397815Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:54.006560811Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found"}
+{"Time":"2026-10-17T22:56:54.006586744Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Found\n"}
+{"Time":"2026-10-17T22:56:54.020948289Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Found (0.01s)\n"}
+{"Time":"2026-10-17T22:56:54.021025729Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:54.021050184Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content"}
+{"Time":"2026-10-17T22:56:54.021062168Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content\n"}
+{"Time":"2026-10-17T22:56:54.021579238Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/layer"}
+{"Time":"2026-10-17T22:56:54.053283006Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms"}
+{"Time":"2026-10-17T22:56:54.053451195Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Output":"=== RUN TestLayerDeclarationConforms\n"}
+{"Time":"2026-10-17T22:56:54.056615856Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content (0.03s)\n"}
+{"Time":"2026-10-17T22:56:54.056890972Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:54.05694549Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs (0.18s)\n"}
+{"Time":"2026-10-17T22:56:54.056962028Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Elapsed":0.18}
+{"Time":"2026-10-17T22:56:54.056974922Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates"}
+{"Time":"2026-10-17T22:56:54.056985058Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Output":"=== RUN TestDrainAmbiguousAcceptanceReplaysAndTokenRotates\n"}
+{"Time":"2026-10-17T22:56:54.069291512Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Output":"--- PASS: TestDrainAmbiguousAcceptanceReplaysAndTokenRotates (0.01s)\n"}
+{"Time":"2026-10-17T22:56:54.069357581Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:54.069373875Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse"}
+{"Time":"2026-10-17T22:56:54.069383388Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Output":"=== RUN TestOutboxReportsLagAndRefusesSourceReuse\n"}
+{"Time":"2026-10-17T22:56:54.069397077Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Output":"--- PASS: TestOutboxReportsLagAndRefusesSourceReuse (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.069430927Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.069444372Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit"}
+{"Time":"2026-10-17T22:56:54.069453119Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Output":"=== RUN TestSlowReceiverDoesNotBlockDecisionCommit\n"}
+{"Time":"2026-10-17T22:56:54.075806448Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Output":"--- PASS: TestLayerDeclarationConforms (0.02s)\n"}
+{"Time":"2026-10-17T22:56:54.075897486Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Output":"--- PASS: TestSlowReceiverDoesNotBlockDecisionCommit (0.01s)\n"}
+{"Time":"2026-10-17T22:56:54.075911336Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:54.075925078Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields"}
+{"Time":"2026-10-17T22:56:54.075933834Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Output":"=== RUN TestCommittedEventsCarryAuditCoreRequiredFields\n"}
+{"Time":"2026-10-17T22:56:54.082054598Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Output":"--- PASS: TestCommittedEventsCarryAuditCoreRequiredFields (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082141813Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082166782Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped"}
+{"Time":"2026-10-17T22:56:54.082177224Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Output":"=== RUN TestCountsSurviveRestartAndTornTailIsDropped\n"}
+{"Time":"2026-10-17T22:56:54.082208388Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:54.082233654Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass"}
+{"Time":"2026-10-17T22:56:54.082246134Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Output":"=== RUN TestEmissionInventoryIsPerEventClass\n"}
+{"Time":"2026-10-17T22:56:54.082260859Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Output":"--- PASS: TestEmissionInventoryIsPerEventClass (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082271869Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082281328Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected"}
+{"Time":"2026-10-17T22:56:54.082289804Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Output":"=== RUN TestVersionPinInDeclarationIsRejected\n"}
+{"Time":"2026-10-17T22:56:54.082301391Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Output":"--- PASS: TestVersionPinInDeclarationIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082335756Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082347244Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected"}
+{"Time":"2026-10-17T22:56:54.082357145Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Output":"=== RUN TestEngineWithoutRoleIsRejected\n"}
+{"Time":"2026-10-17T22:56:54.082369517Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Output":"--- PASS: TestEngineWithoutRoleIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082378913Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082388363Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected"}
+{"Time":"2026-10-17T22:56:54.0823961Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Output":"=== RUN TestUnknownLayerIsRejected\n"}
+{"Time":"2026-10-17T22:56:54.082407606Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Output":"--- PASS: TestUnknownLayerIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082420473Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082429788Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy"}
+{"Time":"2026-10-17T22:56:54.082437904Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Output":"=== RUN TestVocabularyHasFourTokensIncludingTaxonomy\n"}
+{"Time":"2026-10-17T22:56:54.082448869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Output":"--- PASS: TestVocabularyHasFourTokensIncludingTaxonomy (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082458535Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082468021Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase"}
+{"Time":"2026-10-17T22:56:54.08247611Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Output":"=== RUN TestVocabularyComparisonFoldsCase\n"}
+{"Time":"2026-10-17T22:56:54.082486245Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Output":"--- PASS: TestVocabularyComparisonFoldsCase (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082495154Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082503459Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken"}
+{"Time":"2026-10-17T22:56:54.082511277Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Output":"=== RUN TestPluralEnginesIsNotTheToken\n"}
+{"Time":"2026-10-17T22:56:54.082521782Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Output":"--- PASS: TestPluralEnginesIsNotTheToken (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082545777Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082556904Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected"}
+{"Time":"2026-10-17T22:56:54.08256548Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Output":"=== RUN TestEvidenceSourceWithoutEmissionGuaranteeIsRejected\n"}
+{"Time":"2026-10-17T22:56:54.082577283Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Output":"--- PASS: TestEvidenceSourceWithoutEmissionGuaranteeIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082602135Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082612225Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound"}
+{"Time":"2026-10-17T22:56:54.082620151Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Output":"=== RUN TestVersionAnywhereInDeclarationIsFound\n"}
+{"Time":"2026-10-17T22:56:54.082631125Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Output":"--- PASS: TestVersionAnywhereInDeclarationIsFound (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082640873Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082649493Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach"}
+{"Time":"2026-10-17T22:56:54.08265742Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Output":"=== RUN TestVersionPinsLeavesWhatA12DoesNotReach\n"}
+{"Time":"2026-10-17T22:56:54.082742605Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Output":"--- PASS: TestVersionPinsLeavesWhatA12DoesNotReach (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.082755888Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.082765897Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps"}
+{"Time":"2026-10-17T22:56:54.082774707Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Output":"=== RUN TestCheckRejectsVersionedStandardPathButNotStanceMaps\n"}
+{"Time":"2026-10-17T22:56:54.082817647Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Output":"--- PASS: TestCountsSurviveRestartAndTornTailIsDropped (0.01s)\n"}
+{"Time":"2026-10-17T22:56:54.082892526Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:54.082912752Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass"}
+{"Time":"2026-10-17T22:56:54.082927261Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Output":"=== RUN TestReleasedUncommittedIsReportedPerClass\n"}
+{"Time":"2026-10-17T22:56:54.083486961Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Output":"--- PASS: TestReleasedUncommittedIsReportedPerClass (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.083595385Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.083648009Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect"}
+{"Time":"2026-10-17T22:56:54.08365846Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Output":"=== RUN TestCadenceClassifiesEveryEffect\n"}
+{"Time":"2026-10-17T22:56:54.084018411Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Output":"--- PASS: TestCheckRejectsVersionedStandardPathButNotStanceMaps (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.084190307Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.084373564Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere"}
+{"Time":"2026-10-17T22:56:54.084398569Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Output":"=== RUN TestOwnDeclarationCarriesNoVersionAnywhere\n"}
+{"Time":"2026-10-17T22:56:54.084926574Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Output":"--- PASS: TestCadenceClassifiesEveryEffect (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.085003473Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.085017008Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:54.085764448Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Output":"--- PASS: TestOwnDeclarationCarriesNoVersionAnywhere (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.090391974Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.090575277Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance"}
+{"Time":"2026-10-17T22:56:54.090592608Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance\n"}
+{"Time":"2026-10-17T22:56:54.09061791Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees"}
+{"Time":"2026-10-17T22:56:54.09062819Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees\n"}
+{"Time":"2026-10-17T22:56:54.090641878Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.090652645Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.090664142Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding"}
+{"Time":"2026-10-17T22:56:54.090693835Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding\n"}
+{"Time":"2026-10-17T22:56:54.090708083Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.090718461Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.090728876Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance"}
+{"Time":"2026-10-17T22:56:54.09073747Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance\n"}
+{"Time":"2026-10-17T22:56:54.094024699Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.094094772Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.094110246Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source"}
+{"Time":"2026-10-17T22:56:54.094120237Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source\n"}
+{"Time":"2026-10-17T22:56:54.094133484Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.094142943Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.094152339Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused"}
+{"Time":"2026-10-17T22:56:54.094161031Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused\n"}
+{"Time":"2026-10-17T22:56:54.094171816Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.09418141Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.094192186Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance (0.01s)\n"}
+{"Time":"2026-10-17T22:56:54.094223205Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:54.094237389Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut"}
+{"Time":"2026-10-17T22:56:54.09425528Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Output":"=== RUN TestValidatedAgainstAcceptedCut\n"}
+{"Time":"2026-10-17T22:56:54.094268066Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Output":"--- PASS: TestValidatedAgainstAcceptedCut (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.094278472Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.09428877Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo"}
+{"Time":"2026-10-17T22:56:54.094297056Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Output":"=== RUN TestSurveyDetectsFormsDisagreeingWithinOneRepo\n"}
+{"Time":"2026-10-17T22:56:54.095392643Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Output":"--- PASS: TestSurveyDetectsFormsDisagreeingWithinOneRepo (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.095710339Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.095905301Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017"}
+{"Time":"2026-10-17T22:56:54.095926347Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Output":"=== RUN TestSurveyFoldsCaseAfterGHDEC017\n"}
+{"Time":"2026-10-17T22:56:54.098725819Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Output":"--- PASS: TestSurveyFoldsCaseAfterGHDEC017 (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.098801149Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.098820545Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement"}
+{"Time":"2026-10-17T22:56:54.098832556Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Output":"=== RUN TestSpellingDisagreementIsReportedButIsNotALayerDisagreement\n"}
+{"Time":"2026-10-17T22:56:54.099994221Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Output":"--- PASS: TestSpellingDisagreementIsReportedButIsNotALayerDisagreement (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.100260717Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.100457942Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope"}
+{"Time":"2026-10-17T22:56:54.100484228Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Output":"=== RUN TestTaxonomyVolunteerIsInVocabularyAndOutOfScope\n"}
+{"Time":"2026-10-17T22:56:54.104688682Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Output":"--- PASS: TestTaxonomyVolunteerIsInVocabularyAndOutOfScope (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.104762435Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.104778242Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope"}
+{"Time":"2026-10-17T22:56:54.104789721Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Output":"=== RUN TestRunStatesItsScope\n"}
+{"Time":"2026-10-17T22:56:54.104804031Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Output":"--- PASS: TestRunStatesItsScope (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.104815555Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.104826277Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration"}
+{"Time":"2026-10-17T22:56:54.104836484Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Output":"=== RUN TestSurveyReportsMissingDeclaration\n"}
+{"Time":"2026-10-17T22:56:54.10484974Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Output":"--- PASS: TestSurveyReportsMissingDeclaration (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.104928Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.104954718Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement"}
+{"Time":"2026-10-17T22:56:54.104963492Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Output":"=== RUN TestSurveySingleFormIsNotDisagreement\n"}
+{"Time":"2026-10-17T22:56:54.104974953Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Output":"--- PASS: TestSurveySingleFormIsNotDisagreement (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.104983583Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.104992636Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed"}
+{"Time":"2026-10-17T22:56:54.105000102Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Output":"=== RUN TestPeerWithForeignFieldShapesIsStillSurveyed\n"}
+{"Time":"2026-10-17T22:56:54.105012248Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Output":"--- PASS: TestPeerWithForeignFieldShapesIsStillSurveyed (0.00s)\n"}
+{"Time":"2026-10-17T22:56:54.105023006Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Elapsed":0}
+{"Time":"2026-10-17T22:56:54.105033394Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration"}
+{"Time":"2026-10-17T22:56:54.105041771Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Output":"=== RUN TestSurveyFindsVersionInPeerDeclaration\n"}
+{"Time":"2026-10-17T22:56:54.106170418Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Output":"ok \tgithub.com/netkingdom/access-engine/internal/emission\t0.773s\n"}
+{"Time":"2026-10-17T22:56:54.106249328Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Elapsed":0.774}
+{"Time":"2026-10-17T22:56:54.111549678Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Output":"--- PASS: TestSurveyFindsVersionInPeerDeclaration (0.01s)\n"}
+{"Time":"2026-10-17T22:56:54.111751213Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:54.111874569Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:54.113345589Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Output":"ok \tgithub.com/netkingdom/access-engine/internal/layer\t0.092s\n"}
+{"Time":"2026-10-17T22:56:54.113406537Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Elapsed":0.092}
+{"Time":"2026-10-17T22:56:54.430347639Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Output":"--- PASS: TestRunCheckOpsWarden (0.80s)\n"}
+{"Time":"2026-10-17T22:56:54.431551992Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Elapsed":0.8}
+{"Time":"2026-10-17T22:56:54.431607998Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract"}
+{"Time":"2026-10-17T22:56:54.431620811Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Output":"=== RUN TestRunRailiancePlatformCredentialGrantContract\n"}
+{"Time":"2026-10-17T22:56:54.895268468Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Output":"--- PASS: TestRunRailiancePlatformCredentialGrantContract (0.46s)\n"}
+{"Time":"2026-10-17T22:56:54.895671503Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Elapsed":0.46}
+{"Time":"2026-10-17T22:56:54.895912155Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract"}
+{"Time":"2026-10-17T22:56:54.895942363Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Output":"=== RUN TestServeOpsWardenCheckContract\n"}
+{"Time":"2026-10-17T22:56:55.665698235Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Output":"--- PASS: TestServeOpsWardenCheckContract (0.77s)\n"}
+{"Time":"2026-10-17T22:56:55.665797514Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Elapsed":0.77}
+{"Time":"2026-10-17T22:56:55.665824774Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal"}
+{"Time":"2026-10-17T22:56:55.665834206Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Output":"=== RUN TestServeCallerAuthenticationBindsSystemToPrincipal\n"}
+{"Time":"2026-10-17T22:56:56.254370329Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Output":"--- PASS: TestServeCallerAuthenticationBindsSystemToPrincipal (0.59s)\n"}
+{"Time":"2026-10-17T22:56:56.254477859Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Elapsed":0.59}
+{"Time":"2026-10-17T22:56:56.25450088Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction"}
+{"Time":"2026-10-17T22:56:56.254510862Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Output":"=== RUN TestRunLoadRegistryOpsWardenProduction\n"}
+{"Time":"2026-10-17T22:56:56.256197945Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Output":"--- PASS: TestRunLoadRegistryOpsWardenProduction (0.00s)\n"}
+{"Time":"2026-10-17T22:56:56.256262012Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Elapsed":0}
+{"Time":"2026-10-17T22:56:56.256280786Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors"}
+{"Time":"2026-10-17T22:56:56.25629075Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Output":"=== RUN TestOpsWardenProductionRegistryActors\n"}
+{"Time":"2026-10-17T22:56:56.845178851Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T22:56:56.845249041Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T22:56:56.879527789Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown (0.03s)\n"}
+{"Time":"2026-10-17T22:56:56.879607709Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:56.879724933Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T22:56:56.881952275Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T22:56:56.914034646Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown (0.03s)\n"}
+{"Time":"2026-10-17T22:56:56.918086159Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:56.918160037Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T22:56:56.918173193Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T22:56:56.960443678Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown (0.04s)\n"}
+{"Time":"2026-10-17T22:56:56.960524508Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Elapsed":0.04}
+{"Time":"2026-10-17T22:56:56.960542867Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow"}
+{"Time":"2026-10-17T22:56:56.960553481Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Output":"=== RUN TestOpsWardenProductionRegistryActors/admin_actor_allow\n"}
+{"Time":"2026-10-17T22:56:56.98725424Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Output":"--- PASS: TestOpsWardenProductionRegistryActors/admin_actor_allow (0.03s)\n"}
+{"Time":"2026-10-17T22:56:56.987320832Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:56.98734067Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T22:56:56.987350959Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T22:56:57.022313123Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown (0.03s)\n"}
+{"Time":"2026-10-17T22:56:57.022379454Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:57.022399184Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T22:56:57.022408445Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T22:56:57.074012787Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown (0.05s)\n"}
+{"Time":"2026-10-17T22:56:57.074109804Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Elapsed":0.05}
+{"Time":"2026-10-17T22:56:57.074154412Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown"}
+{"Time":"2026-10-17T22:56:57.0741737Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown\n"}
+{"Time":"2026-10-17T22:56:57.107477591Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown (0.03s)\n"}
+{"Time":"2026-10-17T22:56:57.10755357Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:57.107574796Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Output":"--- PASS: TestOpsWardenProductionRegistryActors (0.85s)\n"}
+{"Time":"2026-10-17T22:56:57.107586672Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Elapsed":0.85}
+{"Time":"2026-10-17T22:56:57.107598503Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor"}
+{"Time":"2026-10-17T22:56:57.107609594Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Output":"=== RUN TestRunValidateAccessDescriptor\n"}
+{"Time":"2026-10-17T22:56:57.10762844Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Output":"--- PASS: TestRunValidateAccessDescriptor (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.10763908Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.10764945Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions"}
+{"Time":"2026-10-17T22:56:57.107658864Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Output":"=== RUN TestOpsWardenFetchDecisions\n"}
+{"Time":"2026-10-17T22:56:57.5217392Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/markitect"}
+{"Time":"2026-10-17T22:56:57.525098125Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/policy"}
+{"Time":"2026-10-17T22:56:57.552437858Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport"}
+{"Time":"2026-10-17T22:56:57.552516498Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Output":"=== RUN TestActionVocabularySeparatesReadFromExport\n"}
+{"Time":"2026-10-17T22:56:57.552838251Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Output":"--- PASS: TestActionVocabularySeparatesReadFromExport (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.553376485Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.553969465Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary"}
+{"Time":"2026-10-17T22:56:57.554026247Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Output":"=== RUN TestActionDefinitionsMirrorVocabulary\n"}
+{"Time":"2026-10-17T22:56:57.55434938Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Output":"--- PASS: TestActionDefinitionsMirrorVocabulary (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.554534044Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.554687391Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates"}
+{"Time":"2026-10-17T22:56:57.554711377Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Output":"=== RUN TestMarkitectCheckFixturePackageValidates\n"}
+{"Time":"2026-10-17T22:56:57.578160687Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission"}
+{"Time":"2026-10-17T22:56:57.578232402Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Output":"=== RUN TestInformedDecisionAttributeAdmission\n"}
+{"Time":"2026-10-17T22:56:57.675508953Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Output":"--- PASS: TestMarkitectCheckFixturePackageValidates (0.12s)\n"}
+{"Time":"2026-10-17T22:56:57.675669667Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Elapsed":0.12}
+{"Time":"2026-10-17T22:56:57.675693446Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract"}
+{"Time":"2026-10-17T22:56:57.675705754Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Output":"=== RUN TestGatewayDecisionAllowContract\n"}
+{"Time":"2026-10-17T22:56:57.675773501Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Output":"--- PASS: TestGatewayDecisionAllowContract (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.675788713Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.675801003Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract"}
+{"Time":"2026-10-17T22:56:57.675851996Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Output":"=== RUN TestGatewayDecisionDenyContract\n"}
+{"Time":"2026-10-17T22:56:57.67586692Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Output":"--- PASS: TestGatewayDecisionDenyContract (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.675878714Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.675890464Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract"}
+{"Time":"2026-10-17T22:56:57.675943314Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Output":"=== RUN TestGatewayDecisionRedactContract\n"}
+{"Time":"2026-10-17T22:56:57.675958409Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Output":"--- PASS: TestGatewayDecisionRedactContract (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.676052395Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.676081783Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract"}
+{"Time":"2026-10-17T22:56:57.676141522Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Output":"=== RUN TestGatewayDecisionAuditDeniedContract\n"}
+{"Time":"2026-10-17T22:56:57.676621939Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Output":"--- PASS: TestGatewayDecisionAuditDeniedContract (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.676854359Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.677029447Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape"}
+{"Time":"2026-10-17T22:56:57.678859657Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Output":"=== RUN TestImportResourceManifestLoadsPinnedMarkitectShape\n"}
+{"Time":"2026-10-17T22:56:57.67891964Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Output":"--- PASS: TestImportResourceManifestLoadsPinnedMarkitectShape (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.67895799Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json"}
+{"Time":"2026-10-17T22:56:57.67897983Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json\n"}
+{"Time":"2026-10-17T22:56:57.682073522Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.682168428Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources"}
+{"Time":"2026-10-17T22:56:57.682183433Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Output":"=== RUN TestImportNamespaceResourceManifestClassifiesAllResources\n"}
+{"Time":"2026-10-17T22:56:57.682204082Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Output":"--- PASS: TestImportNamespaceResourceManifestClassifiesAllResources (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.682216842Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.682228654Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings"}
+{"Time":"2026-10-17T22:56:57.682238844Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Output":"=== RUN TestImportAmbiguousManifestReportsClassificationWarnings\n"}
+{"Time":"2026-10-17T22:56:57.686556447Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Output":"--- PASS: TestImportAmbiguousManifestReportsClassificationWarnings (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.686702553Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.686728983Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType"}
+{"Time":"2026-10-17T22:56:57.686738911Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Output":"=== RUN TestImportRejectsUnknownMarkitectResourceType\n"}
+{"Time":"2026-10-17T22:56:57.686752725Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Output":"--- PASS: TestImportRejectsUnknownMarkitectResourceType (0.00s)\n"}
+{"Time":"2026-10-17T22:56:57.68676461Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.686774186Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:57.696945754Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json (0.02s)\n"}
+{"Time":"2026-10-17T22:56:57.697009767Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:57.69702791Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json"}
+{"Time":"2026-10-17T22:56:57.697038091Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json\n"}
+{"Time":"2026-10-17T22:56:57.702123967Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Output":"ok \tgithub.com/netkingdom/access-engine/internal/markitect\t0.180s\n"}
+{"Time":"2026-10-17T22:56:57.702211362Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Elapsed":0.18}
+{"Time":"2026-10-17T22:56:57.718013871Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json (0.02s)\n"}
+{"Time":"2026-10-17T22:56:57.718187282Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:57.71821464Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json"}
+{"Time":"2026-10-17T22:56:57.718222855Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json\n"}
+{"Time":"2026-10-17T22:56:57.734364468Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/readback"}
+{"Time":"2026-10-17T22:56:57.734441529Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/readback","Output":"? \tgithub.com/netkingdom/access-engine/internal/readback\t[no test files]\n"}
+{"Time":"2026-10-17T22:56:57.734462485Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/readback","Elapsed":0}
+{"Time":"2026-10-17T22:56:57.747617543Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json (0.03s)\n"}
+{"Time":"2026-10-17T22:56:57.747683675Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:57.74770079Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json"}
+{"Time":"2026-10-17T22:56:57.747711133Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json\n"}
+{"Time":"2026-10-17T22:56:57.770079947Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json (0.02s)\n"}
+{"Time":"2026-10-17T22:56:57.770156269Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Elapsed":0.02}
+{"Time":"2026-10-17T22:56:57.770176269Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json"}
+{"Time":"2026-10-17T22:56:57.770197432Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json\n"}
+{"Time":"2026-10-17T22:56:57.791470798Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json (0.03s)\n"}
+{"Time":"2026-10-17T22:56:57.791749873Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Elapsed":0.03}
+{"Time":"2026-10-17T22:56:57.791909605Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Output":"--- PASS: TestOpsWardenFetchDecisions (0.68s)\n"}
+{"Time":"2026-10-17T22:56:57.792281143Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Elapsed":0.68}
+{"Time":"2026-10-17T22:56:57.792445356Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings"}
+{"Time":"2026-10-17T22:56:57.792467177Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Output":"=== RUN TestOpsWardenFetchCallerBindings\n"}
+{"Time":"2026-10-17T22:56:58.05405092Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Output":"--- PASS: TestAttributeContextCarriedWithoutViewHash (4.84s)\n"}
+{"Time":"2026-10-17T22:56:58.054179281Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Elapsed":4.84}
+{"Time":"2026-10-17T22:56:58.054197757Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld"}
+{"Time":"2026-10-17T22:56:58.054207559Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Output":"=== RUN TestUncommittedDenyIsWithheld\n"}
+{"Time":"2026-10-17T22:56:58.122229055Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Output":"--- PASS: TestUncommittedDenyIsWithheld (0.07s)\n"}
+{"Time":"2026-10-17T22:56:58.122299092Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Elapsed":0.07}
+{"Time":"2026-10-17T22:56:58.122335405Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld"}
+{"Time":"2026-10-17T22:56:58.122348002Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Output":"=== RUN TestUncommittedAllowIsWithheld\n"}
+{"Time":"2026-10-17T22:56:58.190179572Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Output":"--- PASS: TestUncommittedAllowIsWithheld (0.06s)\n"}
+{"Time":"2026-10-17T22:56:58.190267455Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Elapsed":0.06}
+{"Time":"2026-10-17T22:56:58.190296337Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow"}
+{"Time":"2026-10-17T22:56:58.190306283Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Output":"=== RUN TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow\n"}
+{"Time":"2026-10-17T22:56:58.275763305Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Output":"--- PASS: TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow (0.09s)\n"}
+{"Time":"2026-10-17T22:56:58.276021875Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Elapsed":0.09}
+{"Time":"2026-10-17T22:56:58.276259858Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit"}
+{"Time":"2026-10-17T22:56:58.276287721Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Output":"=== RUN TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit\n"}
+{"Time":"2026-10-17T22:56:58.344939578Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Output":"--- PASS: TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit (0.06s)\n"}
+{"Time":"2026-10-17T22:56:58.34505389Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Elapsed":0.06}
+{"Time":"2026-10-17T22:56:58.345075333Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext"}
+{"Time":"2026-10-17T22:56:58.345085973Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Output":"=== RUN TestCheckUsesExplicitCaringContext\n"}
+{"Time":"2026-10-17T22:56:58.42141512Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Output":"--- PASS: TestOpsWardenFetchCallerBindings (0.63s)\n"}
+{"Time":"2026-10-17T22:56:58.421570793Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Elapsed":0.63}
+{"Time":"2026-10-17T22:56:58.421602137Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy"}
+{"Time":"2026-10-17T22:56:58.421639351Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Output":"=== RUN TestOpsWardenFetchRegistryMatchesPolicy\n"}
+{"Time":"2026-10-17T22:56:58.448813794Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Output":"--- PASS: TestOpsWardenFetchRegistryMatchesPolicy (0.01s)\n"}
+{"Time":"2026-10-17T22:56:58.448883813Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Elapsed":0.01}
+{"Time":"2026-10-17T22:56:58.448901414Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity"}
+{"Time":"2026-10-17T22:56:58.448910206Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Output":"=== RUN TestActualHTTPAllEffectsWithheldAtOutboxCapacity\n"}
+{"Time":"2026-10-17T22:56:58.463495904Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Output":"--- PASS: TestCheckUsesExplicitCaringContext (0.13s)\n"}
+{"Time":"2026-10-17T22:56:58.463583615Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Elapsed":0.13}
+{"Time":"2026-10-17T22:56:58.463606185Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest"}
+{"Time":"2026-10-17T22:56:58.463616528Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Output":"=== RUN TestCallerProvenanceDoesNotChangeRequestDigest\n"}
+{"Time":"2026-10-17T22:56:58.550100592Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Output":"--- PASS: TestCallerProvenanceDoesNotChangeRequestDigest (0.08s)\n"}
+{"Time":"2026-10-17T22:56:58.550177482Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Elapsed":0.08}
+{"Time":"2026-10-17T22:56:58.550195796Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor"}
+{"Time":"2026-10-17T22:56:58.550207825Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Output":"=== RUN TestCheckMatchesRegistryRelationshipDescriptor\n"}
+{"Time":"2026-10-17T22:56:58.624206688Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Output":"--- PASS: TestCheckMatchesRegistryRelationshipDescriptor (0.08s)\n"}
+{"Time":"2026-10-17T22:56:58.624278754Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Elapsed":0.08}
+{"Time":"2026-10-17T22:56:58.624295851Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder"}
+{"Time":"2026-10-17T22:56:58.624306726Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Output":"=== RUN TestBatchCheckPreservesResourceOrder\n"}
+{"Time":"2026-10-17T22:56:58.736928983Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Output":"--- PASS: TestBatchCheckPreservesResourceOrder (0.10s)\n"}
+{"Time":"2026-10-17T22:56:58.737010517Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Elapsed":0.1}
+{"Time":"2026-10-17T22:56:58.7370561Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources"}
+{"Time":"2026-10-17T22:56:58.737068742Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Output":"=== RUN TestListAllowedReturnsOnlyAllowedResources\n"}
+{"Time":"2026-10-17T22:56:58.82654616Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Output":"--- PASS: TestListAllowedReturnsOnlyAllowedResources (0.10s)\n"}
+{"Time":"2026-10-17T22:56:58.826623032Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Elapsed":0.1}
+{"Time":"2026-10-17T22:56:58.826644024Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision"}
+{"Time":"2026-10-17T22:56:58.826655503Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Output":"=== RUN TestExplainUsesRecordedDecision\n"}
+{"Time":"2026-10-17T22:56:58.89760366Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Output":"--- PASS: TestExplainUsesRecordedDecision (0.08s)\n"}
+{"Time":"2026-10-17T22:56:58.897712111Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Elapsed":0.08}
+{"Time":"2026-10-17T22:56:58.897783095Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest"}
+{"Time":"2026-10-17T22:56:58.897794168Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Output":"=== RUN TestCheckRecordsRegistrySnapshotDigest\n"}
+{"Time":"2026-10-17T22:56:59.032810915Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Output":"--- PASS: TestCheckRecordsRegistrySnapshotDigest (0.14s)\n"}
+{"Time":"2026-10-17T22:56:59.032883341Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Elapsed":0.14}
+{"Time":"2026-10-17T22:56:59.032901493Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes"}
+{"Time":"2026-10-17T22:56:59.032911736Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Output":"=== RUN TestCheckAllowLifetimes\n"}
+{"Time":"2026-10-17T22:56:59.274016588Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Output":"--- PASS: TestCheckAllowLifetimes (0.24s)\n"}
+{"Time":"2026-10-17T22:56:59.274087789Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Elapsed":0.24}
+{"Time":"2026-10-17T22:56:59.274103749Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog"}
+{"Time":"2026-10-17T22:56:59.274119367Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Output":"=== RUN TestCheckWritesDecisionLog\n"}
+{"Time":"2026-10-17T22:56:59.370203581Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Output":"--- PASS: TestCheckWritesDecisionLog (0.10s)\n"}
+{"Time":"2026-10-17T22:56:59.37027424Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Elapsed":0.1}
+{"Time":"2026-10-17T22:56:59.370322843Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes"}
+{"Time":"2026-10-17T22:56:59.370336369Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Output":"=== RUN TestRegistryFactsOverrideCallerSuppliedAttributes\n"}
+{"Time":"2026-10-17T22:56:59.434176204Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Output":"--- PASS: TestRegistryFactsOverrideCallerSuppliedAttributes (0.07s)\n"}
+{"Time":"2026-10-17T22:56:59.434323447Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Elapsed":0.07}
+{"Time":"2026-10-17T22:56:59.434349931Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved"}
+{"Time":"2026-10-17T22:56:59.434361193Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Output":"=== RUN TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved\n"}
+{"Time":"2026-10-17T22:56:59.494174658Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Output":"--- PASS: TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved (0.05s)\n"}
+{"Time":"2026-10-17T22:56:59.494239583Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Elapsed":0.05}
+{"Time":"2026-10-17T22:56:59.494252495Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride"}
+{"Time":"2026-10-17T22:56:59.494259853Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Output":"=== RUN TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride\n"}
+{"Time":"2026-10-17T22:56:59.558013122Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Output":"--- PASS: TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride (0.07s)\n"}
+{"Time":"2026-10-17T22:56:59.558109282Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Elapsed":0.07}
+{"Time":"2026-10-17T22:56:59.558137984Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer"}
+{"Time":"2026-10-17T22:56:59.558165784Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Output":"=== RUN TestSubmittedRequestDigestIsComputableByTheConsumer\n"}
+{"Time":"2026-10-17T22:56:59.609050117Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Output":"--- PASS: TestSubmittedRequestDigestIsComputableByTheConsumer (0.05s)\n"}
+{"Time":"2026-10-17T22:56:59.622053062Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Elapsed":0.05}
+{"Time":"2026-10-17T22:56:59.622130078Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope"}
+{"Time":"2026-10-17T22:56:59.622143063Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Output":"=== RUN TestSignerAuthenticatesReturnedAndRecordedEnvelope\n"}
+{"Time":"2026-10-17T22:56:59.703542066Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Output":"--- PASS: TestSignerAuthenticatesReturnedAndRecordedEnvelope (0.09s)\n"}
+{"Time":"2026-10-17T22:56:59.704054426Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Elapsed":0.09}
+{"Time":"2026-10-17T22:56:59.705394615Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration"}
+{"Time":"2026-10-17T22:56:59.705450513Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Output":"=== RUN TestSignerRejectsInvalidConfiguration\n"}
+{"Time":"2026-10-17T22:56:59.786028798Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Output":"--- PASS: TestSignerRejectsInvalidConfiguration (0.08s)\n"}
+{"Time":"2026-10-17T22:56:59.790350486Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Elapsed":0.08}
+{"Time":"2026-10-17T22:56:59.790477891Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Output":"PASS\n"}
+{"Time":"2026-10-17T22:56:59.802707496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Output":"ok \tgithub.com/netkingdom/access-engine/internal/decision\t6.632s\n"}
+{"Time":"2026-10-17T22:56:59.802805577Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Elapsed":6.632}
+{"Time":"2026-10-17T22:56:59.967237359Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Output":"--- PASS: TestActualHTTPAllEffectsWithheldAtOutboxCapacity (1.53s)\n"}
+{"Time":"2026-10-17T22:56:59.967307378Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Elapsed":1.53}
+{"Time":"2026-10-17T22:56:59.967328325Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins"}
+{"Time":"2026-10-17T22:56:59.967342383Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Output":"=== RUN TestReadbackPinMatchesParticipantPins\n"}
+{"Time":"2026-10-17T22:56:59.967353321Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00"}
+{"Time":"2026-10-17T22:56:59.967361166Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Output":"=== RUN TestReadbackPinMatchesParticipantPins/#00\n"}
+{"Time":"2026-10-17T22:56:59.968451892Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Output":"--- PASS: TestReadbackPinMatchesParticipantPins/#00 (0.00s)\n"}
+{"Time":"2026-10-17T22:56:59.968515185Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Elapsed":0}
+{"Time":"2026-10-17T22:56:59.968531668Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/"}
+{"Time":"2026-10-17T22:56:59.968540099Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Output":"=== RUN TestReadbackPinMatchesParticipantPins/access-engine/\n"}
+{"Time":"2026-10-17T22:56:59.969761161Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Output":"--- PASS: TestReadbackPinMatchesParticipantPins/access-engine/ (0.00s)\n"}
+{"Time":"2026-10-17T22:56:59.970090651Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Elapsed":0}
+{"Time":"2026-10-17T22:56:59.974066824Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Output":"--- PASS: TestReadbackPinMatchesParticipantPins (0.00s)\n"}
+{"Time":"2026-10-17T22:56:59.974226294Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Elapsed":0}
+{"Time":"2026-10-17T22:56:59.974254933Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted"}
+{"Time":"2026-10-17T22:56:59.974275312Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Output":"=== RUN TestReadbackRowsInRequestOrderAndNeverOmitted\n"}
+{"Time":"2026-10-17T22:57:00.017071849Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Output":"--- PASS: TestReadbackRowsInRequestOrderAndNeverOmitted (0.05s)\n"}
+{"Time":"2026-10-17T22:57:00.017145547Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:00.017178974Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA"}
+{"Time":"2026-10-17T22:57:00.017192256Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Output":"=== RUN TestReadbackDeniesWithoutMFA\n"}
+{"Time":"2026-10-17T22:57:00.09695862Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Output":"--- PASS: TestReadbackDeniesWithoutMFA (0.08s)\n"}
+{"Time":"2026-10-17T22:57:00.097037503Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Elapsed":0.08}
+{"Time":"2026-10-17T22:57:00.097055609Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection"}
+{"Time":"2026-10-17T22:57:00.097064969Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Output":"=== RUN TestReadbackSystemsProjection\n"}
+{"Time":"2026-10-17T22:57:00.144764366Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Output":"--- PASS: TestReadbackSystemsProjection (0.04s)\n"}
+{"Time":"2026-10-17T22:57:00.144838443Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:00.144856027Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries"}
+{"Time":"2026-10-17T22:57:00.144865314Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Output":"=== RUN TestReadbackRefusesDuplicateSystemAcrossRegistries\n"}
+{"Time":"2026-10-17T22:57:00.148055752Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Output":"--- PASS: TestReadbackRefusesDuplicateSystemAcrossRegistries (0.01s)\n"}
+{"Time":"2026-10-17T22:57:00.148147007Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:00.148190199Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape"}
+{"Time":"2026-10-17T22:57:00.148204257Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Output":"=== RUN TestReadbackHTTPCallerAndRequestShape\n"}
+{"Time":"2026-10-17T22:57:00.230505436Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Output":"--- PASS: TestReadbackHTTPCallerAndRequestShape (0.08s)\n"}
+{"Time":"2026-10-17T22:57:00.230637746Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Elapsed":0.08}
+{"Time":"2026-10-17T22:57:00.230669036Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin"}
+{"Time":"2026-10-17T22:57:00.230679099Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Output":"=== RUN TestReadbackPrincipalCannotCheckOnEnforcementPin\n"}
+{"Time":"2026-10-17T22:57:00.281976814Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/registry"}
+{"Time":"2026-10-17T22:57:00.302056126Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode"}
+{"Time":"2026-10-17T22:57:00.302117308Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Output":"=== RUN TestTaskRegistryNumericSourceAndStrictDecode\n"}
+{"Time":"2026-10-17T22:57:00.302185902Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Output":"--- PASS: TestTaskRegistryNumericSourceAndStrictDecode (0.00s)\n"}
+{"Time":"2026-10-17T22:57:00.302197435Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Elapsed":0}
+{"Time":"2026-10-17T22:57:00.302210411Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse"}
+{"Time":"2026-10-17T22:57:00.302219996Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Output":"=== RUN TestRegistryManifestsParse\n"}
+{"Time":"2026-10-17T22:57:00.307237482Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Output":"--- PASS: TestRegistryManifestsParse (0.01s)\n"}
+{"Time":"2026-10-17T22:57:00.307402101Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:00.307539605Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse"}
+{"Time":"2026-10-17T22:57:00.307561833Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Output":"=== RUN TestExpandedRegistryExamplesParse\n"}
+{"Time":"2026-10-17T22:57:00.309788254Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Output":"--- PASS: TestExpandedRegistryExamplesParse (0.00s)\n"}
+{"Time":"2026-10-17T22:57:00.315807932Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Elapsed":0}
+{"Time":"2026-10-17T22:57:00.315888564Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests"}
+{"Time":"2026-10-17T22:57:00.315935427Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Output":"=== RUN TestStoreImportsManifests\n"}
+{"Time":"2026-10-17T22:57:00.318073894Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Output":"--- PASS: TestStoreImportsManifests (0.00s)\n"}
+{"Time":"2026-10-17T22:57:00.31815027Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Elapsed":0}
+{"Time":"2026-10-17T22:57:00.318174454Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot"}
+{"Time":"2026-10-17T22:57:00.318186177Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Output":"=== RUN TestStoreLoadsAndSavesDeterministicSnapshot\n"}
+{"Time":"2026-10-17T22:57:00.31820542Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Output":"--- PASS: TestStoreLoadsAndSavesDeterministicSnapshot (0.00s)\n"}
+{"Time":"2026-10-17T22:57:00.318226367Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Elapsed":0}
+{"Time":"2026-10-17T22:57:00.31847518Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges"}
+{"Time":"2026-10-17T22:57:00.318505505Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Output":"=== RUN TestStoreDigestChangesWhenSnapshotChanges\n"}
+{"Time":"2026-10-17T22:57:00.319482812Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Output":"--- PASS: TestStoreDigestChangesWhenSnapshotChanges (0.00s)\n"}
+{"Time":"2026-10-17T22:57:00.319543922Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Elapsed":0}
+{"Time":"2026-10-17T22:57:00.319557565Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords"}
+{"Time":"2026-10-17T22:57:00.319567511Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Output":"=== RUN TestStoreRejectsInvalidRecords\n"}
+{"Time":"2026-10-17T22:57:00.319591741Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Output":"--- PASS: TestStoreRejectsInvalidRecords (0.00s)\n"}
+{"Time":"2026-10-17T22:57:00.319603472Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Elapsed":0}
+{"Time":"2026-10-17T22:57:00.319613102Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Output":"PASS\n"}
+{"Time":"2026-10-17T22:57:00.321535282Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Output":"ok \tgithub.com/netkingdom/access-engine/internal/registry\t0.039s\n"}
+{"Time":"2026-10-17T22:57:00.321749866Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:00.930934313Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Output":"--- PASS: TestReadbackPrincipalCannotCheckOnEnforcementPin (0.69s)\n"}
+{"Time":"2026-10-17T22:57:00.931016451Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Elapsed":0.69}
+{"Time":"2026-10-17T22:57:00.931062593Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects"}
+{"Time":"2026-10-17T22:57:00.931076254Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Output":"=== RUN TestReadbackWithholdsUncommittedEffects\n"}
+{"Time":"2026-10-17T22:57:00.997064026Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Output":"--- PASS: TestReadbackWithholdsUncommittedEffects (0.07s)\n"}
+{"Time":"2026-10-17T22:57:00.997147525Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Elapsed":0.07}
+{"Time":"2026-10-17T22:57:00.997167589Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas"}
+{"Time":"2026-10-17T22:57:00.997179807Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Output":"=== RUN TestReadbackShapesMatchSchemas\n"}
+{"Time":"2026-10-17T22:57:01.059024286Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Output":"--- PASS: TestReadbackShapesMatchSchemas (0.06s)\n"}
+{"Time":"2026-10-17T22:57:01.059100869Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:01.05911931Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue"}
+{"Time":"2026-10-17T22:57:01.059130671Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Output":"=== RUN TestReadbackInformedDecisionCatalogue\n"}
+{"Time":"2026-10-17T22:57:01.307659571Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Output":"--- PASS: TestReadbackInformedDecisionCatalogue (0.25s)\n"}
+{"Time":"2026-10-17T22:57:01.307735461Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Elapsed":0.25}
+{"Time":"2026-10-17T22:57:01.307752359Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP"}
+{"Time":"2026-10-17T22:57:01.307763558Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Output":"=== RUN TestEnforcementWithholdsUncommittedDenyHTTP\n"}
+{"Time":"2026-10-17T22:57:01.745549772Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/schemaguard"}
+{"Time":"2026-10-17T22:57:01.766075064Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas"}
+{"Time":"2026-10-17T22:57:01.766148374Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas\n"}
+{"Time":"2026-10-17T22:57:01.766293056Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json"}
+{"Time":"2026-10-17T22:57:01.766311929Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json\n"}
+{"Time":"2026-10-17T22:57:01.776530556Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json (0.01s)\n"}
+{"Time":"2026-10-17T22:57:01.776970525Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:01.778458642Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json"}
+{"Time":"2026-10-17T22:57:01.778525261Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json\n"}
+{"Time":"2026-10-17T22:57:01.786571189Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json (0.01s)\n"}
+{"Time":"2026-10-17T22:57:01.786644923Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:01.78666284Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json"}
+{"Time":"2026-10-17T22:57:01.786673958Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json\n"}
+{"Time":"2026-10-17T22:57:01.790056365Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:01.79013266Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:01.790154301Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json"}
+{"Time":"2026-10-17T22:57:01.790164211Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json\n"}
+{"Time":"2026-10-17T22:57:01.792264139Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:01.795432656Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:01.795573055Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas (0.03s)\n"}
+{"Time":"2026-10-17T22:57:01.795637663Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:01.795658195Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime"}
+{"Time":"2026-10-17T22:57:01.795667862Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Output":"=== RUN TestEveryAllowExampleStatesItsLifetime\n"}
+{"Time":"2026-10-17T22:57:01.797400283Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Output":"--- PASS: TestEveryAllowExampleStatesItsLifetime (0.00s)\n"}
+{"Time":"2026-10-17T22:57:01.798356643Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Elapsed":0}
+{"Time":"2026-10-17T22:57:01.798429945Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete"}
+{"Time":"2026-10-17T22:57:01.798442686Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":"=== RUN TestApprovalClaimsInFixturesAreComplete\n"}
+{"Time":"2026-10-17T22:57:01.798466221Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":" examples_test.go:91: approval-engine not checked out at /work/home/approval-engine/schemas/approval_claim.schema.json\n"}
+{"Time":"2026-10-17T22:57:01.798483877Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":"--- SKIP: TestApprovalClaimsInFixturesAreComplete (0.00s)\n"}
+{"Time":"2026-10-17T22:57:01.798494833Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Elapsed":0}
+{"Time":"2026-10-17T22:57:01.798506104Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds"}
+{"Time":"2026-10-17T22:57:01.798516005Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Output":"=== RUN TestArrayLengthBounds\n"}
+{"Time":"2026-10-17T22:57:01.798528485Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Output":"--- PASS: TestArrayLengthBounds (0.00s)\n"}
+{"Time":"2026-10-17T22:57:01.798539405Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Elapsed":0}
+{"Time":"2026-10-17T22:57:01.798548945Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Output":"PASS\n"}
+{"Time":"2026-10-17T22:57:01.801247285Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Output":"ok \tgithub.com/netkingdom/access-engine/internal/schemaguard\t0.055s\n"}
+{"Time":"2026-10-17T22:57:01.801302822Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Elapsed":0.056}
+{"Time":"2026-10-17T22:57:02.103976864Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Output":"--- PASS: TestEnforcementWithholdsUncommittedDenyHTTP (0.80s)\n"}
+{"Time":"2026-10-17T22:57:02.104220366Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Elapsed":0.8}
+{"Time":"2026-10-17T22:57:02.105929946Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial"}
+{"Time":"2026-10-17T22:57:02.106018847Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial\n"}
+{"Time":"2026-10-17T22:57:02.109644295Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden"}
+{"Time":"2026-10-17T22:57:02.10969802Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden\n"}
+{"Time":"2026-10-17T22:57:02.360752672Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/sign"}
+{"Time":"2026-10-17T22:57:02.382265927Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility"}
+{"Time":"2026-10-17T22:57:02.38233206Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility\n"}
+{"Time":"2026-10-17T22:57:02.39662577Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1"}
+{"Time":"2026-10-17T22:57:02.396694094Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1\n"}
+{"Time":"2026-10-17T22:57:02.409179975Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1 (0.01s)\n"}
+{"Time":"2026-10-17T22:57:02.413404169Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:02.413471555Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0"}
+{"Time":"2026-10-17T22:57:02.41348298Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1.0\n"}
+{"Time":"2026-10-17T22:57:02.413502249Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1.0 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.413515415Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.413525956Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0"}
+{"Time":"2026-10-17T22:57:02.413534495Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/-0.0\n"}
+{"Time":"2026-10-17T22:57:02.413550293Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/-0.0 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.413560997Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.413571836Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07"}
+{"Time":"2026-10-17T22:57:02.413602242Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1e-07\n"}
+{"Time":"2026-10-17T22:57:02.413616264Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1e-07 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.413627589Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.413639059Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20"}
+{"Time":"2026-10-17T22:57:02.413647914Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1e+20\n"}
+{"Time":"2026-10-17T22:57:02.413660078Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1e+20 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.413671711Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.413681954Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993"}
+{"Time":"2026-10-17T22:57:02.413691702Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993\n"}
+{"Time":"2026-10-17T22:57:02.414539386Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.414892394Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.417982362Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308"}
+{"Time":"2026-10-17T22:57:02.418072678Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308\n"}
+{"Time":"2026-10-17T22:57:02.418098873Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.418112012Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.418125474Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324"}
+{"Time":"2026-10-17T22:57:02.418135547Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/5e-324\n"}
+{"Time":"2026-10-17T22:57:02.418168928Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/5e-324 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.418180831Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.418199181Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true"}
+{"Time":"2026-10-17T22:57:02.418208532Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/true\n"}
+{"Time":"2026-10-17T22:57:02.418228785Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/true (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.418241229Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.418252924Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\""}
+{"Time":"2026-10-17T22:57:02.418264439Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"\n"}
+{"Time":"2026-10-17T22:57:02.429326245Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\" (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.429407346Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.429425426Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]"}
+{"Time":"2026-10-17T22:57:02.429436292Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]\n"}
+{"Time":"2026-10-17T22:57:02.429449926Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0] (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.429464263Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.429476319Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}"}
+{"Time":"2026-10-17T22:57:02.429486166Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}\n"}
+{"Time":"2026-10-17T22:57:02.429506753Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0} (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.429543272Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.42955944Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility (0.05s)\n"}
+{"Time":"2026-10-17T22:57:02.429579188Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:02.429600171Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip"}
+{"Time":"2026-10-17T22:57:02.429613553Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Output":"=== RUN TestSignAndVerifyRoundTrip\n"}
+{"Time":"2026-10-17T22:57:02.429630577Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Output":"--- PASS: TestSignAndVerifyRoundTrip (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.429643346Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.429654509Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification"}
+{"Time":"2026-10-17T22:57:02.429663887Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Output":"=== RUN TestAlteredEnvelopeFailsVerification\n"}
+{"Time":"2026-10-17T22:57:02.433109937Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Output":"--- PASS: TestAlteredEnvelopeFailsVerification (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.433501926Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.436274709Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify"}
+{"Time":"2026-10-17T22:57:02.436342185Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Output":"=== RUN TestUnsignedEnvelopeDoesNotVerify\n"}
+{"Time":"2026-10-17T22:57:02.436360337Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Output":"--- PASS: TestUnsignedEnvelopeDoesNotVerify (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.436369345Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.436378831Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure"}
+{"Time":"2026-10-17T22:57:02.436385603Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Output":"=== RUN TestReplayFixturesProveSuccessAndFailure\n"}
+{"Time":"2026-10-17T22:57:02.436395396Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Output":"--- PASS: TestReplayFixturesProveSuccessAndFailure (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.436404079Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.436412502Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures"}
+{"Time":"2026-10-17T22:57:02.436448823Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":"=== RUN TestWriteReplaySignatureFixtures\n"}
+{"Time":"2026-10-17T22:57:02.436458481Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":" write_fixtures_test.go:15: set UPDATE_FIXTURES=1 to regenerate signed replay fixtures\n"}
+{"Time":"2026-10-17T22:57:02.43646839Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":"--- SKIP: TestWriteReplaySignatureFixtures (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.436476416Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.43648409Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Output":"PASS\n"}
+{"Time":"2026-10-17T22:57:02.450193438Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Output":"ok \tgithub.com/netkingdom/access-engine/internal/sign\t0.089s\n"}
+{"Time":"2026-10-17T22:57:02.450362005Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Elapsed":0.09}
+{"Time":"2026-10-17T22:57:02.95465855Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Output":"--- PASS: TestInformedDecisionAttributeAdmission (5.38s)\n"}
+{"Time":"2026-10-17T22:57:02.954732988Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Elapsed":5.38}
+{"Time":"2026-10-17T22:57:02.95475095Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild"}
+{"Time":"2026-10-17T22:57:02.954762447Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Output":"=== RUN TestSittingImagePinMatchesRecordedBuild\n"}
+{"Time":"2026-10-17T22:57:02.954782519Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Output":"--- PASS: TestSittingImagePinMatchesRecordedBuild (0.00s)\n"}
+{"Time":"2026-10-17T22:57:02.954822962Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Elapsed":0}
+{"Time":"2026-10-17T22:57:02.95503227Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator"}
+{"Time":"2026-10-17T22:57:02.955103227Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":"=== RUN TestAdmissionSetGenerator\n"}
+{"Time":"2026-10-17T22:57:03.182114487Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":" informed_decision_attribute_test.go:120: drift check: exit status 1\n"}
+{"Time":"2026-10-17T22:57:03.18220246Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":" cannot read submitter registry /work/home/informed-decision/deploy/intake-submitters.json: [Errno 2] No such file or directory: '/work/home/informed-decision/deploy/intake-submitters.json'\n"}
+{"Time":"2026-10-17T22:57:03.182242649Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":"--- FAIL: TestAdmissionSetGenerator (0.22s)\n"}
+{"Time":"2026-10-17T22:57:03.182258709Z","Action":"fail","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Elapsed":0.22}
+{"Time":"2026-10-17T22:57:03.182284408Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle"}
+{"Time":"2026-10-17T22:57:03.182321568Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Output":"=== RUN TestInformedDecisionLifecycle\n"}
+{"Time":"2026-10-17T22:57:03.385578362Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access"}
+{"Time":"2026-10-17T22:57:03.385664089Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Output":"=== RUN TestInformedDecisionLifecycle/readback_application_access\n"}
+{"Time":"2026-10-17T22:57:03.41920289Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Output":"--- PASS: TestInformedDecisionLifecycle/readback_application_access (0.03s)\n"}
+{"Time":"2026-10-17T22:57:03.422081775Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:03.422162137Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose"}
+{"Time":"2026-10-17T22:57:03.422176808Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Output":"=== RUN TestInformedDecisionLifecycle/application_access_without_readback_purpose\n"}
+{"Time":"2026-10-17T22:57:03.478085196Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_without_readback_purpose (0.06s)\n"}
+{"Time":"2026-10-17T22:57:03.478173746Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:03.478199355Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access"}
+{"Time":"2026-10-17T22:57:03.478209869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Output":"=== RUN TestInformedDecisionLifecycle/workload_application_access\n"}
+{"Time":"2026-10-17T22:57:03.558066304Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Output":"--- PASS: TestInformedDecisionLifecycle/workload_application_access (0.08s)\n"}
+{"Time":"2026-10-17T22:57:03.558158334Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Elapsed":0.08}
+{"Time":"2026-10-17T22:57:03.558181337Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group"}
+{"Time":"2026-10-17T22:57:03.558192591Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Output":"=== RUN TestInformedDecisionLifecycle/application_access_outside_group\n"}
+{"Time":"2026-10-17T22:57:03.606964507Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_outside_group (0.05s)\n"}
+{"Time":"2026-10-17T22:57:03.607033733Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:03.607080379Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA"}
+{"Time":"2026-10-17T22:57:03.607096051Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Output":"=== RUN TestInformedDecisionLifecycle/application_access_stale_MFA\n"}
+{"Time":"2026-10-17T22:57:03.690318236Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_stale_MFA (0.08s)\n"}
+{"Time":"2026-10-17T22:57:03.690397046Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Elapsed":0.08}
+{"Time":"2026-10-17T22:57:03.690414873Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp"}
+{"Time":"2026-10-17T22:57:03.6904261Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Output":"=== RUN TestInformedDecisionLifecycle/application_access_without_otp\n"}
+{"Time":"2026-10-17T22:57:03.745103992Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_without_otp (0.05s)\n"}
+{"Time":"2026-10-17T22:57:03.745177636Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:03.745196013Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application"}
+{"Time":"2026-10-17T22:57:03.745206085Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Output":"=== RUN TestInformedDecisionLifecycle/application_access_other_application\n"}
+{"Time":"2026-10-17T22:57:03.771560459Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_other_application (0.04s)\n"}
+{"Time":"2026-10-17T22:57:03.771701362Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:03.771732219Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant"}
+{"Time":"2026-10-17T22:57:03.771744365Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Output":"=== RUN TestInformedDecisionLifecycle/application_access_foreign_tenant\n"}
+{"Time":"2026-10-17T22:57:03.796411226Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_foreign_tenant (0.02s)\n"}
+{"Time":"2026-10-17T22:57:03.79658534Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:03.796822251Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration"}
+{"Time":"2026-10-17T22:57:03.796877995Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Output":"=== RUN TestInformedDecisionLifecycle/human_registration\n"}
+{"Time":"2026-10-17T22:57:03.866049054Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Output":"--- PASS: TestInformedDecisionLifecycle/human_registration (0.06s)\n"}
+{"Time":"2026-10-17T22:57:03.866348886Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:03.866489005Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration"}
+{"Time":"2026-10-17T22:57:03.866505345Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Output":"=== RUN TestInformedDecisionLifecycle/workload_registration\n"}
+{"Time":"2026-10-17T22:57:03.920106079Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Output":"--- PASS: TestInformedDecisionLifecycle/workload_registration (0.05s)\n"}
+{"Time":"2026-10-17T22:57:03.920282303Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:03.920420339Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload"}
+{"Time":"2026-10-17T22:57:03.920444524Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Output":"=== RUN TestInformedDecisionLifecycle/foreign_workload\n"}
+{"Time":"2026-10-17T22:57:03.951279242Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Output":"--- PASS: TestInformedDecisionLifecycle/foreign_workload (0.03s)\n"}
+{"Time":"2026-10-17T22:57:03.951505945Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:03.952037219Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience"}
+{"Time":"2026-10-17T22:57:03.952083081Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Output":"=== RUN TestInformedDecisionLifecycle/wrong_workload_audience\n"}
+{"Time":"2026-10-17T22:57:03.970019649Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":" runtime_rename_test.go:106: 10 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:03.970118307Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden (1.86s)\n"}
+{"Time":"2026-10-17T22:57:03.970133816Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Elapsed":1.86}
+{"Time":"2026-10-17T22:57:03.970151617Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch"}
+{"Time":"2026-10-17T22:57:03.970163411Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch\n"}
+{"Time":"2026-10-17T22:57:03.98400307Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_workload_audience (0.03s)\n"}
+{"Time":"2026-10-17T22:57:03.984096534Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:03.984124144Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID"}
+{"Time":"2026-10-17T22:57:03.984135885Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Output":"=== RUN TestInformedDecisionLifecycle/missing_workload_UID\n"}
+{"Time":"2026-10-17T22:57:04.018951898Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Output":"--- PASS: TestInformedDecisionLifecycle/missing_workload_UID (0.04s)\n"}
+{"Time":"2026-10-17T22:57:04.019212307Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:04.019390659Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant"}
+{"Time":"2026-10-17T22:57:04.019413292Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Output":"=== RUN TestInformedDecisionLifecycle/wrong_tenant\n"}
+{"Time":"2026-10-17T22:57:04.060667131Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_tenant (0.04s)\n"}
+{"Time":"2026-10-17T22:57:04.062507263Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:04.062778565Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group"}
+{"Time":"2026-10-17T22:57:04.062803209Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Output":"=== RUN TestInformedDecisionLifecycle/outside_human_group\n"}
+{"Time":"2026-10-17T22:57:04.096845852Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Output":"--- PASS: TestInformedDecisionLifecycle/outside_human_group (0.03s)\n"}
+{"Time":"2026-10-17T22:57:04.096922986Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:04.096942067Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA"}
+{"Time":"2026-10-17T22:57:04.096954483Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Output":"=== RUN TestInformedDecisionLifecycle/stale_author_MFA\n"}
+{"Time":"2026-10-17T22:57:04.124608046Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/stale_author_MFA (0.03s)\n"}
+{"Time":"2026-10-17T22:57:04.124859799Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:04.125993123Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA"}
+{"Time":"2026-10-17T22:57:04.126113855Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Output":"=== RUN TestInformedDecisionLifecycle/future_author_MFA\n"}
+{"Time":"2026-10-17T22:57:04.171341599Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/future_author_MFA (0.05s)\n"}
+{"Time":"2026-10-17T22:57:04.177938003Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:04.178014523Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity"}
+{"Time":"2026-10-17T22:57:04.178028085Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Output":"=== RUN TestInformedDecisionLifecycle/asserted_identity\n"}
+{"Time":"2026-10-17T22:57:04.191121287Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Output":"--- PASS: TestInformedDecisionLifecycle/asserted_identity (0.02s)\n"}
+{"Time":"2026-10-17T22:57:04.191546379Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:04.191934472Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read"}
+{"Time":"2026-10-17T22:57:04.191970622Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Output":"=== RUN TestInformedDecisionLifecycle/owner_read\n"}
+{"Time":"2026-10-17T22:57:04.226713921Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Output":"--- PASS: TestInformedDecisionLifecycle/owner_read (0.03s)\n"}
+{"Time":"2026-10-17T22:57:04.226939208Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:04.229822302Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read"}
+{"Time":"2026-10-17T22:57:04.229871374Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Output":"=== RUN TestInformedDecisionLifecycle/foreign_unpublished_read\n"}
+{"Time":"2026-10-17T22:57:04.264083651Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Output":"--- PASS: TestInformedDecisionLifecycle/foreign_unpublished_read (0.04s)\n"}
+{"Time":"2026-10-17T22:57:04.270101176Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:04.270219365Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator"}
+{"Time":"2026-10-17T22:57:04.270236867Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Output":"=== RUN TestInformedDecisionLifecycle/published_collaborator\n"}
+{"Time":"2026-10-17T22:57:04.316144938Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Output":"--- PASS: TestInformedDecisionLifecycle/published_collaborator (0.05s)\n"}
+{"Time":"2026-10-17T22:57:04.316614277Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:04.316869357Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor"}
+{"Time":"2026-10-17T22:57:04.31689612Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Output":"=== RUN TestInformedDecisionLifecycle/new_revision_editor\n"}
+{"Time":"2026-10-17T22:57:04.382009274Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Output":"--- PASS: TestInformedDecisionLifecycle/new_revision_editor (0.06s)\n"}
+{"Time":"2026-10-17T22:57:04.382081349Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:04.382098608Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action"}
+{"Time":"2026-10-17T22:57:04.382109248Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Output":"=== RUN TestInformedDecisionLifecycle/unknown_action\n"}
+{"Time":"2026-10-17T22:57:04.408351778Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Output":"--- PASS: TestInformedDecisionLifecycle/unknown_action (0.03s)\n"}
+{"Time":"2026-10-17T22:57:04.408423519Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:04.408445873Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance"}
+{"Time":"2026-10-17T22:57:04.408524521Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Output":"=== RUN TestInformedDecisionLifecycle/agent_acceptance\n"}
+{"Time":"2026-10-17T22:57:04.461060243Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Output":"--- PASS: TestInformedDecisionLifecycle/agent_acceptance (0.05s)\n"}
+{"Time":"2026-10-17T22:57:04.461272942Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:04.461444775Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded"}
+{"Time":"2026-10-17T22:57:04.461783481Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Output":"=== RUN TestInformedDecisionLifecycle/human_acceptance_excluded\n"}
+{"Time":"2026-10-17T22:57:04.525071087Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Output":"--- PASS: TestInformedDecisionLifecycle/human_acceptance_excluded (0.06s)\n"}
+{"Time":"2026-10-17T22:57:04.527948392Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:04.528050756Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group"}
+{"Time":"2026-10-17T22:57:04.528066644Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Output":"=== RUN TestInformedDecisionLifecycle/publish_initial_group\n"}
+{"Time":"2026-10-17T22:57:04.5909888Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Output":"--- PASS: TestInformedDecisionLifecycle/publish_initial_group (0.06s)\n"}
+{"Time":"2026-10-17T22:57:04.591061641Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:04.59114524Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group"}
+{"Time":"2026-10-17T22:57:04.591160488Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Output":"=== RUN TestInformedDecisionLifecycle/publish_other_group\n"}
+{"Time":"2026-10-17T22:57:04.629240678Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Output":"--- PASS: TestInformedDecisionLifecycle/publish_other_group (0.04s)\n"}
+{"Time":"2026-10-17T22:57:04.629312924Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:04.629330381Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing"}
+{"Time":"2026-10-17T22:57:04.629341211Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Output":"=== RUN TestInformedDecisionLifecycle/review_routing\n"}
+{"Time":"2026-10-17T22:57:04.665220693Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Output":"--- PASS: TestInformedDecisionLifecycle/review_routing (0.04s)\n"}
+{"Time":"2026-10-17T22:57:04.668426433Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:04.668510582Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing"}
+{"Time":"2026-10-17T22:57:04.668520294Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Output":"=== RUN TestInformedDecisionLifecycle/wrong_review_routing\n"}
+{"Time":"2026-10-17T22:57:04.710203295Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_review_routing (0.04s)\n"}
+{"Time":"2026-10-17T22:57:04.717614085Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:04.717749019Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Output":"--- PASS: TestInformedDecisionLifecycle (1.53s)\n"}
+{"Time":"2026-10-17T22:57:04.717777252Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Elapsed":1.53}
+{"Time":"2026-10-17T22:57:04.717791463Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins"}
+{"Time":"2026-10-17T22:57:04.717821409Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Output":"=== RUN TestInformedDecisionLifecycleReleasePins\n"}
+{"Time":"2026-10-17T22:57:05.035091231Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/taskexecution"}
+{"Time":"2026-10-17T22:57:05.063890281Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary"}
+{"Time":"2026-10-17T22:57:05.06396883Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary\n"}
+{"Time":"2026-10-17T22:57:05.102660702Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect"}
+{"Time":"2026-10-17T22:57:05.102730342Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/redirect\n"}
+{"Time":"2026-10-17T22:57:05.105879037Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/redirect (0.00s)\n"}
+{"Time":"2026-10-17T22:57:05.106001933Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Elapsed":0}
+{"Time":"2026-10-17T22:57:05.106019264Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status"}
+{"Time":"2026-10-17T22:57:05.106030076Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/status\n"}
+{"Time":"2026-10-17T22:57:05.107058198Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/status (0.00s)\n"}
+{"Time":"2026-10-17T22:57:05.107120552Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Elapsed":0}
+{"Time":"2026-10-17T22:57:05.107136314Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large"}
+{"Time":"2026-10-17T22:57:05.107147126Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/large\n"}
+{"Time":"2026-10-17T22:57:05.125003777Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/large (0.02s)\n"}
+{"Time":"2026-10-17T22:57:05.134017987Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:05.134099205Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate"}
+{"Time":"2026-10-17T22:57:05.134112731Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/duplicate\n"}
+{"Time":"2026-10-17T22:57:05.170863144Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/duplicate (0.04s)\n"}
+{"Time":"2026-10-17T22:57:05.170964597Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:05.17098586Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8"}
+{"Time":"2026-10-17T22:57:05.171006563Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/invalid-utf8\n"}
+{"Time":"2026-10-17T22:57:05.174012677Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/invalid-utf8 (0.00s)\n"}
+{"Time":"2026-10-17T22:57:05.174087186Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Elapsed":0}
+{"Time":"2026-10-17T22:57:05.174104454Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media"}
+{"Time":"2026-10-17T22:57:05.174115158Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/media\n"}
+{"Time":"2026-10-17T22:57:05.175322029Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/media (0.00s)\n"}
+{"Time":"2026-10-17T22:57:05.175388775Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Elapsed":0}
+{"Time":"2026-10-17T22:57:05.17540414Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media"}
+{"Time":"2026-10-17T22:57:05.175414348Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/duplicate-media\n"}
+{"Time":"2026-10-17T22:57:05.191911414Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/duplicate-media (0.02s)\n"}
+{"Time":"2026-10-17T22:57:05.198909043Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:05.199076998Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed"}
+{"Time":"2026-10-17T22:57:05.199098568Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/compressed\n"}
+{"Time":"2026-10-17T22:57:05.226054616Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/compressed (0.02s)\n"}
+{"Time":"2026-10-17T22:57:05.226137232Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:05.226154347Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow"}
+{"Time":"2026-10-17T22:57:05.22618653Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/slow\n"}
+{"Time":"2026-10-17T22:57:05.274073027Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/slow (0.05s)\n"}
+{"Time":"2026-10-17T22:57:05.274159006Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:05.275690802Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary (0.21s)\n"}
+{"Time":"2026-10-17T22:57:05.276083909Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Elapsed":0.21}
+{"Time":"2026-10-17T22:57:05.276144857Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract"}
+{"Time":"2026-10-17T22:57:05.276159898Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Output":"=== RUN TestCryptographicInitiatorContract\n"}
+{"Time":"2026-10-17T22:57:05.679719238Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":" runtime_rename_test.go:106: 14 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:05.679936382Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch (1.72s)\n"}
+{"Time":"2026-10-17T22:57:05.680136493Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Elapsed":1.72}
+{"Time":"2026-10-17T22:57:05.685371689Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine"}
+{"Time":"2026-10-17T22:57:05.685432502Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine\n"}
+{"Time":"2026-10-17T22:57:06.008397129Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service"}
+{"Time":"2026-10-17T22:57:06.00847584Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Output":"=== RUN TestCryptographicInitiatorContract/service\n"}
+{"Time":"2026-10-17T22:57:06.014219377Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Output":"--- PASS: TestCryptographicInitiatorContract/service (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.014442807Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.014583665Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant"}
+{"Time":"2026-10-17T22:57:06.014626795Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Output":"=== RUN TestCryptographicInitiatorContract/foreign_tenant\n"}
+{"Time":"2026-10-17T22:57:06.058078969Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Output":"--- PASS: TestCryptographicInitiatorContract/foreign_tenant (0.04s)\n"}
+{"Time":"2026-10-17T22:57:06.058145823Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Elapsed":0.04}
+{"Time":"2026-10-17T22:57:06.058191658Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience"}
+{"Time":"2026-10-17T22:57:06.058201865Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Output":"=== RUN TestCryptographicInitiatorContract/audience\n"}
+{"Time":"2026-10-17T22:57:06.067816146Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Output":"--- PASS: TestCryptographicInitiatorContract/audience (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.068451754Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.073997751Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired"}
+{"Time":"2026-10-17T22:57:06.074063315Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Output":"=== RUN TestCryptographicInitiatorContract/expired\n"}
+{"Time":"2026-10-17T22:57:06.093181307Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Output":"--- PASS: TestCryptographicInitiatorContract/expired (0.02s)\n"}
+{"Time":"2026-10-17T22:57:06.106010454Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:06.106085838Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa"}
+{"Time":"2026-10-17T22:57:06.106100861Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Output":"=== RUN TestCryptographicInitiatorContract/old_mfa\n"}
+{"Time":"2026-10-17T22:57:06.111527937Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Output":"--- PASS: TestCryptographicInitiatorContract/old_mfa (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.126005987Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.126076619Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant"}
+{"Time":"2026-10-17T22:57:06.126088549Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Output":"=== RUN TestCryptographicInitiatorContract/registered_tenant\n"}
+{"Time":"2026-10-17T22:57:06.129322932Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Output":"--- PASS: TestCryptographicInitiatorContract/registered_tenant (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.150062282Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.150152112Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer"}
+{"Time":"2026-10-17T22:57:06.150168568Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Output":"=== RUN TestCryptographicInitiatorContract/issuer\n"}
+{"Time":"2026-10-17T22:57:06.170077565Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Output":"--- PASS: TestCryptographicInitiatorContract/issuer (0.02s)\n"}
+{"Time":"2026-10-17T22:57:06.170153634Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:06.170189784Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future"}
+{"Time":"2026-10-17T22:57:06.170202219Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Output":"=== RUN TestCryptographicInitiatorContract/future\n"}
+{"Time":"2026-10-17T22:57:06.181620694Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Output":"--- PASS: TestCryptographicInitiatorContract/future (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.190061772Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.190133432Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa"}
+{"Time":"2026-10-17T22:57:06.190147147Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Output":"=== RUN TestCryptographicInitiatorContract/no_mfa\n"}
+{"Time":"2026-10-17T22:57:06.195849105Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Output":"--- PASS: TestCryptographicInitiatorContract/no_mfa (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.197154487Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.197836128Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Output":"--- PASS: TestCryptographicInitiatorContract (0.92s)\n"}
+{"Time":"2026-10-17T22:57:06.198544253Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Elapsed":0.92}
+{"Time":"2026-10-17T22:57:06.1987299Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON"}
+{"Time":"2026-10-17T22:57:06.198933771Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Output":"=== RUN TestStrictClaimJSON\n"}
+{"Time":"2026-10-17T22:57:06.199789309Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Output":"--- PASS: TestStrictClaimJSON (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.200218558Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.200251516Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding"}
+{"Time":"2026-10-17T22:57:06.200422104Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Output":"=== RUN TestServicePilotAuthenticatedBinding\n"}
+{"Time":"2026-10-17T22:57:06.208813475Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Output":"--- PASS: TestServicePilotAuthenticatedBinding (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.208884008Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.208902195Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals"}
+{"Time":"2026-10-17T22:57:06.208911276Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Output":"=== RUN TestServicePilotRefusals\n"}
+{"Time":"2026-10-17T22:57:06.208921655Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport"}
+{"Time":"2026-10-17T22:57:06.208930555Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Output":"=== RUN TestServicePilotRefusals/expired_transport\n"}
+{"Time":"2026-10-17T22:57:06.208943107Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Output":"--- PASS: TestServicePilotRefusals/expired_transport (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.208953973Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.208965325Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry"}
+{"Time":"2026-10-17T22:57:06.208975497Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Output":"=== RUN TestServicePilotRefusals/missing_expiry\n"}
+{"Time":"2026-10-17T22:57:06.208987814Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Output":"--- PASS: TestServicePilotRefusals/missing_expiry (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.208997697Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209022936Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection"}
+{"Time":"2026-10-17T22:57:06.209034938Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Output":"=== RUN TestServicePilotRefusals/human_projection\n"}
+{"Time":"2026-10-17T22:57:06.209048645Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Output":"--- PASS: TestServicePilotRefusals/human_projection (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209059105Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209069411Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation"}
+{"Time":"2026-10-17T22:57:06.209078627Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Output":"=== RUN TestServicePilotRefusals/delegation\n"}
+{"Time":"2026-10-17T22:57:06.209113127Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Output":"--- PASS: TestServicePilotRefusals/delegation (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209125733Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209137194Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding"}
+{"Time":"2026-10-17T22:57:06.209148448Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Output":"=== RUN TestServicePilotRefusals/forged_binding\n"}
+{"Time":"2026-10-17T22:57:06.209172271Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Output":"--- PASS: TestServicePilotRefusals/forged_binding (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209184084Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209198998Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply"}
+{"Time":"2026-10-17T22:57:06.2092088Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Output":"=== RUN TestServicePilotRefusals/legacy_apply\n"}
+{"Time":"2026-10-17T22:57:06.209221226Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Output":"--- PASS: TestServicePilotRefusals/legacy_apply (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209231866Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209242552Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant"}
+{"Time":"2026-10-17T22:57:06.209251542Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Output":"=== RUN TestServicePilotRefusals/foreigntenant\n"}
+{"Time":"2026-10-17T22:57:06.209319126Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Output":"--- PASS: TestServicePilotRefusals/foreigntenant (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209332048Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209342336Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience"}
+{"Time":"2026-10-17T22:57:06.209350741Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Output":"=== RUN TestServicePilotRefusals/wrong_audience\n"}
+{"Time":"2026-10-17T22:57:06.209361237Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Output":"--- PASS: TestServicePilotRefusals/wrong_audience (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209370894Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209379839Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified"}
+{"Time":"2026-10-17T22:57:06.209400994Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Output":"=== RUN TestServicePilotRefusals/caller_verified\n"}
+{"Time":"2026-10-17T22:57:06.209412761Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Output":"--- PASS: TestServicePilotRefusals/caller_verified (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209422301Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209431409Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime"}
+{"Time":"2026-10-17T22:57:06.209439506Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Output":"=== RUN TestServicePilotRefusals/lifetime\n"}
+{"Time":"2026-10-17T22:57:06.209449777Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Output":"--- PASS: TestServicePilotRefusals/lifetime (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209459002Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209468181Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human"}
+{"Time":"2026-10-17T22:57:06.209476739Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Output":"=== RUN TestServicePilotRefusals/human\n"}
+{"Time":"2026-10-17T22:57:06.209488217Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Output":"--- PASS: TestServicePilotRefusals/human (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209497514Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209506333Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject"}
+{"Time":"2026-10-17T22:57:06.209514241Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Output":"=== RUN TestServicePilotRefusals/subject\n"}
+{"Time":"2026-10-17T22:57:06.2095248Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Output":"--- PASS: TestServicePilotRefusals/subject (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.20953398Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209543205Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal"}
+{"Time":"2026-10-17T22:57:06.20955508Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Output":"=== RUN TestServicePilotRefusals/wrong_service_principal\n"}
+{"Time":"2026-10-17T22:57:06.209566884Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Output":"--- PASS: TestServicePilotRefusals/wrong_service_principal (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.20957674Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209587651Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Output":"--- PASS: TestServicePilotRefusals (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.209607876Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.209617759Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode"}
+{"Time":"2026-10-17T22:57:06.209625839Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Output":"=== RUN TestServiceInputRuntimeRecheckAndStrictHTTPDecode\n"}
+{"Time":"2026-10-17T22:57:06.226357696Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Output":"--- PASS: TestServiceInputRuntimeRecheckAndStrictHTTPDecode (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.226491233Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.226509015Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Output":"PASS\n"}
+{"Time":"2026-10-17T22:57:06.230066878Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Output":"ok \tgithub.com/netkingdom/access-engine/internal/taskexecution\t1.195s\n"}
+{"Time":"2026-10-17T22:57:06.230152109Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Elapsed":1.195}
+{"Time":"2026-10-17T22:57:06.772346947Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/api"}
+{"Time":"2026-10-17T22:57:06.79712139Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim"}
+{"Time":"2026-10-17T22:57:06.797189895Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Output":"=== RUN TestApprovalBindingDigestSurvivesAttachingTheClaim\n"}
+{"Time":"2026-10-17T22:57:06.797812788Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Output":"--- PASS: TestApprovalBindingDigestSurvivesAttachingTheClaim (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.805847581Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.805953083Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached"}
+{"Time":"2026-10-17T22:57:06.805972875Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Output":"=== RUN TestRequestDigestStillMovesWhenTheClaimIsAttached\n"}
+{"Time":"2026-10-17T22:57:06.805991839Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Output":"--- PASS: TestRequestDigestStillMovesWhenTheClaimIsAttached (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.80600339Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.806014283Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest"}
+{"Time":"2026-10-17T22:57:06.806023552Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Output":"=== RUN TestTheTwoDigestsDisagreeOnAClaimBearingRequest\n"}
+{"Time":"2026-10-17T22:57:06.806035599Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Output":"--- PASS: TestTheTwoDigestsDisagreeOnAClaimBearingRequest (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.806067322Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.806080217Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim"}
+{"Time":"2026-10-17T22:57:06.806089162Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Output":"=== RUN TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim\n"}
+{"Time":"2026-10-17T22:57:06.806102012Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Output":"--- PASS: TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.806112913Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.806124131Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent"}
+{"Time":"2026-10-17T22:57:06.80613304Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Output":"=== RUN TestBindingOmitsApprovalDigestWhenNoClaimIsPresent\n"}
+{"Time":"2026-10-17T22:57:06.806144636Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Output":"--- PASS: TestBindingOmitsApprovalDigestWhenNoClaimIsPresent (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.806155412Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.806165457Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest"}
+{"Time":"2026-10-17T22:57:06.806174113Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Output":"=== RUN TestOtherContextClaimsStillBindUnderTheApprovalDigest\n"}
+{"Time":"2026-10-17T22:57:06.806186007Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Output":"--- PASS: TestOtherContextClaimsStillBindUnderTheApprovalDigest (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.806197306Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.806217622Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant"}
+{"Time":"2026-10-17T22:57:06.806227045Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Output":"=== RUN TestDecisionEffectsListsEveryConstant\n"}
+{"Time":"2026-10-17T22:57:06.80623975Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Output":"--- PASS: TestDecisionEffectsListsEveryConstant (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.806250553Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.80626067Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection"}
+{"Time":"2026-10-17T22:57:06.806269354Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Output":"=== RUN TestRestrictsSplitsByDirection\n"}
+{"Time":"2026-10-17T22:57:06.806292654Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Output":"--- PASS: TestRestrictsSplitsByDirection (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.806306739Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.806317064Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding"}
+{"Time":"2026-10-17T22:57:06.806326063Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding\n"}
+{"Time":"2026-10-17T22:57:06.814022637Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body"}
+{"Time":"2026-10-17T22:57:06.814087426Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/body\n"}
+{"Time":"2026-10-17T22:57:06.814107056Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/body (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814123495Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814136335Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant"}
+{"Time":"2026-10-17T22:57:06.814145127Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/tenant\n"}
+{"Time":"2026-10-17T22:57:06.814161268Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/tenant (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814171431Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814180646Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog"}
+{"Time":"2026-10-17T22:57:06.814189754Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/catalog\n"}
+{"Time":"2026-10-17T22:57:06.814202522Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/catalog (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814213063Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814222549Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr"}
+{"Time":"2026-10-17T22:57:06.814231233Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/ccr\n"}
+{"Time":"2026-10-17T22:57:06.814269259Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/ccr (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814281766Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814291838Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source"}
+{"Time":"2026-10-17T22:57:06.814300909Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/source\n"}
+{"Time":"2026-10-17T22:57:06.814312695Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/source (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814322587Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814332397Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method"}
+{"Time":"2026-10-17T22:57:06.814340378Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/method\n"}
+{"Time":"2026-10-17T22:57:06.814350847Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/method (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814360504Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814369648Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal"}
+{"Time":"2026-10-17T22:57:06.814377691Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/principal\n"}
+{"Time":"2026-10-17T22:57:06.814388602Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/principal (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814400018Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814409315Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action"}
+{"Time":"2026-10-17T22:57:06.814417187Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/action\n"}
+{"Time":"2026-10-17T22:57:06.814429279Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/action (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.81446863Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814484518Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id"}
+{"Time":"2026-10-17T22:57:06.814493887Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id\n"}
+{"Time":"2026-10-17T22:57:06.814506521Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814517422Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814529812Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target"}
+{"Time":"2026-10-17T22:57:06.814538144Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/target\n"}
+{"Time":"2026-10-17T22:57:06.814549127Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/target (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814559073Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814569497Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.814586576Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.81459938Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment"}
+{"Time":"2026-10-17T22:57:06.814608379Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Output":"=== RUN TestExecutionContractApprovalJoinAndEnrichment\n"}
+{"Time":"2026-10-17T22:57:06.814619453Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Output":"--- PASS: TestExecutionContractApprovalJoinAndEnrichment (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.814629182Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.814638082Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet"}
+{"Time":"2026-10-17T22:57:06.814646315Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Output":"=== RUN TestPurposeEntersDigestsOnlyWhenSet\n"}
+{"Time":"2026-10-17T22:57:06.822038746Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Output":"--- PASS: TestPurposeEntersDigestsOnlyWhenSet (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.822143815Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.822161903Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses"}
+{"Time":"2026-10-17T22:57:06.822171723Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Output":"=== RUN TestCaringAccessDescriptorExampleParses\n"}
+{"Time":"2026-10-17T22:57:06.822185024Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Output":"--- PASS: TestCaringAccessDescriptorExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.822195493Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.822204862Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses"}
+{"Time":"2026-10-17T22:57:06.82221424Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Output":"=== RUN TestCheckRequestExampleParses\n"}
+{"Time":"2026-10-17T22:57:06.822225628Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Output":"--- PASS: TestCheckRequestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.822236837Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.822247333Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse"}
+{"Time":"2026-10-17T22:57:06.822256368Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Output":"=== RUN TestRegistryExamplesParse\n"}
+{"Time":"2026-10-17T22:57:06.822267198Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Output":"--- PASS: TestRegistryExamplesParse (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.822276413Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.822286603Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse"}
+{"Time":"2026-10-17T22:57:06.822294691Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Output":"=== RUN TestDecisionAndAuditExamplesParse\n"}
+{"Time":"2026-10-17T22:57:06.830105685Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Output":"--- PASS: TestDecisionAndAuditExamplesParse (0.01s)\n"}
+{"Time":"2026-10-17T22:57:06.830276219Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:06.830300872Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses"}
+{"Time":"2026-10-17T22:57:06.830310602Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Output":"=== RUN TestActionAuthorizationExampleParses\n"}
+{"Time":"2026-10-17T22:57:06.83052688Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Output":"--- PASS: TestActionAuthorizationExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.830552733Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.830642418Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction"}
+{"Time":"2026-10-17T22:57:06.83066002Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Output":"=== RUN TestRequestDigestIgnoresIDAndChangesWithAction\n"}
+{"Time":"2026-10-17T22:57:06.830674303Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Output":"--- PASS: TestRequestDigestIgnoresIDAndChangesWithAction (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.830743745Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.830755116Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone"}
+{"Time":"2026-10-17T22:57:06.830763854Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Output":"=== RUN TestApplyAllowLifetimeDefaultDeclaredAndNone\n"}
+{"Time":"2026-10-17T22:57:06.830921175Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Output":"--- PASS: TestApplyAllowLifetimeDefaultDeclaredAndNone (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.831205579Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.831298438Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON"}
+{"Time":"2026-10-17T22:57:06.831334165Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Output":"=== RUN TestSchemaFilesAreJSON\n"}
+{"Time":"2026-10-17T22:57:06.831346843Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json"}
+{"Time":"2026-10-17T22:57:06.831355779Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/action_authorization.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.831378322Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/action_authorization.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.831388719Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.831398602Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json"}
+{"Time":"2026-10-17T22:57:06.831407538Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/audit_event.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.831424923Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/audit_event.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.831435248Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.831444545Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json"}
+{"Time":"2026-10-17T22:57:06.831452805Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/caring_access_descriptor.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.831486394Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/caring_access_descriptor.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.831497972Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.831507765Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json"}
+{"Time":"2026-10-17T22:57:06.831516448Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/caring_profile.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.845092785Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/caring_profile.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.845277458Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.845298928Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json"}
+{"Time":"2026-10-17T22:57:06.845308631Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/check_request.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.84538415Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/check_request.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.845406089Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.845480932Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json"}
+{"Time":"2026-10-17T22:57:06.845493782Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/decision_envelope.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.845562539Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/decision_envelope.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.845584351Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.845595136Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json"}
+{"Time":"2026-10-17T22:57:06.845671918Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/policy_fixture.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.845690115Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/policy_fixture.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.845762027Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.845775075Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json"}
+{"Time":"2026-10-17T22:57:06.846081923Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/policy_package.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.84643989Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/policy_package.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.846827613Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.847203146Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json"}
+{"Time":"2026-10-17T22:57:06.847232479Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/protected_system_manifest.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.847779123Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/protected_system_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.847867735Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.84790292Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json"}
+{"Time":"2026-10-17T22:57:06.847965735Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_request.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.847987223Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_request.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.847998386Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.848010235Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json"}
+{"Time":"2026-10-17T22:57:06.848054554Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_response.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.848070082Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_response.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.84808148Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.84809148Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json"}
+{"Time":"2026-10-17T22:57:06.848100028Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_systems.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.848214358Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_systems.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.848386065Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.848412188Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json"}
+{"Time":"2026-10-17T22:57:06.848421133Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/relationship_fact.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.848658259Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/relationship_fact.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.848683931Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.84892957Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json"}
+{"Time":"2026-10-17T22:57:06.848960824Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/resource_manifest.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.856683764Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/resource_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.856757029Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.856772873Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json"}
+{"Time":"2026-10-17T22:57:06.856782945Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/subject_manifest.schema.json\n"}
+{"Time":"2026-10-17T22:57:06.85679593Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/subject_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.856806273Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.856817616Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Output":"--- PASS: TestSchemaFilesAreJSON (0.03s)\n"}
+{"Time":"2026-10-17T22:57:06.856828085Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:06.856841792Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses"}
+{"Time":"2026-10-17T22:57:06.856850475Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Output":"=== RUN TestResourceManifestExampleParses\n"}
+{"Time":"2026-10-17T22:57:06.856862116Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Output":"--- PASS: TestResourceManifestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.856898447Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.856909953Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields"}
+{"Time":"2026-10-17T22:57:06.856939575Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Output":"=== RUN TestResourceManifestRequiredFields\n"}
+{"Time":"2026-10-17T22:57:06.856952199Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Output":"--- PASS: TestResourceManifestRequiredFields (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.856961928Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.856972109Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses"}
+{"Time":"2026-10-17T22:57:06.85698109Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Output":"=== RUN TestMarkitectProtectedSystemNamespaceExampleParses\n"}
+{"Time":"2026-10-17T22:57:06.856997006Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Output":"--- PASS: TestMarkitectProtectedSystemNamespaceExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.857007339Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.857017484Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses"}
+{"Time":"2026-10-17T22:57:06.857025698Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Output":"=== RUN TestMarkitectNamespaceResourceManifestExampleParses\n"}
+{"Time":"2026-10-17T22:57:06.857036357Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Output":"--- PASS: TestMarkitectNamespaceResourceManifestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:06.864461736Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:06.864532566Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Output":"PASS\n"}
+{"Time":"2026-10-17T22:57:06.865053655Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/api\t0.093s\n"}
+{"Time":"2026-10-17T22:57:06.865148399Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Elapsed":0.093}
+{"Time":"2026-10-17T22:57:09.206247292Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/decisionpep"}
+{"Time":"2026-10-17T22:57:09.209427176Z","Action":"start","Package":"github.com/netkingdom/access-engine/testsupport/signfixture"}
+{"Time":"2026-10-17T22:57:09.209515166Z","Action":"output","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Output":"? \tgithub.com/netkingdom/access-engine/testsupport/signfixture\t[no test files]\n"}
+{"Time":"2026-10-17T22:57:09.209553048Z","Action":"skip","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Elapsed":0}
+{"Time":"2026-10-17T22:57:09.209588278Z","Action":"start","Package":"github.com/netkingdom/access-engine/tools"}
+{"Time":"2026-10-17T22:57:09.209612706Z","Action":"output","Package":"github.com/netkingdom/access-engine/tools","Output":"? \tgithub.com/netkingdom/access-engine/tools\t[no test files]\n"}
+{"Time":"2026-10-17T22:57:09.209631841Z","Action":"skip","Package":"github.com/netkingdom/access-engine/tools","Elapsed":0}
+{"Time":"2026-10-17T22:57:09.222964421Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision"}
+{"Time":"2026-10-17T22:57:09.22306068Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"=== RUN TestAuthenticDecisionProducerCanonicalPrecision\n"}
+{"Time":"2026-10-17T22:57:09.255995125Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"--- PASS: TestAuthenticDecisionProducerCanonicalPrecision (0.03s)\n"}
+{"Time":"2026-10-17T22:57:09.258002391Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:09.258077225Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings"}
+{"Time":"2026-10-17T22:57:09.258090643Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"=== RUN TestDecisionAdverseBindings\n"}
+{"Time":"2026-10-17T22:57:09.258103898Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator"}
+{"Time":"2026-10-17T22:57:09.258112898Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"=== RUN TestDecisionAdverseBindings/evaluator\n"}
+{"Time":"2026-10-17T22:57:09.260411106Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"--- PASS: TestDecisionAdverseBindings/evaluator (0.00s)\n"}
+{"Time":"2026-10-17T22:57:09.260657151Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Elapsed":0}
+{"Time":"2026-10-17T22:57:09.260956054Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor"}
+{"Time":"2026-10-17T22:57:09.260992836Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"=== RUN TestDecisionAdverseBindings/actor\n"}
+{"Time":"2026-10-17T22:57:09.26601061Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"--- PASS: TestDecisionAdverseBindings/actor (0.00s)\n"}
+{"Time":"2026-10-17T22:57:09.266079935Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Elapsed":0}
+{"Time":"2026-10-17T22:57:09.266094795Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn"}
+{"Time":"2026-10-17T22:57:09.266103813Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"=== RUN TestDecisionAdverseBindings/caller-warn\n"}
+{"Time":"2026-10-17T22:57:09.270043343Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"--- PASS: TestDecisionAdverseBindings/caller-warn (0.01s)\n"}
+{"Time":"2026-10-17T22:57:09.270587624Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:09.274081643Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal"}
+{"Time":"2026-10-17T22:57:09.274158334Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"=== RUN TestDecisionAdverseBindings/caller-principal\n"}
+{"Time":"2026-10-17T22:57:09.274995009Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"--- PASS: TestDecisionAdverseBindings/caller-principal (0.00s)\n"}
+{"Time":"2026-10-17T22:57:09.275372967Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Elapsed":0}
+{"Time":"2026-10-17T22:57:09.2756093Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired"}
+{"Time":"2026-10-17T22:57:09.27564573Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"=== RUN TestDecisionAdverseBindings/expired\n"}
+{"Time":"2026-10-17T22:57:09.279705043Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"--- PASS: TestDecisionAdverseBindings/expired (0.00s)\n"}
+{"Time":"2026-10-17T22:57:09.281065637Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Elapsed":0}
+{"Time":"2026-10-17T22:57:09.281116819Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry"}
+{"Time":"2026-10-17T22:57:09.281127009Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"=== RUN TestDecisionAdverseBindings/subnanosecond-expiry\n"}
+{"Time":"2026-10-17T22:57:09.285107313Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"--- PASS: TestDecisionAdverseBindings/subnanosecond-expiry (0.00s)\n"}
+{"Time":"2026-10-17T22:57:09.290062895Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Elapsed":0}
+{"Time":"2026-10-17T22:57:09.291480484Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect"}
+{"Time":"2026-10-17T22:57:09.29149978Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"=== RUN TestDecisionAdverseBindings/effect\n"}
+{"Time":"2026-10-17T22:57:09.301816694Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"--- PASS: TestDecisionAdverseBindings/effect (0.01s)\n"}
+{"Time":"2026-10-17T22:57:09.301941168Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:09.301967327Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version"}
+{"Time":"2026-10-17T22:57:09.301978392Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"=== RUN TestDecisionAdverseBindings/version\n"}
+{"Time":"2026-10-17T22:57:09.305144565Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"--- PASS: TestDecisionAdverseBindings/version (0.01s)\n"}
+{"Time":"2026-10-17T22:57:09.305513361Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:09.30584195Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant"}
+{"Time":"2026-10-17T22:57:09.305878569Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"=== RUN TestDecisionAdverseBindings/tenant\n"}
+{"Time":"2026-10-17T22:57:09.31307009Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"--- PASS: TestDecisionAdverseBindings/tenant (0.00s)\n"}
+{"Time":"2026-10-17T22:57:09.313462557Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.906257577Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose"}
+{"Time":"2026-10-17T22:57:12.906343647Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"=== RUN TestDecisionAdverseBindings/purpose\n"}
+{"Time":"2026-10-17T22:57:12.909119053Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"--- PASS: TestDecisionAdverseBindings/purpose (0.01s)\n"}
+{"Time":"2026-10-17T22:57:12.909315493Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:12.909339831Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context"}
+{"Time":"2026-10-17T22:57:12.909349308Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"=== RUN TestDecisionAdverseBindings/context\n"}
+{"Time":"2026-10-17T22:57:12.910826577Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"--- PASS: TestDecisionAdverseBindings/context (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.910885838Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.910905928Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile"}
+{"Time":"2026-10-17T22:57:12.910916028Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"=== RUN TestDecisionAdverseBindings/legacy-numeric-profile\n"}
+{"Time":"2026-10-17T22:57:12.92517425Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"--- PASS: TestDecisionAdverseBindings/legacy-numeric-profile (0.01s)\n"}
+{"Time":"2026-10-17T22:57:12.925250419Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:12.925286741Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience"}
+{"Time":"2026-10-17T22:57:12.925300221Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"=== RUN TestDecisionAdverseBindings/caller-audience\n"}
+{"Time":"2026-10-17T22:57:12.928392671Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"--- PASS: TestDecisionAdverseBindings/caller-audience (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.928776274Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.928994176Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired"}
+{"Time":"2026-10-17T22:57:12.929024005Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"=== RUN TestDecisionAdverseBindings/caller-expired\n"}
+{"Time":"2026-10-17T22:57:12.933387752Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"--- PASS: TestDecisionAdverseBindings/caller-expired (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.933679036Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.933832122Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy"}
+{"Time":"2026-10-17T22:57:12.933855423Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"=== RUN TestDecisionAdverseBindings/policy\n"}
+{"Time":"2026-10-17T22:57:12.940784192Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"--- PASS: TestDecisionAdverseBindings/policy (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.940859685Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.940879108Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest"}
+{"Time":"2026-10-17T22:57:12.940891534Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"=== RUN TestDecisionAdverseBindings/policy-digest\n"}
+{"Time":"2026-10-17T22:57:12.94236093Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"--- PASS: TestDecisionAdverseBindings/policy-digest (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.952825718Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.952894475Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry"}
+{"Time":"2026-10-17T22:57:12.95290672Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"=== RUN TestDecisionAdverseBindings/registry\n"}
+{"Time":"2026-10-17T22:57:12.952926017Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"--- PASS: TestDecisionAdverseBindings/registry (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.952938127Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.952948642Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action"}
+{"Time":"2026-10-17T22:57:12.952963836Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"=== RUN TestDecisionAdverseBindings/action\n"}
+{"Time":"2026-10-17T22:57:12.95585448Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"--- PASS: TestDecisionAdverseBindings/action (0.01s)\n"}
+{"Time":"2026-10-17T22:57:12.955960839Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:12.956054753Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource"}
+{"Time":"2026-10-17T22:57:12.956076115Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"=== RUN TestDecisionAdverseBindings/resource\n"}
+{"Time":"2026-10-17T22:57:12.960866281Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"--- PASS: TestDecisionAdverseBindings/resource (0.01s)\n"}
+{"Time":"2026-10-17T22:57:12.961077709Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:12.961211164Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision"}
+{"Time":"2026-10-17T22:57:12.96123267Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"=== RUN TestDecisionAdverseBindings/stale-decision\n"}
+{"Time":"2026-10-17T22:57:12.965799182Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"--- PASS: TestDecisionAdverseBindings/stale-decision (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.966005758Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.968085623Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL"}
+{"Time":"2026-10-17T22:57:12.968137247Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"=== RUN TestDecisionAdverseBindings/excess-TTL\n"}
+{"Time":"2026-10-17T22:57:12.970652843Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"--- PASS: TestDecisionAdverseBindings/excess-TTL (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.971007888Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.971175979Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation"}
+{"Time":"2026-10-17T22:57:12.971205555Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"=== RUN TestDecisionAdverseBindings/obligation\n"}
+{"Time":"2026-10-17T22:57:12.976559687Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"--- PASS: TestDecisionAdverseBindings/obligation (0.00s)\n"}
+{"Time":"2026-10-17T22:57:12.976788472Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Elapsed":0}
+{"Time":"2026-10-17T22:57:12.976914479Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted"}
+{"Time":"2026-10-17T22:57:12.976934714Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"=== RUN TestDecisionAdverseBindings/submitted\n"}
+{"Time":"2026-10-17T22:57:12.983295553Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"--- PASS: TestDecisionAdverseBindings/submitted (0.01s)\n"}
+{"Time":"2026-10-17T22:57:12.984952545Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:12.986068745Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin"}
+{"Time":"2026-10-17T22:57:12.986235943Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"=== RUN TestDecisionAdverseBindings/future-begin\n"}
+{"Time":"2026-10-17T22:57:12.996730694Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"--- PASS: TestDecisionAdverseBindings/future-begin (0.01s)\n"}
+{"Time":"2026-10-17T22:57:12.996818901Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:12.996839848Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL"}
+{"Time":"2026-10-17T22:57:12.996880822Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"=== RUN TestDecisionAdverseBindings/missing-TTL\n"}
+{"Time":"2026-10-17T22:57:12.997417763Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"--- PASS: TestDecisionAdverseBindings/missing-TTL (0.00s)\n"}
+{"Time":"2026-10-17T22:57:13.000718612Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Elapsed":0}
+{"Time":"2026-10-17T22:57:13.000802869Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned"}
+{"Time":"2026-10-17T22:57:13.000814348Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"=== RUN TestDecisionAdverseBindings/unsigned\n"}
+{"Time":"2026-10-17T22:57:13.001353651Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"--- PASS: TestDecisionAdverseBindings/unsigned (0.00s)\n"}
+{"Time":"2026-10-17T22:57:13.001673664Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Elapsed":0}
+{"Time":"2026-10-17T22:57:13.001811719Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"--- PASS: TestDecisionAdverseBindings (0.17s)\n"}
+{"Time":"2026-10-17T22:57:13.002016013Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Elapsed":0.17}
+{"Time":"2026-10-17T22:57:13.002314358Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay"}
+{"Time":"2026-10-17T22:57:13.00234921Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"=== RUN TestSignatureForgeryAndReplay\n"}
+{"Time":"2026-10-17T22:57:13.004716526Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload"}
+{"Time":"2026-10-17T22:57:13.005028439Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"=== RUN TestSignatureForgeryAndReplay/forged-payload\n"}
+{"Time":"2026-10-17T22:57:13.01169426Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"--- PASS: TestSignatureForgeryAndReplay/forged-payload (0.01s)\n"}
+{"Time":"2026-10-17T22:57:13.011873513Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:13.012063155Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key"}
+{"Time":"2026-10-17T22:57:13.012087583Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"=== RUN TestSignatureForgeryAndReplay/wrong-key\n"}
+{"Time":"2026-10-17T22:57:13.028958759Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"--- PASS: TestSignatureForgeryAndReplay/wrong-key (0.01s)\n"}
+{"Time":"2026-10-17T22:57:13.029039562Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:13.029064161Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay"}
+{"Time":"2026-10-17T22:57:13.029074387Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"=== RUN TestSignatureForgeryAndReplay/replay\n"}
+{"Time":"2026-10-17T22:57:13.036744279Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"--- PASS: TestSignatureForgeryAndReplay/replay (0.00s)\n"}
+{"Time":"2026-10-17T22:57:13.036819979Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Elapsed":0}
+{"Time":"2026-10-17T22:57:13.036837977Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"--- PASS: TestSignatureForgeryAndReplay (0.03s)\n"}
+{"Time":"2026-10-17T22:57:13.036850754Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:13.036864776Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse"}
+{"Time":"2026-10-17T22:57:13.036874939Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"=== RUN TestUnavailableAndPublicTokenFileRefuse\n"}
+{"Time":"2026-10-17T22:57:13.040495145Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"--- PASS: TestUnavailableAndPublicTokenFileRefuse (0.01s)\n"}
+{"Time":"2026-10-17T22:57:13.045038405Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:13.045161599Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"PASS\n"}
+{"Time":"2026-10-17T22:57:13.048424919Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/decisionpep\t0.263s\n"}
+{"Time":"2026-10-17T22:57:13.048484226Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Elapsed":0.264}
+{"Time":"2026-10-17T22:57:13.454237046Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":" runtime_rename_test.go:106: 31 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:13.454654661Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine (4.20s)\n"}
+{"Time":"2026-10-17T22:57:13.454911707Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Elapsed":4.2}
+{"Time":"2026-10-17T22:57:13.455216607Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine"}
+{"Time":"2026-10-17T22:57:13.45528577Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine\n"}
+{"Time":"2026-10-17T22:57:14.252987045Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":" runtime_rename_test.go:106: 8 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:14.253131871Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine (0.80s)\n"}
+{"Time":"2026-10-17T22:57:14.253153188Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Elapsed":0.8}
+{"Time":"2026-10-17T22:57:14.253168337Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine"}
+{"Time":"2026-10-17T22:57:14.25317803Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine\n"}
+{"Time":"2026-10-17T22:57:14.310994073Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Output":"--- PASS: TestInformedDecisionLifecycleReleasePins (6.02s)\n"}
+{"Time":"2026-10-17T22:57:14.312302792Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Elapsed":6.02}
+{"Time":"2026-10-17T22:57:14.312383018Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs"}
+{"Time":"2026-10-17T22:57:14.312397248Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Output":"=== RUN TestT03ReviewActs\n"}
+{"Time":"2026-10-17T22:57:19.357109262Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":" runtime_rename_test.go:106: 41 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:19.357537798Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine (5.11s)\n"}
+{"Time":"2026-10-17T22:57:19.360771104Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Elapsed":5.11}
+{"Time":"2026-10-17T22:57:19.360848526Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle"}
+{"Time":"2026-10-17T22:57:19.360864261Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle\n"}
+{"Time":"2026-10-17T22:57:19.595772982Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Output":"--- PASS: TestT03ReviewActs (5.28s)\n"}
+{"Time":"2026-10-17T22:57:19.596099073Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Elapsed":5.28}
+{"Time":"2026-10-17T22:57:19.59644942Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords"}
+{"Time":"2026-10-17T22:57:19.596484425Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Output":"=== RUN TestWP0094ExactRecords\n"}
+{"Time":"2026-10-17T22:57:19.689194898Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":" runtime_rename_test.go:106: 2 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:19.689292672Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle (0.33s)\n"}
+{"Time":"2026-10-17T22:57:19.689309526Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Elapsed":0.33}
+{"Time":"2026-10-17T22:57:19.689328002Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting"}
+{"Time":"2026-10-17T22:57:19.689353764Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting\n"}
+{"Time":"2026-10-17T22:57:23.891631108Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Output":"--- PASS: TestWP0094ExactRecords (4.29s)\n"}
+{"Time":"2026-10-17T22:57:23.891705338Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Elapsed":4.29}
+{"Time":"2026-10-17T22:57:23.891728404Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T22:57:23.891738206Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Output":"=== RUN TestLoadPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T22:57:23.92145837Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Output":"--- PASS: TestLoadPolicyPackageMarkdownValidates (0.03s)\n"}
+{"Time":"2026-10-17T22:57:23.921612682Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Elapsed":0.03}
+{"Time":"2026-10-17T22:57:23.921642962Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T22:57:23.921654171Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Output":"=== RUN TestRedactPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T22:57:23.93093874Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Output":"--- PASS: TestRedactPolicyPackageMarkdownValidates (0.01s)\n"}
+{"Time":"2026-10-17T22:57:23.93102701Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:23.931049851Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T22:57:23.931061952Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Output":"=== RUN TestOpsWardenPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T22:57:24.336011081Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Output":"--- PASS: TestOpsWardenPolicyPackageMarkdownValidates (0.40s)\n"}
+{"Time":"2026-10-17T22:57:24.336082372Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Elapsed":0.4}
+{"Time":"2026-10-17T22:57:24.337486447Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced"}
+{"Time":"2026-10-17T22:57:24.337560415Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Output":"=== RUN TestCaringFindingsAreAdvisoryUntilEnforced\n"}
+{"Time":"2026-10-17T22:57:24.350029658Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Output":"--- PASS: TestCaringFindingsAreAdvisoryUntilEnforced (0.01s)\n"}
+{"Time":"2026-10-17T22:57:24.350200552Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:24.350260661Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead"}
+{"Time":"2026-10-17T22:57:24.350275017Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Output":"=== RUN TestValidateFlagsUndeclaredAttributeRead\n"}
+{"Time":"2026-10-17T22:57:24.362302007Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Output":"--- PASS: TestValidateFlagsUndeclaredAttributeRead (0.01s)\n"}
+{"Time":"2026-10-17T22:57:24.363187522Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:24.363246224Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared"}
+{"Time":"2026-10-17T22:57:24.363259317Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Output":"=== RUN TestOpsWardenAttributeReadsAreDeclared\n"}
+{"Time":"2026-10-17T22:57:24.764692149Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Output":"--- PASS: TestOpsWardenAttributeReadsAreDeclared (0.40s)\n"}
+{"Time":"2026-10-17T22:57:24.76476802Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Elapsed":0.4}
+{"Time":"2026-10-17T22:57:24.764832791Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage"}
+{"Time":"2026-10-17T22:57:24.764864442Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Output":"=== RUN TestFixtureMismatchInvalidatesPackage\n"}
+{"Time":"2026-10-17T22:57:24.777949146Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Output":"--- PASS: TestFixtureMismatchInvalidatesPackage (0.01s)\n"}
+{"Time":"2026-10-17T22:57:24.778017732Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:24.778034765Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses"}
+{"Time":"2026-10-17T22:57:24.778071393Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Output":"=== RUN TestPolicyPackageMetadataParses\n"}
+{"Time":"2026-10-17T22:57:24.780734799Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Output":"--- PASS: TestPolicyPackageMetadataParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:24.780810725Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:24.780833583Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses"}
+{"Time":"2026-10-17T22:57:24.780843683Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Output":"=== RUN TestPolicyFixtureParses\n"}
+{"Time":"2026-10-17T22:57:24.78085637Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Output":"--- PASS: TestPolicyFixtureParses (0.00s)\n"}
+{"Time":"2026-10-17T22:57:24.780865865Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Elapsed":0}
+{"Time":"2026-10-17T22:57:24.780874341Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal"}
+{"Time":"2026-10-17T22:57:24.780881293Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Output":"=== RUN TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal\n"}
+{"Time":"2026-10-17T22:57:24.984899822Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":" runtime_rename_test.go:106: 4 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:24.984981176Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting (5.30s)\n"}
+{"Time":"2026-10-17T22:57:24.985008543Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Elapsed":5.3}
+{"Time":"2026-10-17T22:57:24.985045045Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03"}
+{"Time":"2026-10-17T22:57:24.985058255Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03\n"}
+{"Time":"2026-10-17T22:57:25.064895631Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":" runtime_rename_test.go:106: 1 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T22:57:25.064989618Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03 (0.08s)\n"}
+{"Time":"2026-10-17T22:57:25.065024578Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Elapsed":0.08}
+{"Time":"2026-10-17T22:57:25.065078077Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial (19.38s)\n"}
+{"Time":"2026-10-17T22:57:25.065094191Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Elapsed":19.38}
+{"Time":"2026-10-17T22:57:25.065105814Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary"}
+{"Time":"2026-10-17T22:57:25.065115715Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Output":"=== RUN TestRuntimeRenameReadbackRoutesPreserveCallerBoundary\n"}
+{"Time":"2026-10-17T22:57:25.187370367Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Output":"--- PASS: TestRuntimeRenameReadbackRoutesPreserveCallerBoundary (0.12s)\n"}
+{"Time":"2026-10-17T22:57:25.187434984Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Elapsed":0.12}
+{"Time":"2026-10-17T22:57:25.187452568Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny"}
+{"Time":"2026-10-17T22:57:25.187467086Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny\n"}
+{"Time":"2026-10-17T22:57:25.307455825Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign"}
+{"Time":"2026-10-17T22:57:25.307517196Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign\n"}
+{"Time":"2026-10-17T22:57:25.310265915Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign (0.00s)\n"}
+{"Time":"2026-10-17T22:57:25.310412572Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Elapsed":0}
+{"Time":"2026-10-17T22:57:25.310427712Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience"}
+{"Time":"2026-10-17T22:57:25.310437189Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience\n"}
+{"Time":"2026-10-17T22:57:25.313073192Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience (0.00s)\n"}
+{"Time":"2026-10-17T22:57:25.313147152Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Elapsed":0}
+{"Time":"2026-10-17T22:57:25.313163437Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience"}
+{"Time":"2026-10-17T22:57:25.313173175Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience\n"}
+{"Time":"2026-10-17T22:57:25.315998261Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience (0.00s)\n"}
+{"Time":"2026-10-17T22:57:25.316056729Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Elapsed":0}
+{"Time":"2026-10-17T22:57:25.316084331Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired"}
+{"Time":"2026-10-17T22:57:25.316094412Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired\n"}
+{"Time":"2026-10-17T22:57:25.318931546Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired (0.00s)\n"}
+{"Time":"2026-10-17T22:57:25.319005622Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Elapsed":0}
+{"Time":"2026-10-17T22:57:25.319019987Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry"}
+{"Time":"2026-10-17T22:57:25.319029491Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry\n"}
+{"Time":"2026-10-17T22:57:25.320404089Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry (0.00s)\n"}
+{"Time":"2026-10-17T22:57:25.320469005Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Elapsed":0}
+{"Time":"2026-10-17T22:57:25.320482431Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated"}
+{"Time":"2026-10-17T22:57:25.320507301Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated\n"}
+{"Time":"2026-10-17T22:57:25.327376977Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated (0.01s)\n"}
+{"Time":"2026-10-17T22:57:25.32759441Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:25.517150467Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny (0.33s)\n"}
+{"Time":"2026-10-17T22:57:25.5172198Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Elapsed":0.33}
+{"Time":"2026-10-17T22:57:25.517235842Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse"}
+{"Time":"2026-10-17T22:57:25.51726697Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Output":"=== RUN TestServicePilotGenericEngineAndCLIBypassesRefuse\n"}
+{"Time":"2026-10-17T22:57:25.616829625Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Output":"--- PASS: TestServicePilotGenericEngineAndCLIBypassesRefuse (0.09s)\n"}
+{"Time":"2026-10-17T22:57:25.616904811Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Elapsed":0.09}
+{"Time":"2026-10-17T22:57:25.616928707Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass"}
+{"Time":"2026-10-17T22:57:25.617009023Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Output":"=== RUN TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass\n"}
+{"Time":"2026-10-17T22:57:25.673923688Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Output":"--- PASS: TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass (0.06s)\n"}
+{"Time":"2026-10-17T22:57:25.674144512Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:25.674175171Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord"}
+{"Time":"2026-10-17T22:57:25.674193187Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord\n"}
+{"Time":"2026-10-17T22:57:25.6748772Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned"}
+{"Time":"2026-10-17T22:57:25.674922746Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned\n"}
+{"Time":"2026-10-17T22:57:25.74748553Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned (0.07s)\n"}
+{"Time":"2026-10-17T22:57:25.747559534Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Elapsed":0.07}
+{"Time":"2026-10-17T22:57:25.747586514Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow"}
+{"Time":"2026-10-17T22:57:25.747596469Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow\n"}
+{"Time":"2026-10-17T22:57:25.810993475Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow (0.06s)\n"}
+{"Time":"2026-10-17T22:57:25.811087787Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:25.81111583Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord (0.14s)\n"}
+{"Time":"2026-10-17T22:57:25.811129717Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Elapsed":0.14}
+{"Time":"2026-10-17T22:57:25.811153694Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI"}
+{"Time":"2026-10-17T22:57:25.811164054Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Output":"=== RUN TestServicePilotChildCLI\n"}
+{"Time":"2026-10-17T22:57:25.811178518Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Output":"--- PASS: TestServicePilotChildCLI (0.00s)\n"}
+{"Time":"2026-10-17T22:57:25.811195723Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Elapsed":0}
+{"Time":"2026-10-17T22:57:25.811208942Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals"}
+{"Time":"2026-10-17T22:57:25.811217743Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals\n"}
+{"Time":"2026-10-17T22:57:25.978074305Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T22:57:25.980622259Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect"}
+{"Time":"2026-10-17T22:57:25.980726642Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/redirect\n"}
+{"Time":"2026-10-17T22:57:25.990398357Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/redirect (0.01s)\n"}
+{"Time":"2026-10-17T22:57:25.990467132Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:25.990479909Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate"}
+{"Time":"2026-10-17T22:57:25.990488232Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T22:57:26.010184881Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate (0.02s)\n"}
+{"Time":"2026-10-17T22:57:26.010350744Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:26.010374622Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed"}
+{"Time":"2026-10-17T22:57:26.010385794Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/changed\n"}
+{"Time":"2026-10-17T22:57:26.022749401Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/changed (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.022827049Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.022844137Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired"}
+{"Time":"2026-10-17T22:57:26.02285466Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/expired\n"}
+{"Time":"2026-10-17T22:57:26.036207306Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/expired (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.036279769Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.036315595Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh"}
+{"Time":"2026-10-17T22:57:26.036327164Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T22:57:26.089554399Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh (0.05s)\n"}
+{"Time":"2026-10-17T22:57:26.089628386Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:26.089652597Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale"}
+{"Time":"2026-10-17T22:57:26.08975864Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T22:57:26.101020003Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.103019211Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.103082458Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T22:57:26.103117643Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T22:57:26.10836514Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.108440957Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.221397386Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Output":"--- PASS: TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal (1.44s)\n"}
+{"Time":"2026-10-17T22:57:26.221472076Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Elapsed":1.44}
+{"Time":"2026-10-17T22:57:26.22149011Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal"}
+{"Time":"2026-10-17T22:57:26.221501797Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal\n"}
+{"Time":"2026-10-17T22:57:26.277723434Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Output":" service_task_execution_test.go:21: actual Secrets descriptor generator fork/exec /home/worsch/secrets-engine/.venv/bin/python: no such file or directory\n"}
+{"Time":"2026-10-17T22:57:26.277824473Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Output":"--- FAIL: TestServiceTaskExecutionSourcePredicateAndHardRefusal (0.06s)\n"}
+{"Time":"2026-10-17T22:57:26.277841479Z","Action":"fail","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:26.277861885Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission"}
+{"Time":"2026-10-17T22:57:26.277872399Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Output":"=== RUN TestTaskExecutionPackageClosedAdmission\n"}
+{"Time":"2026-10-17T22:57:26.369427124Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals (0.56s)\n"}
+{"Time":"2026-10-17T22:57:26.369499244Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Elapsed":0.56}
+{"Time":"2026-10-17T22:57:26.369515593Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals"}
+{"Time":"2026-10-17T22:57:26.369525998Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals\n"}
+{"Time":"2026-10-17T22:57:26.411076031Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Output":"--- PASS: TestTaskExecutionPackageClosedAdmission (0.13s)\n"}
+{"Time":"2026-10-17T22:57:26.411197646Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Elapsed":0.13}
+{"Time":"2026-10-17T22:57:26.411243679Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch"}
+{"Time":"2026-10-17T22:57:26.411259613Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Output":"=== RUN TestTaskExecutionSourceHasNoActivationSwitch\n"}
+{"Time":"2026-10-17T22:57:26.411274302Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Output":"--- PASS: TestTaskExecutionSourceHasNoActivationSwitch (0.00s)\n"}
+{"Time":"2026-10-17T22:57:26.411285691Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Elapsed":0}
+{"Time":"2026-10-17T22:57:26.411297684Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection"}
+{"Time":"2026-10-17T22:57:26.411320317Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Output":"=== RUN TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection\n"}
+{"Time":"2026-10-17T22:57:26.413175481Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Output":" task_execution_test.go:43: actual descriptor/canonical generator failed: fork/exec /home/worsch/secrets-engine/.venv/bin/python: no such file or directory\n"}
+{"Time":"2026-10-17T22:57:26.413266312Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Output":"--- FAIL: TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection (0.00s)\n"}
+{"Time":"2026-10-17T22:57:26.413341254Z","Action":"fail","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Elapsed":0}
+{"Time":"2026-10-17T22:57:26.41338148Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Output":"FAIL\n"}
+{"Time":"2026-10-17T22:57:26.421980116Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Output":"FAIL\tgithub.com/netkingdom/access-engine/internal/policy\t25.318s\n"}
+{"Time":"2026-10-17T22:57:26.422061416Z","Action":"fail","Package":"github.com/netkingdom/access-engine/internal/policy","Elapsed":25.318}
+{"Time":"2026-10-17T22:57:26.553987564Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T22:57:26.557711529Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect"}
+{"Time":"2026-10-17T22:57:26.557779059Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect\n"}
+{"Time":"2026-10-17T22:57:26.563731766Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.563825491Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.5638567Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate"}
+{"Time":"2026-10-17T22:57:26.563874518Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T22:57:26.580175451Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate (0.02s)\n"}
+{"Time":"2026-10-17T22:57:26.580253045Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Elapsed":0.02}
+{"Time":"2026-10-17T22:57:26.580278329Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed"}
+{"Time":"2026-10-17T22:57:26.580288572Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed\n"}
+{"Time":"2026-10-17T22:57:26.587561424Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.587626484Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.587642057Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired"}
+{"Time":"2026-10-17T22:57:26.58765102Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired\n"}
+{"Time":"2026-10-17T22:57:26.595420747Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.595479053Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.595491271Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh"}
+{"Time":"2026-10-17T22:57:26.595498494Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T22:57:26.645886972Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh (0.05s)\n"}
+{"Time":"2026-10-17T22:57:26.645982961Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Elapsed":0.05}
+{"Time":"2026-10-17T22:57:26.646003691Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act"}
+{"Time":"2026-10-17T22:57:26.646014593Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act\n"}
+{"Time":"2026-10-17T22:57:26.65215796Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.652251036Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.652292695Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale"}
+{"Time":"2026-10-17T22:57:26.652327592Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T22:57:26.660605353Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.660720819Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.660746987Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T22:57:26.660759259Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T22:57:26.671214824Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind (0.01s)\n"}
+{"Time":"2026-10-17T22:57:26.671296737Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Elapsed":0.01}
+{"Time":"2026-10-17T22:57:26.882745798Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals (0.51s)\n"}
+{"Time":"2026-10-17T22:57:26.882814266Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Elapsed":0.51}
+{"Time":"2026-10-17T22:57:26.882829974Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse"}
+{"Time":"2026-10-17T22:57:26.882860696Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Output":"=== RUN TestTrustedServiceMissingAndGenericAdmissionRefuse\n"}
+{"Time":"2026-10-17T22:57:26.939787429Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Output":"--- PASS: TestTrustedServiceMissingAndGenericAdmissionRefuse (0.06s)\n"}
+{"Time":"2026-10-17T22:57:26.939861785Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Elapsed":0.06}
+{"Time":"2026-10-17T22:57:26.939877322Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"PASS\n"}
+{"Time":"2026-10-17T22:57:26.949768343Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/access-engine\t30.673s\n"}
+{"Time":"2026-10-17T22:57:26.949833411Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":30.675}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-export-test.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-export-test.jsonl
new file mode 100644
index 00000000..1ec90f03
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-export-test.jsonl
@@ -0,0 +1,140 @@
+{"Time":"2026-10-17T23:06:19.442563952Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/decisionpep"}
+{"Time":"2026-10-17T23:06:19.448497431Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision"}
+{"Time":"2026-10-17T23:06:19.448664574Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"=== RUN TestAuthenticDecisionProducerCanonicalPrecision\n"}
+{"Time":"2026-10-17T23:06:19.453799879Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"--- PASS: TestAuthenticDecisionProducerCanonicalPrecision (0.01s)\n"}
+{"Time":"2026-10-17T23:06:19.453867851Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Elapsed":0.01}
+{"Time":"2026-10-17T23:06:19.453955742Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings"}
+{"Time":"2026-10-17T23:06:19.453966716Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"=== RUN TestDecisionAdverseBindings\n"}
+{"Time":"2026-10-17T23:06:19.454079315Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation"}
+{"Time":"2026-10-17T23:06:19.454091921Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"=== RUN TestDecisionAdverseBindings/obligation\n"}
+{"Time":"2026-10-17T23:06:19.456028146Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"--- PASS: TestDecisionAdverseBindings/obligation (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.456096479Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.456105713Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect"}
+{"Time":"2026-10-17T23:06:19.456109554Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"=== RUN TestDecisionAdverseBindings/effect\n"}
+{"Time":"2026-10-17T23:06:19.458184694Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"--- PASS: TestDecisionAdverseBindings/effect (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.458252765Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.458263874Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context"}
+{"Time":"2026-10-17T23:06:19.458269384Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"=== RUN TestDecisionAdverseBindings/context\n"}
+{"Time":"2026-10-17T23:06:19.460167821Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"--- PASS: TestDecisionAdverseBindings/context (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.460238931Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.460249698Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn"}
+{"Time":"2026-10-17T23:06:19.460254288Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"=== RUN TestDecisionAdverseBindings/caller-warn\n"}
+{"Time":"2026-10-17T23:06:19.461705185Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"--- PASS: TestDecisionAdverseBindings/caller-warn (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.461765916Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.461783085Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired"}
+{"Time":"2026-10-17T23:06:19.461788351Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"=== RUN TestDecisionAdverseBindings/caller-expired\n"}
+{"Time":"2026-10-17T23:06:19.462928131Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"--- PASS: TestDecisionAdverseBindings/caller-expired (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.462975309Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.462983732Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL"}
+{"Time":"2026-10-17T23:06:19.462988502Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"=== RUN TestDecisionAdverseBindings/excess-TTL\n"}
+{"Time":"2026-10-17T23:06:19.46429199Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"--- PASS: TestDecisionAdverseBindings/excess-TTL (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.464345003Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.464353875Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator"}
+{"Time":"2026-10-17T23:06:19.4643587Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"=== RUN TestDecisionAdverseBindings/evaluator\n"}
+{"Time":"2026-10-17T23:06:19.465901766Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"--- PASS: TestDecisionAdverseBindings/evaluator (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.465970478Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.46598293Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy"}
+{"Time":"2026-10-17T23:06:19.465994049Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"=== RUN TestDecisionAdverseBindings/policy\n"}
+{"Time":"2026-10-17T23:06:19.468933438Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"--- PASS: TestDecisionAdverseBindings/policy (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.469071023Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.469510802Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest"}
+{"Time":"2026-10-17T23:06:19.469558296Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"=== RUN TestDecisionAdverseBindings/policy-digest\n"}
+{"Time":"2026-10-17T23:06:19.473045303Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"--- PASS: TestDecisionAdverseBindings/policy-digest (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.473092761Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.473129371Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant"}
+{"Time":"2026-10-17T23:06:19.473139606Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"=== RUN TestDecisionAdverseBindings/tenant\n"}
+{"Time":"2026-10-17T23:06:19.474352633Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"--- PASS: TestDecisionAdverseBindings/tenant (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.474412255Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.474419595Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action"}
+{"Time":"2026-10-17T23:06:19.474424537Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"=== RUN TestDecisionAdverseBindings/action\n"}
+{"Time":"2026-10-17T23:06:19.475560197Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"--- PASS: TestDecisionAdverseBindings/action (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.475602199Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.475608276Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal"}
+{"Time":"2026-10-17T23:06:19.47561228Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"=== RUN TestDecisionAdverseBindings/caller-principal\n"}
+{"Time":"2026-10-17T23:06:19.476730761Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"--- PASS: TestDecisionAdverseBindings/caller-principal (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.47677959Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.476786876Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience"}
+{"Time":"2026-10-17T23:06:19.476791538Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"=== RUN TestDecisionAdverseBindings/caller-audience\n"}
+{"Time":"2026-10-17T23:06:19.478109229Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"--- PASS: TestDecisionAdverseBindings/caller-audience (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.47815262Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.478159401Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin"}
+{"Time":"2026-10-17T23:06:19.478163693Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"=== RUN TestDecisionAdverseBindings/future-begin\n"}
+{"Time":"2026-10-17T23:06:19.479169558Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"--- PASS: TestDecisionAdverseBindings/future-begin (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.479198819Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.479205014Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned"}
+{"Time":"2026-10-17T23:06:19.47920918Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"=== RUN TestDecisionAdverseBindings/unsigned\n"}
+{"Time":"2026-10-17T23:06:19.480044655Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"--- PASS: TestDecisionAdverseBindings/unsigned (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.480074547Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.480081553Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version"}
+{"Time":"2026-10-17T23:06:19.480085963Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"=== RUN TestDecisionAdverseBindings/version\n"}
+{"Time":"2026-10-17T23:06:19.480985154Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"--- PASS: TestDecisionAdverseBindings/version (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.48103685Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.481055146Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose"}
+{"Time":"2026-10-17T23:06:19.481073135Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"=== RUN TestDecisionAdverseBindings/purpose\n"}
+{"Time":"2026-10-17T23:06:19.482676732Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"--- PASS: TestDecisionAdverseBindings/purpose (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.482733595Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.482741611Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted"}
+{"Time":"2026-10-17T23:06:19.482746426Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"=== RUN TestDecisionAdverseBindings/submitted\n"}
+{"Time":"2026-10-17T23:06:19.483891878Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"--- PASS: TestDecisionAdverseBindings/submitted (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.483942474Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.483949787Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision"}
+{"Time":"2026-10-17T23:06:19.483961419Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"=== RUN TestDecisionAdverseBindings/stale-decision\n"}
+{"Time":"2026-10-17T23:06:19.485034972Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"--- PASS: TestDecisionAdverseBindings/stale-decision (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.485071672Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.485077461Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry"}
+{"Time":"2026-10-17T23:06:19.485080626Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"=== RUN TestDecisionAdverseBindings/subnanosecond-expiry\n"}
+{"Time":"2026-10-17T23:06:19.486299262Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"--- PASS: TestDecisionAdverseBindings/subnanosecond-expiry (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.486346044Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.486352906Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL"}
+{"Time":"2026-10-17T23:06:19.486357171Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"=== RUN TestDecisionAdverseBindings/missing-TTL\n"}
+{"Time":"2026-10-17T23:06:19.487498926Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"--- PASS: TestDecisionAdverseBindings/missing-TTL (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.487526329Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.487532786Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry"}
+{"Time":"2026-10-17T23:06:19.487536916Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"=== RUN TestDecisionAdverseBindings/registry\n"}
+{"Time":"2026-10-17T23:06:19.4885092Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"--- PASS: TestDecisionAdverseBindings/registry (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.488538515Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.488546766Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor"}
+{"Time":"2026-10-17T23:06:19.488552627Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"=== RUN TestDecisionAdverseBindings/actor\n"}
+{"Time":"2026-10-17T23:06:19.489720478Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"--- PASS: TestDecisionAdverseBindings/actor (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.489760731Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.489776944Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource"}
+{"Time":"2026-10-17T23:06:19.489800533Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"=== RUN TestDecisionAdverseBindings/resource\n"}
+{"Time":"2026-10-17T23:06:19.490681293Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"--- PASS: TestDecisionAdverseBindings/resource (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.490718823Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.490727119Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile"}
+{"Time":"2026-10-17T23:06:19.490732755Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"=== RUN TestDecisionAdverseBindings/legacy-numeric-profile\n"}
+{"Time":"2026-10-17T23:06:19.491622432Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"--- PASS: TestDecisionAdverseBindings/legacy-numeric-profile (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.491666662Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.491689277Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired"}
+{"Time":"2026-10-17T23:06:19.491694345Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"=== RUN TestDecisionAdverseBindings/expired\n"}
+{"Time":"2026-10-17T23:06:19.492690363Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"--- PASS: TestDecisionAdverseBindings/expired (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.492722266Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.492729633Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"--- PASS: TestDecisionAdverseBindings (0.04s)\n"}
+{"Time":"2026-10-17T23:06:19.49273526Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Elapsed":0.04}
+{"Time":"2026-10-17T23:06:19.492764701Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay"}
+{"Time":"2026-10-17T23:06:19.492776244Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"=== RUN TestSignatureForgeryAndReplay\n"}
+{"Time":"2026-10-17T23:06:19.492788092Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload"}
+{"Time":"2026-10-17T23:06:19.492792862Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"=== RUN TestSignatureForgeryAndReplay/forged-payload\n"}
+{"Time":"2026-10-17T23:06:19.493799896Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"--- PASS: TestSignatureForgeryAndReplay/forged-payload (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.493847209Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.493856587Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key"}
+{"Time":"2026-10-17T23:06:19.493878878Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"=== RUN TestSignatureForgeryAndReplay/wrong-key\n"}
+{"Time":"2026-10-17T23:06:19.494746653Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"--- PASS: TestSignatureForgeryAndReplay/wrong-key (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.494777546Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.494785048Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay"}
+{"Time":"2026-10-17T23:06:19.494796834Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"=== RUN TestSignatureForgeryAndReplay/replay\n"}
+{"Time":"2026-10-17T23:06:19.496075426Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"--- PASS: TestSignatureForgeryAndReplay/replay (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.4961153Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.496123596Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"--- PASS: TestSignatureForgeryAndReplay (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.496129169Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.496134678Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse"}
+{"Time":"2026-10-17T23:06:19.496139385Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"=== RUN TestUnavailableAndPublicTokenFileRefuse\n"}
+{"Time":"2026-10-17T23:06:19.496836346Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"--- PASS: TestUnavailableAndPublicTokenFileRefuse (0.00s)\n"}
+{"Time":"2026-10-17T23:06:19.496868132Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Elapsed":0}
+{"Time":"2026-10-17T23:06:19.496875598Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource"}
+{"Time":"2026-10-17T23:06:19.496881252Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource","Output":"=== RUN TestConsumerExportMatchesProducerSource\n"}
+{"Time":"2026-10-17T23:06:19.556997898Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource","Output":"--- PASS: TestConsumerExportMatchesProducerSource (0.06s)\n"}
+{"Time":"2026-10-17T23:06:19.557063985Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource","Elapsed":0.06}
+{"Time":"2026-10-17T23:06:19.557079477Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"PASS\n"}
+{"Time":"2026-10-17T23:06:19.559095012Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/decisionpep\t0.116s\n"}
+{"Time":"2026-10-17T23:06:19.559188025Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Elapsed":0.117}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-test.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-test.jsonl
new file mode 100644
index 00000000..7287978c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-test.jsonl
@@ -0,0 +1,2093 @@
+{"Time":"2026-10-17T23:09:47.630390941Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"}
+{"Time":"2026-10-17T23:09:47.630587261Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/flex-auth"}
+{"Time":"2026-10-17T23:09:47.656963185Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement"}
+{"Time":"2026-10-17T23:09:47.657025431Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Output":"=== RUN TestRetiredBinaryNamesReplacement\n"}
+{"Time":"2026-10-17T23:09:47.686629296Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Output":"--- PASS: TestRetiredBinaryNamesReplacement (0.03s)\n"}
+{"Time":"2026-10-17T23:09:47.686705582Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Test":"TestRetiredBinaryNamesReplacement","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:47.686836954Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:47.696226901Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration"}
+{"Time":"2026-10-17T23:09:47.696287623Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Output":"=== RUN TestEnvelopeSigningStartupConfiguration\n"}
+{"Time":"2026-10-17T23:09:47.798503218Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Output":"--- PASS: TestEnvelopeSigningStartupConfiguration (0.10s)\n"}
+{"Time":"2026-10-17T23:09:47.798577268Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnvelopeSigningStartupConfiguration","Elapsed":0.1}
+{"Time":"2026-10-17T23:09:47.798593003Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"}
+{"Time":"2026-10-17T23:09:47.798599243Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"}
+{"Time":"2026-10-17T23:09:47.933064058Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters"}
+{"Time":"2026-10-17T23:09:47.933103283Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters","Output":"? \tgithub.com/netkingdom/access-engine/internal/adapters\t[no test files]\n"}
+{"Time":"2026-10-17T23:09:47.933177847Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/adapters","Elapsed":0}
+{"Time":"2026-10-17T23:09:47.933199921Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/directory"}
+{"Time":"2026-10-17T23:09:47.956552958Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage"}
+{"Time":"2026-10-17T23:09:47.956612814Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Output":"=== RUN TestGraphResolverDetectsTokenOverage\n"}
+{"Time":"2026-10-17T23:09:47.956929392Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Output":"--- PASS: TestGraphResolverDetectsTokenOverage (0.00s)\n"}
+{"Time":"2026-10-17T23:09:47.956959834Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestGraphResolverDetectsTokenOverage","Elapsed":0}
+{"Time":"2026-10-17T23:09:47.9571676Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance"}
+{"Time":"2026-10-17T23:09:47.957214752Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Output":"=== RUN TestSCIMResolverCarriesDescriptorProvenance\n"}
+{"Time":"2026-10-17T23:09:47.957459534Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Output":"--- PASS: TestSCIMResolverCarriesDescriptorProvenance (0.00s)\n"}
+{"Time":"2026-10-17T23:09:47.957497037Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestSCIMResolverCarriesDescriptorProvenance","Elapsed":0}
+{"Time":"2026-10-17T23:09:47.957529598Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim"}
+{"Time":"2026-10-17T23:09:47.957539796Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Output":"=== RUN TestLDAPResolverUsesDistinguishedNameClaim\n"}
+{"Time":"2026-10-17T23:09:47.957996489Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Output":"--- PASS: TestLDAPResolverUsesDistinguishedNameClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:09:47.95807218Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestLDAPResolverUsesDistinguishedNameClaim","Elapsed":0}
+{"Time":"2026-10-17T23:09:47.958091197Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject"}
+{"Time":"2026-10-17T23:09:47.958101775Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Output":"=== RUN TestMergeResultsAndApplyToSubject\n"}
+{"Time":"2026-10-17T23:09:47.958537154Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Output":"--- PASS: TestMergeResultsAndApplyToSubject (0.00s)\n"}
+{"Time":"2026-10-17T23:09:47.958678879Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Test":"TestMergeResultsAndApplyToSubject","Elapsed":0}
+{"Time":"2026-10-17T23:09:47.958732712Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:48.031346881Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins"}
+{"Time":"2026-10-17T23:09:48.031396935Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins\n"}
+{"Time":"2026-10-17T23:09:48.077534735Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins (0.05s)\n"}
+{"Time":"2026-10-17T23:09:48.077603735Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:48.07761525Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners"}
+{"Time":"2026-10-17T23:09:48.077620192Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners\n"}
+{"Time":"2026-10-17T23:09:48.116789155Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.116857596Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.116868435Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers"}
+{"Time":"2026-10-17T23:09:48.116874458Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers\n"}
+{"Time":"2026-10-17T23:09:48.165049449Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers (0.05s)\n"}
+{"Time":"2026-10-17T23:09:48.16513147Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:48.165340526Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource"}
+{"Time":"2026-10-17T23:09:48.165375116Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource\n"}
+{"Time":"2026-10-17T23:09:48.203848347Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.203914704Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.204110063Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups"}
+{"Time":"2026-10-17T23:09:48.204136926Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups\n"}
+{"Time":"2026-10-17T23:09:48.242913803Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.242980945Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.243011288Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer"}
+{"Time":"2026-10-17T23:09:48.24302467Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer\n"}
+{"Time":"2026-10-17T23:09:48.279722185Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.279864009Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.27987923Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer"}
+{"Time":"2026-10-17T23:09:48.279885325Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer\n"}
+{"Time":"2026-10-17T23:09:48.318230259Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.318282685Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.318296337Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut"}
+{"Time":"2026-10-17T23:09:48.318302424Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut\n"}
+{"Time":"2026-10-17T23:09:48.353520838Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut (0.03s)\n"}
+{"Time":"2026-10-17T23:09:48.353698884Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:48.353722031Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups"}
+{"Time":"2026-10-17T23:09:48.353728542Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups\n"}
+{"Time":"2026-10-17T23:09:48.394879005Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.394938916Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.394951107Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider"}
+{"Time":"2026-10-17T23:09:48.394957302Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/outsider\n"}
+{"Time":"2026-10-17T23:09:48.431323519Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/outsider (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.431414232Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.431444909Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups"}
+{"Time":"2026-10-17T23:09:48.431455901Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups\n"}
+{"Time":"2026-10-17T23:09:48.469875311Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.469933382Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.470124138Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant"}
+{"Time":"2026-10-17T23:09:48.470149169Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant\n"}
+{"Time":"2026-10-17T23:09:48.510531628Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.510595146Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.510607391Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance"}
+{"Time":"2026-10-17T23:09:48.510613234Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance\n"}
+{"Time":"2026-10-17T23:09:48.549016589Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.549086707Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.549108854Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action"}
+{"Time":"2026-10-17T23:09:48.549117934Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action\n"}
+{"Time":"2026-10-17T23:09:48.592426267Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.592490515Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.672669142Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy (0.87s)\n"}
+{"Time":"2026-10-17T23:09:48.672717122Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":0.87}
+{"Time":"2026-10-17T23:09:48.672766934Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion"}
+{"Time":"2026-10-17T23:09:48.6727744Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Output":"=== RUN TestRunVersion\n"}
+{"Time":"2026-10-17T23:09:48.672980591Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Output":"--- PASS: TestRunVersion (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.673001673Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunVersion","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.673018391Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy"}
+{"Time":"2026-10-17T23:09:48.673029501Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Output":"=== RUN TestRunTestPolicy\n"}
+{"Time":"2026-10-17T23:09:48.691388731Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/flex-auth\t1.060s\n"}
+{"Time":"2026-10-17T23:09:48.691519923Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/flex-auth","Elapsed":1.061}
+{"Time":"2026-10-17T23:09:48.693158095Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak"}
+{"Time":"2026-10-17T23:09:48.714933568Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Output":"--- PASS: TestRunTestPolicy (0.04s)\n"}
+{"Time":"2026-10-17T23:09:48.715008366Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunTestPolicy","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:48.715029782Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck"}
+{"Time":"2026-10-17T23:09:48.715037853Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Output":"=== RUN TestRunCheck\n"}
+{"Time":"2026-10-17T23:09:48.715207602Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape"}
+{"Time":"2026-10-17T23:09:48.715238441Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Output":"=== RUN TestBuildAuthorizationRequestUsesUMAPermissionShape\n"}
+{"Time":"2026-10-17T23:09:48.715705093Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Output":"--- PASS: TestBuildAuthorizationRequestUsesUMAPermissionShape (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.715749142Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestBuildAuthorizationRequestUsesUMAPermissionShape","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.715979752Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest"}
+{"Time":"2026-10-17T23:09:48.716114911Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Output":"=== RUN TestResourceRegistrationsFromManifest\n"}
+{"Time":"2026-10-17T23:09:48.71642884Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Output":"--- PASS: TestResourceRegistrationsFromManifest (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.71657804Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestResourceRegistrationsFromManifest","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.716683145Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow"}
+{"Time":"2026-10-17T23:09:48.716699638Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Output":"=== RUN TestAdapterCheckWrapsKeycloakAllow\n"}
+{"Time":"2026-10-17T23:09:48.719490945Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Output":"--- PASS: TestAdapterCheckWrapsKeycloakAllow (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.719546689Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterCheckWrapsKeycloakAllow","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.719674437Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak"}
+{"Time":"2026-10-17T23:09:48.71969679Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Output":"=== RUN TestAdapterFailsClosedOnUnavailableKeycloak\n"}
+{"Time":"2026-10-17T23:09:48.720498938Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Output":"--- PASS: TestAdapterFailsClosedOnUnavailableKeycloak (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.72057049Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestAdapterFailsClosedOnUnavailableKeycloak","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.720611861Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient"}
+{"Time":"2026-10-17T23:09:48.720623024Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Output":"=== RUN TestRegisterResourceManifestDelegatesToClient\n"}
+{"Time":"2026-10-17T23:09:48.721030514Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Output":"--- PASS: TestRegisterResourceManifestDelegatesToClient (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.721175881Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Test":"TestRegisterResourceManifestDelegatesToClient","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.721303385Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:48.771863171Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship"}
+{"Time":"2026-10-17T23:09:48.783656125Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Output":"--- PASS: TestRunCheck (0.07s)\n"}
+{"Time":"2026-10-17T23:09:48.783743205Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheck","Elapsed":0.07}
+{"Time":"2026-10-17T23:09:48.783758958Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck"}
+{"Time":"2026-10-17T23:09:48.783767578Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Output":"=== RUN TestRunBatchCheck\n"}
+{"Time":"2026-10-17T23:09:48.794793722Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry"}
+{"Time":"2026-10-17T23:09:48.794863002Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Output":"=== RUN TestSnapshotToTuplesMapsCanonicalRegistry\n"}
+{"Time":"2026-10-17T23:09:48.798971188Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Output":"--- PASS: TestSnapshotToTuplesMapsCanonicalRegistry (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.799024904Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestSnapshotToTuplesMapsCanonicalRegistry","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.799037122Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple"}
+{"Time":"2026-10-17T23:09:48.799043939Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Output":"=== RUN TestAdapterCheckPreservesCARINGFromMatchedTuple\n"}
+{"Time":"2026-10-17T23:09:48.800644613Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Output":"--- PASS: TestAdapterCheckPreservesCARINGFromMatchedTuple (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.800720421Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckPreservesCARINGFromMatchedTuple","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.800731539Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend"}
+{"Time":"2026-10-17T23:09:48.800737454Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Output":"=== RUN TestAdapterCheckFailsClosedOnStaleBackend\n"}
+{"Time":"2026-10-17T23:09:48.801582118Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Output":"--- PASS: TestAdapterCheckFailsClosedOnStaleBackend (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.80161357Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestAdapterCheckFailsClosedOnStaleBackend","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.801623543Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder"}
+{"Time":"2026-10-17T23:09:48.801629008Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Output":"=== RUN TestBatchCheckPreservesBackendOrder\n"}
+{"Time":"2026-10-17T23:09:48.802215535Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Output":"--- PASS: TestBatchCheckPreservesBackendOrder (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.802241081Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestBatchCheckPreservesBackendOrder","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.802250107Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults"}
+{"Time":"2026-10-17T23:09:48.802255193Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Output":"=== RUN TestListAllowedReturnsEnvelopeResults\n"}
+{"Time":"2026-10-17T23:09:48.802725009Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Output":"--- PASS: TestListAllowedReturnsEnvelopeResults (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.80276409Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestListAllowedReturnsEnvelopeResults","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.802903749Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples"}
+{"Time":"2026-10-17T23:09:48.802916662Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Output":"=== RUN TestImportTuplesDelegatesSnapshotTuples\n"}
+{"Time":"2026-10-17T23:09:48.80466792Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Output":"--- PASS: TestImportTuplesDelegatesSnapshotTuples (0.00s)\n"}
+{"Time":"2026-10-17T23:09:48.80473352Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Test":"TestImportTuplesDelegatesSnapshotTuples","Elapsed":0}
+{"Time":"2026-10-17T23:09:48.804759689Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:48.842302384Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Output":"--- PASS: TestRunBatchCheck (0.06s)\n"}
+{"Time":"2026-10-17T23:09:48.842368949Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunBatchCheck","Elapsed":0.06}
+{"Time":"2026-10-17T23:09:48.842382006Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden"}
+{"Time":"2026-10-17T23:09:48.842387489Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Output":"=== RUN TestRunCheckOpsWarden\n"}
+{"Time":"2026-10-17T23:09:48.96210109Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/directory\t1.029s\n"}
+{"Time":"2026-10-17T23:09:48.962152272Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/directory","Elapsed":1.029}
+{"Time":"2026-10-17T23:09:48.963312503Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/rule"}
+{"Time":"2026-10-17T23:09:49.005671288Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck"}
+{"Time":"2026-10-17T23:09:49.005729224Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Output":"=== RUN TestCanonicalInputFromCheck\n"}
+{"Time":"2026-10-17T23:09:49.00778619Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Output":"--- PASS: TestCanonicalInputFromCheck (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.007827183Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestCanonicalInputFromCheck","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.007835379Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures"}
+{"Time":"2026-10-17T23:09:49.007840068Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Output":"=== RUN TestPolicyArtifactFromPackagePreservesRegoAndFixtures\n"}
+{"Time":"2026-10-17T23:09:49.054683344Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Output":"--- PASS: TestPolicyArtifactFromPackagePreservesRegoAndFixtures (0.05s)\n"}
+{"Time":"2026-10-17T23:09:49.054771019Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestPolicyArtifactFromPackagePreservesRegoAndFixtures","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:49.054795997Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult"}
+{"Time":"2026-10-17T23:09:49.054804248Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Output":"=== RUN TestAdapterCheckWrapsRuleResult\n"}
+{"Time":"2026-10-17T23:09:49.055369951Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Output":"--- PASS: TestAdapterCheckWrapsRuleResult (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.055418365Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterCheckWrapsRuleResult","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.055522424Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy"}
+{"Time":"2026-10-17T23:09:49.055542145Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Output":"=== RUN TestAdapterFailsClosedOnStalePolicy\n"}
+{"Time":"2026-10-17T23:09:49.056281419Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Output":"--- PASS: TestAdapterFailsClosedOnStalePolicy (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.056336334Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestAdapterFailsClosedOnStalePolicy","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.056356415Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder"}
+{"Time":"2026-10-17T23:09:49.056363196Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Output":"=== RUN TestBatchCheckPreservesOrder\n"}
+{"Time":"2026-10-17T23:09:49.05701187Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Output":"--- PASS: TestBatchCheckPreservesOrder (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.057058218Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestBatchCheckPreservesOrder","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.057072412Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations"}
+{"Time":"2026-10-17T23:09:49.05707757Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Output":"=== RUN TestEvaluateFixturesComparesExpectations\n"}
+{"Time":"2026-10-17T23:09:49.057301405Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Output":"--- PASS: TestEvaluateFixturesComparesExpectations (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.057317428Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestEvaluateFixturesComparesExpectations","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.057325472Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact"}
+{"Time":"2026-10-17T23:09:49.05733081Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Output":"=== RUN TestImportPolicyDelegatesArtifact\n"}
+{"Time":"2026-10-17T23:09:49.099007033Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Output":"--- PASS: TestImportPolicyDelegatesArtifact (0.04s)\n"}
+{"Time":"2026-10-17T23:09:49.099074617Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Test":"TestImportPolicyDelegatesArtifact","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:49.099165096Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:49.429339996Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Output":"--- PASS: TestRunCheckOpsWarden (0.59s)\n"}
+{"Time":"2026-10-17T23:09:49.429413739Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunCheckOpsWarden","Elapsed":0.59}
+{"Time":"2026-10-17T23:09:49.429432333Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract"}
+{"Time":"2026-10-17T23:09:49.429440638Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Output":"=== RUN TestRunRailiancePlatformCredentialGrantContract\n"}
+{"Time":"2026-10-17T23:09:49.72503789Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/keycloak\t1.032s\n"}
+{"Time":"2026-10-17T23:09:49.7250968Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/keycloak","Elapsed":1.032}
+{"Time":"2026-10-17T23:09:49.726667406Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz"}
+{"Time":"2026-10-17T23:09:49.778674479Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry"}
+{"Time":"2026-10-17T23:09:49.778724561Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Output":"=== RUN TestSnapshotToDirectoryMapsCanonicalRegistry\n"}
+{"Time":"2026-10-17T23:09:49.782271357Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Output":"--- PASS: TestSnapshotToDirectoryMapsCanonicalRegistry (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.782340285Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestSnapshotToDirectoryMapsCanonicalRegistry","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.782353648Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope"}
+{"Time":"2026-10-17T23:09:49.782359482Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Output":"=== RUN TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope\n"}
+{"Time":"2026-10-17T23:09:49.783428211Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Output":"--- PASS: TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.783480457Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckWrapsTopazAllowInFlexAuthEnvelope","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.783499871Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz"}
+{"Time":"2026-10-17T23:09:49.783506048Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Output":"=== RUN TestAdapterCheckFailsClosedOnUnavailableTopaz\n"}
+{"Time":"2026-10-17T23:09:49.784122292Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Output":"--- PASS: TestAdapterCheckFailsClosedOnUnavailableTopaz (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.784194953Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestAdapterCheckFailsClosedOnUnavailableTopaz","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.784207928Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations"}
+{"Time":"2026-10-17T23:09:49.784213835Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Output":"=== RUN TestImportDirectoryWritesObjectsAndRelations\n"}
+{"Time":"2026-10-17T23:09:49.785410532Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Output":"--- PASS: TestImportDirectoryWritesObjectsAndRelations (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.785445528Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportDirectoryWritesObjectsAndRelations","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.785465294Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle"}
+{"Time":"2026-10-17T23:09:49.785478657Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Output":"=== RUN TestImportPolicyWritesTopazBundle\n"}
+{"Time":"2026-10-17T23:09:49.809149382Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/relationship\t1.037s\n"}
+{"Time":"2026-10-17T23:09:49.80919904Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/relationship","Elapsed":1.037}
+{"Time":"2026-10-17T23:09:49.810799007Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/audit"}
+{"Time":"2026-10-17T23:09:49.829039007Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions"}
+{"Time":"2026-10-17T23:09:49.829109422Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Output":"=== RUN TestJSONLDecisionLogRoundTripsDecisions\n"}
+{"Time":"2026-10-17T23:09:49.833215758Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Output":"--- PASS: TestImportPolicyWritesTopazBundle (0.05s)\n"}
+{"Time":"2026-10-17T23:09:49.833285759Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestImportPolicyWritesTopazBundle","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:49.833308735Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape"}
+{"Time":"2026-10-17T23:09:49.83331584Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Output":"=== RUN TestHTTPClientUsesTopazDirectoryRESTShape\n"}
+{"Time":"2026-10-17T23:09:49.834923924Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Output":"--- PASS: TestJSONLDecisionLogRoundTripsDecisions (0.01s)\n"}
+{"Time":"2026-10-17T23:09:49.834986297Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/audit","Test":"TestJSONLDecisionLogRoundTripsDecisions","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:49.835238422Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:49.841288207Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Output":"--- PASS: TestRunRailiancePlatformCredentialGrantContract (0.41s)\n"}
+{"Time":"2026-10-17T23:09:49.841392302Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunRailiancePlatformCredentialGrantContract","Elapsed":0.41}
+{"Time":"2026-10-17T23:09:49.841421699Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract"}
+{"Time":"2026-10-17T23:09:49.841435982Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Output":"=== RUN TestServeOpsWardenCheckContract\n"}
+{"Time":"2026-10-17T23:09:49.849642546Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Output":"--- PASS: TestHTTPClientUsesTopazDirectoryRESTShape (0.02s)\n"}
+{"Time":"2026-10-17T23:09:49.84970811Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestHTTPClientUsesTopazDirectoryRESTShape","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:49.849729391Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample"}
+{"Time":"2026-10-17T23:09:49.849738471Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":"=== RUN TestTopazDockerComposeExample\n"}
+{"Time":"2026-10-17T23:09:49.85008623Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":" integration_test.go:17: set ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION=1 to run the examples/topaz docker-compose integration\n"}
+{"Time":"2026-10-17T23:09:49.850111361Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Output":"--- SKIP: TestTopazDockerComposeExample (0.00s)\n"}
+{"Time":"2026-10-17T23:09:49.850320461Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Test":"TestTopazDockerComposeExample","Elapsed":0}
+{"Time":"2026-10-17T23:09:49.850354222Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:50.106974944Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/rule\t1.144s\n"}
+{"Time":"2026-10-17T23:09:50.107027127Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/rule","Elapsed":1.144}
+{"Time":"2026-10-17T23:09:50.115323682Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/callerauth"}
+{"Time":"2026-10-17T23:09:50.136294905Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding"}
+{"Time":"2026-10-17T23:09:50.136376989Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Output":"=== RUN TestAuthenticatorEnforcesAudienceAndSystemBinding\n"}
+{"Time":"2026-10-17T23:09:50.136755095Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Output":"--- PASS: TestAuthenticatorEnforcesAudienceAndSystemBinding (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.136780199Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorEnforcesAudienceAndSystemBinding","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.136876278Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure"}
+{"Time":"2026-10-17T23:09:50.13690682Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Output":"=== RUN TestAuthenticatorRejectsMissingTokenAndReviewerFailure\n"}
+{"Time":"2026-10-17T23:09:50.137197685Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Output":"--- PASS: TestAuthenticatorRejectsMissingTokenAndReviewerFailure (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.137217956Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorRejectsMissingTokenAndReviewerFailure","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.137231671Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure"}
+{"Time":"2026-10-17T23:09:50.137239083Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Output":"=== RUN TestAuthenticatorWarnModePermitsButRecordsFailure\n"}
+{"Time":"2026-10-17T23:09:50.137484627Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Output":"--- PASS: TestAuthenticatorWarnModePermitsButRecordsFailure (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.13750781Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModePermitsButRecordsFailure","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.137530552Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal"}
+{"Time":"2026-10-17T23:09:50.137535529Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Output":"=== RUN TestAuthenticatorWarnModeKeepsObservedPrincipal\n"}
+{"Time":"2026-10-17T23:09:50.137788661Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Output":"--- PASS: TestAuthenticatorWarnModeKeepsObservedPrincipal (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.137922609Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestAuthenticatorWarnModeKeepsObservedPrincipal","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.137944331Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence"}
+{"Time":"2026-10-17T23:09:50.13795719Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Output":"=== RUN TestDisabledRecordStatesAbsence\n"}
+{"Time":"2026-10-17T23:09:50.138213184Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Output":"--- PASS: TestDisabledRecordStatesAbsence (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.138236269Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestDisabledRecordStatesAbsence","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.138330147Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary"}
+{"Time":"2026-10-17T23:09:50.13834233Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Output":"=== RUN TestOpenRouterNativeCallerBoundary\n"}
+{"Time":"2026-10-17T23:09:50.13853323Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller"}
+{"Time":"2026-10-17T23:09:50.138550056Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Output":"=== RUN TestOpenRouterNativeCallerBoundary/native_lifecycle_caller\n"}
+{"Time":"2026-10-17T23:09:50.138804261Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/native_lifecycle_caller (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.138819996Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_lifecycle_caller","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.138826976Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system"}
+{"Time":"2026-10-17T23:09:50.13883134Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_own_system\n"}
+{"Time":"2026-10-17T23:09:50.13913322Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_own_system (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.13915982Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_own_system","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.139283366Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner"}
+{"Time":"2026-10-17T23:09:50.139294403Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner\n"}
+{"Time":"2026-10-17T23:09:50.139654462Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.139674146Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_represent_custody_owner","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.139792119Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine"}
+{"Time":"2026-10-17T23:09:50.139808359Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Output":"=== RUN TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine\n"}
+{"Time":"2026-10-17T23:09:50.140133847Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.140176751Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/warden_cannot_impersonate_native_engine","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.140199619Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller"}
+{"Time":"2026-10-17T23:09:50.14020869Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Output":"=== RUN TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller\n"}
+{"Time":"2026-10-17T23:09:50.140563391Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.140584284Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/radar_is_recipient_not_lifecycle_caller","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.140703907Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner"}
+{"Time":"2026-10-17T23:09:50.140715224Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner\n"}
+{"Time":"2026-10-17T23:09:50.141010403Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.141026697Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/native_caller_cannot_represent_custody_owner","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.141143426Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner"}
+{"Time":"2026-10-17T23:09:50.141154517Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Output":"=== RUN TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner\n"}
+{"Time":"2026-10-17T23:09:50.141479877Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Output":"--- PASS: TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.141495062Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary/batch_must_bind_every_owner","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.141634189Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Output":"--- PASS: TestOpenRouterNativeCallerBoundary (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.141758889Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestOpenRouterNativeCallerBoundary","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.141842722Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding"}
+{"Time":"2026-10-17T23:09:50.141854291Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding\n"}
+{"Time":"2026-10-17T23:09:50.142028676Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden"}
+{"Time":"2026-10-17T23:09:50.142041526Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/ops-warden\n"}
+{"Time":"2026-10-17T23:09:50.144479342Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/ops-warden (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.144563149Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.144575015Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch"}
+{"Time":"2026-10-17T23:09:50.144582428Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch\n"}
+{"Time":"2026-10-17T23:09:50.147420747Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.14746008Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/ops-warden-fetch","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.147470171Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine"}
+{"Time":"2026-10-17T23:09:50.147475518Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/secrets-engine\n"}
+{"Time":"2026-10-17T23:09:50.149643328Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/secrets-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.149693094Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/secrets-engine","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.149738045Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine"}
+{"Time":"2026-10-17T23:09:50.149744817Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/user-engine\n"}
+{"Time":"2026-10-17T23:09:50.151757449Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/user-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.151808423Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/user-engine","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.151913556Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine"}
+{"Time":"2026-10-17T23:09:50.151925251Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/tenant-engine\n"}
+{"Time":"2026-10-17T23:09:50.154006125Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/tenant-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.154050833Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/tenant-engine","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.154075152Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle"}
+{"Time":"2026-10-17T23:09:50.154080446Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle\n"}
+{"Time":"2026-10-17T23:09:50.15653981Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.156588837Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-lifecycle","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.156596826Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting"}
+{"Time":"2026-10-17T23:09:50.156601777Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting\n"}
+{"Time":"2026-10-17T23:09:50.159049184Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.159095849Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-sitting","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.159110249Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03"}
+{"Time":"2026-10-17T23:09:50.159117075Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03\n"}
+{"Time":"2026-10-17T23:09:50.161641093Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03 (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.161697532Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/informed-decision-t03","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.16170599Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback"}
+{"Time":"2026-10-17T23:09:50.161710923Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Output":"=== RUN TestRuntimeRenameEveryInstalledPinBinding/application-readback\n"}
+{"Time":"2026-10-17T23:09:50.164418333Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding/application-readback (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.164483871Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding/application-readback","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.164514764Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Output":"--- PASS: TestRuntimeRenameEveryInstalledPinBinding (0.02s)\n"}
+{"Time":"2026-10-17T23:09:50.164667601Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameEveryInstalledPinBinding","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:50.164688683Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience"}
+{"Time":"2026-10-17T23:09:50.164693697Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience\n"}
+{"Time":"2026-10-17T23:09:50.164888271Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth"}
+{"Time":"2026-10-17T23:09:50.164901382Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth\n"}
+{"Time":"2026-10-17T23:09:50.176507781Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth (0.01s)\n"}
+{"Time":"2026-10-17T23:09:50.176554626Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/flex-auth","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:50.176564139Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine"}
+{"Time":"2026-10-17T23:09:50.176569486Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine\n"}
+{"Time":"2026-10-17T23:09:50.180232834Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.180280093Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/access-engine","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.180288723Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign"}
+{"Time":"2026-10-17T23:09:50.180294016Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign\n"}
+{"Time":"2026-10-17T23:09:50.184134723Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.184180882Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/foreign","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.18433248Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp"}
+{"Time":"2026-10-17T23:09:50.184363274Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp\n"}
+{"Time":"2026-10-17T23:09:50.188612737Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.188751548Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/custom-pdp","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.188943435Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/"}
+{"Time":"2026-10-17T23:09:50.188956871Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/\n"}
+{"Time":"2026-10-17T23:09:50.193325058Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/ (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.193372029Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/flex-auth/","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.193383454Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth"}
+{"Time":"2026-10-17T23:09:50.193388675Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth\n"}
+{"Time":"2026-10-17T23:09:50.196670951Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.196720032Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/flex-auth","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.196730916Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine"}
+{"Time":"2026-10-17T23:09:50.196737156Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine\n"}
+{"Time":"2026-10-17T23:09:50.200628931Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.20067454Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/access-engine","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.200692403Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign"}
+{"Time":"2026-10-17T23:09:50.200711033Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign\n"}
+{"Time":"2026-10-17T23:09:50.204233774Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.20428437Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/foreign","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.204313694Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp"}
+{"Time":"2026-10-17T23:09:50.204319402Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp\n"}
+{"Time":"2026-10-17T23:09:50.20775843Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.207825238Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/custom-pdp","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.207838584Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/"}
+{"Time":"2026-10-17T23:09:50.20785266Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/\n"}
+{"Time":"2026-10-17T23:09:50.210973079Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/ (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.211024198Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/access-engine/","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.211226019Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth"}
+{"Time":"2026-10-17T23:09:50.211250293Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth\n"}
+{"Time":"2026-10-17T23:09:50.215470041Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.215549772Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/flex-auth","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.215609267Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine"}
+{"Time":"2026-10-17T23:09:50.215618339Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine\n"}
+{"Time":"2026-10-17T23:09:50.219869549Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.219923508Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/access-engine","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.220256656Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign"}
+{"Time":"2026-10-17T23:09:50.220284267Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign\n"}
+{"Time":"2026-10-17T23:09:50.224075409Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.224142885Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/foreign","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.224291222Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp"}
+{"Time":"2026-10-17T23:09:50.224304973Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp\n"}
+{"Time":"2026-10-17T23:09:50.228202352Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.228251198Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/custom-pdp","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.228262569Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/"}
+{"Time":"2026-10-17T23:09:50.228268836Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Output":"=== RUN TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/\n"}
+{"Time":"2026-10-17T23:09:50.231751992Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/ (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.231804887Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience/custom-pdp/","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.231818737Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Output":"--- PASS: TestRuntimeRenameUsesActualTokenReviewAudience (0.07s)\n"}
+{"Time":"2026-10-17T23:09:50.231828665Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameUsesActualTokenReviewAudience","Elapsed":0.07}
+{"Time":"2026-10-17T23:09:50.231872219Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact"}
+{"Time":"2026-10-17T23:09:50.231880064Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Output":"=== RUN TestRuntimeRenameCustomAudienceAndInputBindingsStayExact\n"}
+{"Time":"2026-10-17T23:09:50.232228968Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Output":"--- PASS: TestRuntimeRenameCustomAudienceAndInputBindingsStayExact (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.232258085Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestRuntimeRenameCustomAudienceAndInputBindingsStayExact","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.23226978Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated"}
+{"Time":"2026-10-17T23:09:50.232274785Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Output":"=== RUN TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated\n"}
+{"Time":"2026-10-17T23:09:50.23591103Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Output":"--- PASS: TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.236064287Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.236078191Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry"}
+{"Time":"2026-10-17T23:09:50.236084594Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Output":"=== RUN TestKubernetesTokenReviewerCapturesTokenExpiry\n"}
+{"Time":"2026-10-17T23:09:50.239508542Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Output":"--- PASS: TestKubernetesTokenReviewerCapturesTokenExpiry (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.23955701Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestKubernetesTokenReviewerCapturesTokenExpiry","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.239564981Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim"}
+{"Time":"2026-10-17T23:09:50.239569914Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Output":"=== RUN TestTokenExpiryReadsJWTClaim\n"}
+{"Time":"2026-10-17T23:09:50.239946492Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Output":"--- PASS: TestTokenExpiryReadsJWTClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.240035465Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Test":"TestTokenExpiryReadsJWTClaim","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.240219708Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:50.446845536Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Output":"--- PASS: TestServeOpsWardenCheckContract (0.61s)\n"}
+{"Time":"2026-10-17T23:09:50.446903111Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeOpsWardenCheckContract","Elapsed":0.61}
+{"Time":"2026-10-17T23:09:50.446915546Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal"}
+{"Time":"2026-10-17T23:09:50.446920199Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Output":"=== RUN TestServeCallerAuthenticationBindsSystemToPrincipal\n"}
+{"Time":"2026-10-17T23:09:50.83872014Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/audit","Output":"ok \tgithub.com/netkingdom/access-engine/internal/audit\t1.028s\n"}
+{"Time":"2026-10-17T23:09:50.838784388Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/audit","Elapsed":1.028}
+{"Time":"2026-10-17T23:09:50.840662546Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/decision"}
+{"Time":"2026-10-17T23:09:50.859485124Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Output":"ok \tgithub.com/netkingdom/access-engine/internal/adapters/topaz\t1.133s\n"}
+{"Time":"2026-10-17T23:09:50.859550463Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/adapters/topaz","Elapsed":1.133}
+{"Time":"2026-10-17T23:09:50.869774918Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/emission"}
+{"Time":"2026-10-17T23:09:50.891565041Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild"}
+{"Time":"2026-10-17T23:09:50.891637702Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Output":"=== RUN TestOutboxLockChild\n"}
+{"Time":"2026-10-17T23:09:50.891879888Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Output":"--- PASS: TestOutboxLockChild (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.891922665Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxLockChild","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.892095202Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease"}
+{"Time":"2026-10-17T23:09:50.892131487Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Output":"=== RUN TestActualProcessWriterExclusionAndCrashRelease\n"}
+{"Time":"2026-10-17T23:09:50.894600966Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect"}
+{"Time":"2026-10-17T23:09:50.894643753Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Output":"=== RUN TestRequiredCommitForEveryEffect\n"}
+{"Time":"2026-10-17T23:09:50.894726495Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow"}
+{"Time":"2026-10-17T23:09:50.894738028Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Output":"=== RUN TestRequiredCommitForEveryEffect/allow\n"}
+{"Time":"2026-10-17T23:09:50.895279216Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Output":"--- PASS: TestRequiredCommitForEveryEffect/allow (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.895322138Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/allow","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.895544867Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny"}
+{"Time":"2026-10-17T23:09:50.895598547Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Output":"=== RUN TestRequiredCommitForEveryEffect/deny\n"}
+{"Time":"2026-10-17T23:09:50.895868358Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Output":"--- PASS: TestRequiredCommitForEveryEffect/deny (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.895902615Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/deny","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.89592092Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact"}
+{"Time":"2026-10-17T23:09:50.89592596Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Output":"=== RUN TestRequiredCommitForEveryEffect/redact\n"}
+{"Time":"2026-10-17T23:09:50.896314541Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Output":"--- PASS: TestRequiredCommitForEveryEffect/redact (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.896355434Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/redact","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.896369077Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only"}
+{"Time":"2026-10-17T23:09:50.896373315Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Output":"=== RUN TestRequiredCommitForEveryEffect/audit_only\n"}
+{"Time":"2026-10-17T23:09:50.896683743Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Output":"--- PASS: TestRequiredCommitForEveryEffect/audit_only (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.896703536Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/audit_only","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.896727026Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable"}
+{"Time":"2026-10-17T23:09:50.896737973Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Output":"=== RUN TestRequiredCommitForEveryEffect/not_applicable\n"}
+{"Time":"2026-10-17T23:09:50.897026308Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Output":"--- PASS: TestRequiredCommitForEveryEffect/not_applicable (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.897046489Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect/not_applicable","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.897249106Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Output":"--- PASS: TestRequiredCommitForEveryEffect (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.897268953Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRequiredCommitForEveryEffect","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.897360235Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime"}
+{"Time":"2026-10-17T23:09:50.897370172Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Output":"=== RUN TestTrustedTaskWholeOperationLifetime\n"}
+{"Time":"2026-10-17T23:09:50.897609418Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict"}
+{"Time":"2026-10-17T23:09:50.897623512Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/old-15s-conflict\n"}
+{"Time":"2026-10-17T23:09:50.897845309Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/old-15s-conflict (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.897869637Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/old-15s-conflict","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.897962975Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve"}
+{"Time":"2026-10-17T23:09:50.897973246Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve\n"}
+{"Time":"2026-10-17T23:09:50.898176711Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.89827315Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/insufficient-cleanup-reserve","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.898655436Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup"}
+{"Time":"2026-10-17T23:09:50.898670008Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup\n"}
+{"Time":"2026-10-17T23:09:50.898902536Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.898923312Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/elapsed-consume-setup","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.899110988Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation"}
+{"Time":"2026-10-17T23:09:50.89913042Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/expired-operation\n"}
+{"Time":"2026-10-17T23:09:50.899347032Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/expired-operation (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.899370396Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/expired-operation","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.899466213Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum"}
+{"Time":"2026-10-17T23:09:50.899493563Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/source-hard-maximum\n"}
+{"Time":"2026-10-17T23:09:50.899687695Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/source-hard-maximum (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.899786723Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/source-hard-maximum","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.899925714Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass"}
+{"Time":"2026-10-17T23:09:50.899942856Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass\n"}
+{"Time":"2026-10-17T23:09:50.900236861Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.900273688Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/attempted-policy-cap-bypass","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.900281506Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact"}
+{"Time":"2026-10-17T23:09:50.900285762Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact\n"}
+{"Time":"2026-10-17T23:09:50.90058419Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.900618618Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/shorter-original-or-fresh-fact","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.900639754Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit"}
+{"Time":"2026-10-17T23:09:50.900644236Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit\n"}
+{"Time":"2026-10-17T23:09:50.900879875Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.900897594Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/structural-120-cannot-fit","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.900985088Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl"}
+{"Time":"2026-10-17T23:09:50.900995223Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Output":"=== RUN TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl\n"}
+{"Time":"2026-10-17T23:09:50.901210104Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.901226849Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime/noninteger-structural-ttl","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.90138769Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Output":"--- PASS: TestTrustedTaskWholeOperationLifetime (0.00s)\n"}
+{"Time":"2026-10-17T23:09:50.901417934Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestTrustedTaskWholeOperationLifetime","Elapsed":0}
+{"Time":"2026-10-17T23:09:50.901508846Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash"}
+{"Time":"2026-10-17T23:09:50.90151881Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Output":"=== RUN TestAttributeContextCarriedWithoutViewHash\n"}
+{"Time":"2026-10-17T23:09:51.018820708Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Output":"--- PASS: TestServeCallerAuthenticationBindsSystemToPrincipal (0.57s)\n"}
+{"Time":"2026-10-17T23:09:51.018873323Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServeCallerAuthenticationBindsSystemToPrincipal","Elapsed":0.57}
+{"Time":"2026-10-17T23:09:51.018894144Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction"}
+{"Time":"2026-10-17T23:09:51.018900312Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Output":"=== RUN TestRunLoadRegistryOpsWardenProduction\n"}
+{"Time":"2026-10-17T23:09:51.023040678Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Output":"--- PASS: TestRunLoadRegistryOpsWardenProduction (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.023101013Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunLoadRegistryOpsWardenProduction","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.023113132Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors"}
+{"Time":"2026-10-17T23:09:51.023119543Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Output":"=== RUN TestOpsWardenProductionRegistryActors\n"}
+{"Time":"2026-10-17T23:09:51.247360136Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/callerauth","Output":"ok \tgithub.com/netkingdom/access-engine/internal/callerauth\t1.132s\n"}
+{"Time":"2026-10-17T23:09:51.247414907Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/callerauth","Elapsed":1.1320000000000001}
+{"Time":"2026-10-17T23:09:51.250916043Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/layer"}
+{"Time":"2026-10-17T23:09:51.274232244Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms"}
+{"Time":"2026-10-17T23:09:51.274286753Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Output":"=== RUN TestLayerDeclarationConforms\n"}
+{"Time":"2026-10-17T23:09:51.298711156Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Output":"--- PASS: TestLayerDeclarationConforms (0.02s)\n"}
+{"Time":"2026-10-17T23:09:51.298799858Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestLayerDeclarationConforms","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:51.298824133Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass"}
+{"Time":"2026-10-17T23:09:51.298832979Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Output":"=== RUN TestEmissionInventoryIsPerEventClass\n"}
+{"Time":"2026-10-17T23:09:51.307243774Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Output":"--- PASS: TestEmissionInventoryIsPerEventClass (0.01s)\n"}
+{"Time":"2026-10-17T23:09:51.307301673Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEmissionInventoryIsPerEventClass","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:51.307327553Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected"}
+{"Time":"2026-10-17T23:09:51.307338202Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Output":"=== RUN TestVersionPinInDeclarationIsRejected\n"}
+{"Time":"2026-10-17T23:09:51.30765346Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Output":"--- PASS: TestVersionPinInDeclarationIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.307700277Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinInDeclarationIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.307716382Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected"}
+{"Time":"2026-10-17T23:09:51.307723894Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Output":"=== RUN TestEngineWithoutRoleIsRejected\n"}
+{"Time":"2026-10-17T23:09:51.30802314Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Output":"--- PASS: TestEngineWithoutRoleIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.308062464Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEngineWithoutRoleIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.308082374Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected"}
+{"Time":"2026-10-17T23:09:51.308101004Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Output":"=== RUN TestUnknownLayerIsRejected\n"}
+{"Time":"2026-10-17T23:09:51.308378564Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Output":"--- PASS: TestUnknownLayerIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.3083986Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestUnknownLayerIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.308413055Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy"}
+{"Time":"2026-10-17T23:09:51.30843255Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Output":"=== RUN TestVocabularyHasFourTokensIncludingTaxonomy\n"}
+{"Time":"2026-10-17T23:09:51.308674113Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Output":"--- PASS: TestVocabularyHasFourTokensIncludingTaxonomy (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.308719705Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyHasFourTokensIncludingTaxonomy","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.308740967Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase"}
+{"Time":"2026-10-17T23:09:51.308747252Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Output":"=== RUN TestVocabularyComparisonFoldsCase\n"}
+{"Time":"2026-10-17T23:09:51.308946998Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Output":"--- PASS: TestVocabularyComparisonFoldsCase (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.308973761Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVocabularyComparisonFoldsCase","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.308996106Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken"}
+{"Time":"2026-10-17T23:09:51.309010218Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Output":"=== RUN TestPluralEnginesIsNotTheToken\n"}
+{"Time":"2026-10-17T23:09:51.309210658Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Output":"--- PASS: TestPluralEnginesIsNotTheToken (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.309247728Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPluralEnginesIsNotTheToken","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.309266736Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected"}
+{"Time":"2026-10-17T23:09:51.309273535Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Output":"=== RUN TestEvidenceSourceWithoutEmissionGuaranteeIsRejected\n"}
+{"Time":"2026-10-17T23:09:51.309611024Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Output":"--- PASS: TestEvidenceSourceWithoutEmissionGuaranteeIsRejected (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.309639284Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestEvidenceSourceWithoutEmissionGuaranteeIsRejected","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.309667039Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound"}
+{"Time":"2026-10-17T23:09:51.309678175Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Output":"=== RUN TestVersionAnywhereInDeclarationIsFound\n"}
+{"Time":"2026-10-17T23:09:51.314037495Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Output":"--- PASS: TestVersionAnywhereInDeclarationIsFound (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.314114781Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionAnywhereInDeclarationIsFound","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.314133745Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach"}
+{"Time":"2026-10-17T23:09:51.314144863Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Output":"=== RUN TestVersionPinsLeavesWhatA12DoesNotReach\n"}
+{"Time":"2026-10-17T23:09:51.320249453Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Output":"--- PASS: TestVersionPinsLeavesWhatA12DoesNotReach (0.01s)\n"}
+{"Time":"2026-10-17T23:09:51.320335126Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestVersionPinsLeavesWhatA12DoesNotReach","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:51.320352701Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps"}
+{"Time":"2026-10-17T23:09:51.320369121Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Output":"=== RUN TestCheckRejectsVersionedStandardPathButNotStanceMaps\n"}
+{"Time":"2026-10-17T23:09:51.325717465Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Output":"--- PASS: TestCheckRejectsVersionedStandardPathButNotStanceMaps (0.01s)\n"}
+{"Time":"2026-10-17T23:09:51.325777953Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestCheckRejectsVersionedStandardPathButNotStanceMaps","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:51.32579431Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere"}
+{"Time":"2026-10-17T23:09:51.325801632Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Output":"=== RUN TestOwnDeclarationCarriesNoVersionAnywhere\n"}
+{"Time":"2026-10-17T23:09:51.328891979Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Output":"--- PASS: TestOwnDeclarationCarriesNoVersionAnywhere (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.32894262Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestOwnDeclarationCarriesNoVersionAnywhere","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.328953224Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance"}
+{"Time":"2026-10-17T23:09:51.328958166Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance\n"}
+{"Time":"2026-10-17T23:09:51.329135454Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees"}
+{"Time":"2026-10-17T23:09:51.329150134Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees\n"}
+{"Time":"2026-10-17T23:09:51.331433761Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.33148589Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/case_folding_agrees","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.331501363Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding"}
+{"Time":"2026-10-17T23:09:51.331508857Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding\n"}
+{"Time":"2026-10-17T23:09:51.33351184Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.333589199Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/different_layer_remains_finding","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.333625476Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance"}
+{"Time":"2026-10-17T23:09:51.333637081Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance\n"}
+{"Time":"2026-10-17T23:09:51.336048607Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.336158734Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/missing_derived_provenance","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.336202964Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source"}
+{"Time":"2026-10-17T23:09:51.336249619Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source\n"}
+{"Time":"2026-10-17T23:09:51.338538864Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.338607927Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/wrong_governing_source","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.338633121Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused"}
+{"Time":"2026-10-17T23:09:51.338647468Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Output":"=== RUN TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused\n"}
+{"Time":"2026-10-17T23:09:51.341279686Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.341361409Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance/derived_declaration_pin_refused","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.341403953Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Output":"--- PASS: TestDerivedDeclarationAgreementAndProvenance (0.01s)\n"}
+{"Time":"2026-10-17T23:09:51.341418308Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestDerivedDeclarationAgreementAndProvenance","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:51.34143783Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut"}
+{"Time":"2026-10-17T23:09:51.341484377Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Output":"=== RUN TestValidatedAgainstAcceptedCut\n"}
+{"Time":"2026-10-17T23:09:51.341511168Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Output":"--- PASS: TestValidatedAgainstAcceptedCut (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.341644136Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestValidatedAgainstAcceptedCut","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.341672351Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo"}
+{"Time":"2026-10-17T23:09:51.341691585Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Output":"=== RUN TestSurveyDetectsFormsDisagreeingWithinOneRepo\n"}
+{"Time":"2026-10-17T23:09:51.343398361Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Output":"--- PASS: TestSurveyDetectsFormsDisagreeingWithinOneRepo (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.343465738Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyDetectsFormsDisagreeingWithinOneRepo","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.343484818Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017"}
+{"Time":"2026-10-17T23:09:51.343497677Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Output":"=== RUN TestSurveyFoldsCaseAfterGHDEC017\n"}
+{"Time":"2026-10-17T23:09:51.345203361Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Output":"--- PASS: TestSurveyFoldsCaseAfterGHDEC017 (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.345260486Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFoldsCaseAfterGHDEC017","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.345279088Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement"}
+{"Time":"2026-10-17T23:09:51.345285058Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Output":"=== RUN TestSpellingDisagreementIsReportedButIsNotALayerDisagreement\n"}
+{"Time":"2026-10-17T23:09:51.347485141Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Output":"--- PASS: TestSpellingDisagreementIsReportedButIsNotALayerDisagreement (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.347550534Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSpellingDisagreementIsReportedButIsNotALayerDisagreement","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.347561201Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope"}
+{"Time":"2026-10-17T23:09:51.347566603Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Output":"=== RUN TestTaxonomyVolunteerIsInVocabularyAndOutOfScope\n"}
+{"Time":"2026-10-17T23:09:51.349960195Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Output":"--- PASS: TestTaxonomyVolunteerIsInVocabularyAndOutOfScope (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.350037806Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestTaxonomyVolunteerIsInVocabularyAndOutOfScope","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.350075994Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope"}
+{"Time":"2026-10-17T23:09:51.350086932Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Output":"=== RUN TestRunStatesItsScope\n"}
+{"Time":"2026-10-17T23:09:51.350406058Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Output":"--- PASS: TestRunStatesItsScope (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.35044018Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestRunStatesItsScope","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.35045541Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration"}
+{"Time":"2026-10-17T23:09:51.350463715Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Output":"=== RUN TestSurveyReportsMissingDeclaration\n"}
+{"Time":"2026-10-17T23:09:51.35120172Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Output":"--- PASS: TestSurveyReportsMissingDeclaration (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.351268006Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyReportsMissingDeclaration","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.351279214Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement"}
+{"Time":"2026-10-17T23:09:51.351286229Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Output":"=== RUN TestSurveySingleFormIsNotDisagreement\n"}
+{"Time":"2026-10-17T23:09:51.353014346Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Output":"--- PASS: TestSurveySingleFormIsNotDisagreement (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.353094672Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveySingleFormIsNotDisagreement","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.353116782Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed"}
+{"Time":"2026-10-17T23:09:51.353132689Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Output":"=== RUN TestPeerWithForeignFieldShapesIsStillSurveyed\n"}
+{"Time":"2026-10-17T23:09:51.355523897Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Output":"--- PASS: TestPeerWithForeignFieldShapesIsStillSurveyed (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.355583862Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestPeerWithForeignFieldShapesIsStillSurveyed","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.355604034Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration"}
+{"Time":"2026-10-17T23:09:51.355613078Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Output":"=== RUN TestSurveyFindsVersionInPeerDeclaration\n"}
+{"Time":"2026-10-17T23:09:51.359888187Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Output":"--- PASS: TestSurveyFindsVersionInPeerDeclaration (0.00s)\n"}
+{"Time":"2026-10-17T23:09:51.360014339Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Test":"TestSurveyFindsVersionInPeerDeclaration","Elapsed":0}
+{"Time":"2026-10-17T23:09:51.360049894Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:51.694359886Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:09:51.694416001Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:09:51.741012903Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown (0.05s)\n"}
+{"Time":"2026-10-17T23:09:51.741102066Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_agent_advisory_while_zone_is_unknown","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:51.741283403Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:09:51.741301013Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:09:51.804433397Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown (0.06s)\n"}
+{"Time":"2026-10-17T23:09:51.804498348Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/state_hub_bridge_IAM_subject_advisory_while_zone_is_unknown","Elapsed":0.06}
+{"Time":"2026-10-17T23:09:51.80452017Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:09:51.804530927Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:09:51.862337375Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown (0.06s)\n"}
+{"Time":"2026-10-17T23:09:51.86239899Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/codex_interhub_bootstrap_advisory_while_zone_is_unknown","Elapsed":0.06}
+{"Time":"2026-10-17T23:09:51.862417007Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow"}
+{"Time":"2026-10-17T23:09:51.862424058Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Output":"=== RUN TestOpsWardenProductionRegistryActors/admin_actor_allow\n"}
+{"Time":"2026-10-17T23:09:51.908113686Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Output":"--- PASS: TestOpsWardenProductionRegistryActors/admin_actor_allow (0.05s)\n"}
+{"Time":"2026-10-17T23:09:51.908184183Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/admin_actor_allow","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:51.908204355Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:09:51.908212804Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:09:51.956399653Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown (0.05s)\n"}
+{"Time":"2026-10-17T23:09:51.95646529Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/automation_actor_advisory_while_zone_is_unknown","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:51.956489176Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown"}
+{"Time":"2026-10-17T23:09:51.956501791Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown\n"}
+{"Time":"2026-10-17T23:09:51.983756233Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Output":"--- PASS: TestActualProcessWriterExclusionAndCrashRelease (1.09s)\n"}
+{"Time":"2026-10-17T23:09:51.983815629Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualProcessWriterExclusionAndCrashRelease","Elapsed":1.09}
+{"Time":"2026-10-17T23:09:51.984019626Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries"}
+{"Time":"2026-10-17T23:09:51.984044027Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Output":"=== RUN TestExactCapacityBatchEntryAndRestartBoundaries\n"}
+{"Time":"2026-10-17T23:09:52.000900459Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown (0.04s)\n"}
+{"Time":"2026-10-17T23:09:52.000975789Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/ttl_above_production_max_is_advisory_while_zone_is_unknown","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:52.00100248Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown"}
+{"Time":"2026-10-17T23:09:52.00102386Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Output":"=== RUN TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown\n"}
+{"Time":"2026-10-17T23:09:52.056369632Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Output":"--- PASS: TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown (0.06s)\n"}
+{"Time":"2026-10-17T23:09:52.056467974Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors/unregistered_production_actor_is_advisory_unknown","Elapsed":0.06}
+{"Time":"2026-10-17T23:09:52.056499814Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Output":"--- PASS: TestOpsWardenProductionRegistryActors (1.03s)\n"}
+{"Time":"2026-10-17T23:09:52.056517831Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenProductionRegistryActors","Elapsed":1.03}
+{"Time":"2026-10-17T23:09:52.056535333Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor"}
+{"Time":"2026-10-17T23:09:52.056548255Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Output":"=== RUN TestRunValidateAccessDescriptor\n"}
+{"Time":"2026-10-17T23:09:52.058863589Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Output":"--- PASS: TestRunValidateAccessDescriptor (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.058958956Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRunValidateAccessDescriptor","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.058989714Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions"}
+{"Time":"2026-10-17T23:09:52.059009317Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Output":"=== RUN TestOpsWardenFetchDecisions\n"}
+{"Time":"2026-10-17T23:09:52.290496405Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Output":"--- PASS: TestExactCapacityBatchEntryAndRestartBoundaries (0.31s)\n"}
+{"Time":"2026-10-17T23:09:52.290554827Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestExactCapacityBatchEntryAndRestartBoundaries","Elapsed":0.31}
+{"Time":"2026-10-17T23:09:52.290570454Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence"}
+{"Time":"2026-10-17T23:09:52.29057793Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence\n"}
+{"Time":"2026-10-17T23:09:52.338415985Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file"}
+{"Time":"2026-10-17T23:09:52.338470476Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/file\n"}
+{"Time":"2026-10-17T23:09:52.339527803Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/file (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.339919332Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/file","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.340021335Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line"}
+{"Time":"2026-10-17T23:09:52.34005166Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/line\n"}
+{"Time":"2026-10-17T23:09:52.369838113Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/layer","Output":"ok \tgithub.com/netkingdom/access-engine/internal/layer\t1.119s\n"}
+{"Time":"2026-10-17T23:09:52.369917428Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/layer","Elapsed":1.119}
+{"Time":"2026-10-17T23:09:52.37343457Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/markitect"}
+{"Time":"2026-10-17T23:09:52.45872292Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport"}
+{"Time":"2026-10-17T23:09:52.458793164Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Output":"=== RUN TestActionVocabularySeparatesReadFromExport\n"}
+{"Time":"2026-10-17T23:09:52.459190681Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Output":"--- PASS: TestActionVocabularySeparatesReadFromExport (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.459429169Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionVocabularySeparatesReadFromExport","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.459464679Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary"}
+{"Time":"2026-10-17T23:09:52.459480937Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Output":"=== RUN TestActionDefinitionsMirrorVocabulary\n"}
+{"Time":"2026-10-17T23:09:52.460169979Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Output":"--- PASS: TestActionDefinitionsMirrorVocabulary (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.460241999Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestActionDefinitionsMirrorVocabulary","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.460257987Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates"}
+{"Time":"2026-10-17T23:09:52.460266652Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Output":"=== RUN TestMarkitectCheckFixturePackageValidates\n"}
+{"Time":"2026-10-17T23:09:52.467728399Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/line (0.13s)\n"}
+{"Time":"2026-10-17T23:09:52.467798328Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/line","Elapsed":0.13}
+{"Time":"2026-10-17T23:09:52.468051718Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn"}
+{"Time":"2026-10-17T23:09:52.468082944Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn\n"}
+{"Time":"2026-10-17T23:09:52.567652197Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn (0.10s)\n"}
+{"Time":"2026-10-17T23:09:52.567722432Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/oversized-torn","Elapsed":0.1}
+{"Time":"2026-10-17T23:09:52.567738699Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt"}
+{"Time":"2026-10-17T23:09:52.567747653Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Output":"=== RUN TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt\n"}
+{"Time":"2026-10-17T23:09:52.571492727Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.571548562Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence/terminated-corrupt","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.571596407Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Output":"--- PASS: TestBoundedStartupPreservesOversizedCommittedEvidence (0.28s)\n"}
+{"Time":"2026-10-17T23:09:52.571615867Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestBoundedStartupPreservesOversizedCommittedEvidence","Elapsed":0.28}
+{"Time":"2026-10-17T23:09:52.571626994Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback"}
+{"Time":"2026-10-17T23:09:52.571634929Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback\n"}
+{"Time":"2026-10-17T23:09:52.571642675Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full"}
+{"Time":"2026-10-17T23:09:52.57164877Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full\n"}
+{"Time":"2026-10-17T23:09:52.57671541Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.576828811Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/full","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.576862743Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null"}
+{"Time":"2026-10-17T23:09:52.576871417Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Output":"=== RUN TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null\n"}
+{"Time":"2026-10-17T23:09:52.580785513Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.580865081Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback//dev/null","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.580897426Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Output":"--- PASS: TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.581002765Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestActualDiskFullAndFsyncFailureFenceUnconfirmedRollback","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.581536419Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases"}
+{"Time":"2026-10-17T23:09:52.581583408Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases\n"}
+{"Time":"2026-10-17T23:09:52.582352732Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink"}
+{"Time":"2026-10-17T23:09:52.582391966Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink\n"}
+{"Time":"2026-10-17T23:09:52.583616121Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.583696059Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/symlink","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.583870245Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable"}
+{"Time":"2026-10-17T23:09:52.583912455Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable\n"}
+{"Time":"2026-10-17T23:09:52.584859599Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.584917328Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/world-readable","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.58510363Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink"}
+{"Time":"2026-10-17T23:09:52.585129329Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Output":"=== RUN TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink\n"}
+{"Time":"2026-10-17T23:09:52.586438988Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.586517898Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases/hardlink","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.589003043Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Output":"--- PASS: TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.589472453Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestWriterLockRefusesUnsafeFilesAndStartupFailureReleases","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.589514059Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion"}
+{"Time":"2026-10-17T23:09:52.589524176Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Output":"=== RUN TestPVCFSGroupPermissionWideningRetainsWriterExclusion\n"}
+{"Time":"2026-10-17T23:09:52.591398799Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Output":"--- PASS: TestPVCFSGroupPermissionWideningRetainsWriterExclusion (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.591464859Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestPVCFSGroupPermissionWideningRetainsWriterExclusion","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.591480234Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs"}
+{"Time":"2026-10-17T23:09:52.591487565Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs\n"}
+{"Time":"2026-10-17T23:09:52.591807181Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink"}
+{"Time":"2026-10-17T23:09:52.591835027Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink\n"}
+{"Time":"2026-10-17T23:09:52.593453524Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.593516112Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/symlink","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.593680948Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink"}
+{"Time":"2026-10-17T23:09:52.593695574Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink\n"}
+{"Time":"2026-10-17T23:09:52.595420456Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.595479835Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/hardlink","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.595521413Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo"}
+{"Time":"2026-10-17T23:09:52.595528672Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo\n"}
+{"Time":"2026-10-17T23:09:52.597071839Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.597251264Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/outbox.jsonl/fifo","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.597483926Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink"}
+{"Time":"2026-10-17T23:09:52.597513151Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink\n"}
+{"Time":"2026-10-17T23:09:52.598959328Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.599027715Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/symlink","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.599053973Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink"}
+{"Time":"2026-10-17T23:09:52.599063649Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink\n"}
+{"Time":"2026-10-17T23:09:52.600065771Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.600119333Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/hardlink","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.600284547Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo"}
+{"Time":"2026-10-17T23:09:52.600302293Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Output":"=== RUN TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo\n"}
+{"Time":"2026-10-17T23:09:52.601488224Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.60153698Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs/drain.json/fifo","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.601552868Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Output":"--- PASS: TestJournalAndCursorRefuseAliasesAndFIFOs (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.601727686Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestJournalAndCursorRefuseAliasesAndFIFOs","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.601748993Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature"}
+{"Time":"2026-10-17T23:09:52.601756333Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Output":"=== RUN TestOutboxReplayPreservesProducerNumericSignature\n"}
+{"Time":"2026-10-17T23:09:52.614327796Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Output":"--- PASS: TestOutboxReplayPreservesProducerNumericSignature (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.614405515Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReplayPreservesProducerNumericSignature","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.614427788Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart"}
+{"Time":"2026-10-17T23:09:52.614434767Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Output":"=== RUN TestHeartbeatScheduleSurvivesRestart\n"}
+{"Time":"2026-10-17T23:09:52.658356408Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Output":"--- PASS: TestHeartbeatScheduleSurvivesRestart (0.04s)\n"}
+{"Time":"2026-10-17T23:09:52.658422207Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestHeartbeatScheduleSurvivesRestart","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:52.658464056Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs"}
+{"Time":"2026-10-17T23:09:52.65847383Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs\n"}
+{"Time":"2026-10-17T23:09:52.658785503Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request"}
+{"Time":"2026-10-17T23:09:52.658804249Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request\n"}
+{"Time":"2026-10-17T23:09:52.684789272Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request (0.03s)\n"}
+{"Time":"2026-10-17T23:09:52.684857794Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Bad_Request","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:52.684878506Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized"}
+{"Time":"2026-10-17T23:09:52.684892384Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized\n"}
+{"Time":"2026-10-17T23:09:52.688791326Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Output":"--- PASS: TestMarkitectCheckFixturePackageValidates (0.23s)\n"}
+{"Time":"2026-10-17T23:09:52.688903248Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestMarkitectCheckFixturePackageValidates","Elapsed":0.23}
+{"Time":"2026-10-17T23:09:52.689002537Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract"}
+{"Time":"2026-10-17T23:09:52.689021698Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Output":"=== RUN TestGatewayDecisionAllowContract\n"}
+{"Time":"2026-10-17T23:09:52.689361133Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Output":"--- PASS: TestGatewayDecisionAllowContract (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.68939998Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAllowContract","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.689413677Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract"}
+{"Time":"2026-10-17T23:09:52.689420701Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Output":"=== RUN TestGatewayDecisionDenyContract\n"}
+{"Time":"2026-10-17T23:09:52.68982601Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Output":"--- PASS: TestGatewayDecisionDenyContract (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.689862872Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionDenyContract","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.689902233Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract"}
+{"Time":"2026-10-17T23:09:52.689911602Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Output":"=== RUN TestGatewayDecisionRedactContract\n"}
+{"Time":"2026-10-17T23:09:52.692070207Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Output":"--- PASS: TestGatewayDecisionRedactContract (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.692128296Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionRedactContract","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.692139685Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract"}
+{"Time":"2026-10-17T23:09:52.692147232Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Output":"=== RUN TestGatewayDecisionAuditDeniedContract\n"}
+{"Time":"2026-10-17T23:09:52.692157503Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Output":"--- PASS: TestGatewayDecisionAuditDeniedContract (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.692165916Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestGatewayDecisionAuditDeniedContract","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.692181904Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape"}
+{"Time":"2026-10-17T23:09:52.692189045Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Output":"=== RUN TestImportResourceManifestLoadsPinnedMarkitectShape\n"}
+{"Time":"2026-10-17T23:09:52.695846395Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Output":"--- PASS: TestImportResourceManifestLoadsPinnedMarkitectShape (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.695913167Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportResourceManifestLoadsPinnedMarkitectShape","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.695928397Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources"}
+{"Time":"2026-10-17T23:09:52.695936098Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Output":"=== RUN TestImportNamespaceResourceManifestClassifiesAllResources\n"}
+{"Time":"2026-10-17T23:09:52.701574566Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized (0.02s)\n"}
+{"Time":"2026-10-17T23:09:52.701643512Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Unauthorized","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:52.701668363Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden"}
+{"Time":"2026-10-17T23:09:52.701678805Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden\n"}
+{"Time":"2026-10-17T23:09:52.705605647Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Output":"--- PASS: TestImportNamespaceResourceManifestClassifiesAllResources (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.705672014Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportNamespaceResourceManifestClassifiesAllResources","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.705735036Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings"}
+{"Time":"2026-10-17T23:09:52.705747985Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Output":"=== RUN TestImportAmbiguousManifestReportsClassificationWarnings\n"}
+{"Time":"2026-10-17T23:09:52.707898547Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Output":"--- PASS: TestImportAmbiguousManifestReportsClassificationWarnings (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.708329671Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportAmbiguousManifestReportsClassificationWarnings","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.708390736Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType"}
+{"Time":"2026-10-17T23:09:52.708401313Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Output":"=== RUN TestImportRejectsUnknownMarkitectResourceType\n"}
+{"Time":"2026-10-17T23:09:52.708757287Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Output":"--- PASS: TestImportRejectsUnknownMarkitectResourceType (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.708813059Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Test":"TestImportRejectsUnknownMarkitectResourceType","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.708831328Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:52.716476827Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.71656379Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Forbidden","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.716588082Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error"}
+{"Time":"2026-10-17T23:09:52.716603943Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error\n"}
+{"Time":"2026-10-17T23:09:52.730728148Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.730792819Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Internal_Server_Error","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.73081483Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found"}
+{"Time":"2026-10-17T23:09:52.730823857Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/Found\n"}
+{"Time":"2026-10-17T23:09:52.745336476Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/Found (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.745392238Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/Found","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.745406621Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content"}
+{"Time":"2026-10-17T23:09:52.745414205Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Output":"=== RUN TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content\n"}
+{"Time":"2026-10-17T23:09:52.759190469Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.759264717Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs/No_Content","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.759315276Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Output":"--- PASS: TestDrainRetainsRejectionsAndResumesWithStableIDs (0.10s)\n"}
+{"Time":"2026-10-17T23:09:52.759558216Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainRetainsRejectionsAndResumesWithStableIDs","Elapsed":0.1}
+{"Time":"2026-10-17T23:09:52.759585818Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates"}
+{"Time":"2026-10-17T23:09:52.759624944Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Output":"=== RUN TestDrainAmbiguousAcceptanceReplaysAndTokenRotates\n"}
+{"Time":"2026-10-17T23:09:52.767304388Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Output":"--- PASS: TestDrainAmbiguousAcceptanceReplaysAndTokenRotates (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.767386129Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestDrainAmbiguousAcceptanceReplaysAndTokenRotates","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.767405913Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse"}
+{"Time":"2026-10-17T23:09:52.767415625Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Output":"=== RUN TestOutboxReportsLagAndRefusesSourceReuse\n"}
+{"Time":"2026-10-17T23:09:52.769732571Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Output":"--- PASS: TestOutboxReportsLagAndRefusesSourceReuse (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.769814231Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestOutboxReportsLagAndRefusesSourceReuse","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.769846053Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit"}
+{"Time":"2026-10-17T23:09:52.769856008Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Output":"=== RUN TestSlowReceiverDoesNotBlockDecisionCommit\n"}
+{"Time":"2026-10-17T23:09:52.776131262Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Output":"--- PASS: TestSlowReceiverDoesNotBlockDecisionCommit (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.776204716Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestSlowReceiverDoesNotBlockDecisionCommit","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.776411833Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields"}
+{"Time":"2026-10-17T23:09:52.776433583Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Output":"=== RUN TestCommittedEventsCarryAuditCoreRequiredFields\n"}
+{"Time":"2026-10-17T23:09:52.781427019Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Output":"--- PASS: TestCommittedEventsCarryAuditCoreRequiredFields (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.78149987Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCommittedEventsCarryAuditCoreRequiredFields","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.78151904Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped"}
+{"Time":"2026-10-17T23:09:52.781533477Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Output":"=== RUN TestCountsSurviveRestartAndTornTailIsDropped\n"}
+{"Time":"2026-10-17T23:09:52.784817794Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Output":"--- PASS: TestCountsSurviveRestartAndTornTailIsDropped (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.784889607Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCountsSurviveRestartAndTornTailIsDropped","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.784918571Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass"}
+{"Time":"2026-10-17T23:09:52.784925198Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Output":"=== RUN TestReleasedUncommittedIsReportedPerClass\n"}
+{"Time":"2026-10-17T23:09:52.78576411Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Output":"--- PASS: TestReleasedUncommittedIsReportedPerClass (0.00s)\n"}
+{"Time":"2026-10-17T23:09:52.785822398Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestReleasedUncommittedIsReportedPerClass","Elapsed":0}
+{"Time":"2026-10-17T23:09:52.785831063Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect"}
+{"Time":"2026-10-17T23:09:52.785843336Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Output":"=== RUN TestCadenceClassifiesEveryEffect\n"}
+{"Time":"2026-10-17T23:09:52.79849412Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Output":"--- PASS: TestCadenceClassifiesEveryEffect (0.01s)\n"}
+{"Time":"2026-10-17T23:09:52.798562615Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Test":"TestCadenceClassifiesEveryEffect","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:52.798581064Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:53.021017188Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json"}
+{"Time":"2026-10-17T23:09:53.021062897Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json\n"}
+{"Time":"2026-10-17T23:09:53.045620422Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json (0.02s)\n"}
+{"Time":"2026-10-17T23:09:53.045679034Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_forgejo_admin_api_token.json","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:53.045694525Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json"}
+{"Time":"2026-10-17T23:09:53.045701658Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json\n"}
+{"Time":"2026-10-17T23:09:53.072443302Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json (0.03s)\n"}
+{"Time":"2026-10-17T23:09:53.072507658Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_allow_openrouter_llm_connect.json","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:53.072522365Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json"}
+{"Time":"2026-10-17T23:09:53.072547748Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json\n"}
+{"Time":"2026-10-17T23:09:53.096045914Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json (0.02s)\n"}
+{"Time":"2026-10-17T23:09:53.096114923Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_unknown_need.json","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:53.096146213Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json"}
+{"Time":"2026-10-17T23:09:53.096156637Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json\n"}
+{"Time":"2026-10-17T23:09:53.118456798Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json (0.02s)\n"}
+{"Time":"2026-10-17T23:09:53.118520361Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_wrong_system.json","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:53.118726492Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json"}
+{"Time":"2026-10-17T23:09:53.118751623Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Output":"=== RUN TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json\n"}
+{"Time":"2026-10-17T23:09:53.148711842Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Output":"--- PASS: TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json (0.03s)\n"}
+{"Time":"2026-10-17T23:09:53.148785531Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions/check_request_deny_non_secret_type.json","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:53.14879893Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Output":"--- PASS: TestOpsWardenFetchDecisions (1.09s)\n"}
+{"Time":"2026-10-17T23:09:53.149001926Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchDecisions","Elapsed":1.09}
+{"Time":"2026-10-17T23:09:53.149020123Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings"}
+{"Time":"2026-10-17T23:09:53.149025434Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Output":"=== RUN TestOpsWardenFetchCallerBindings\n"}
+{"Time":"2026-10-17T23:09:53.719178467Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/markitect","Output":"ok \tgithub.com/netkingdom/access-engine/internal/markitect\t1.346s\n"}
+{"Time":"2026-10-17T23:09:53.719231083Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/markitect","Elapsed":1.346}
+{"Time":"2026-10-17T23:09:53.729210297Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/policy"}
+{"Time":"2026-10-17T23:09:53.790847255Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission"}
+{"Time":"2026-10-17T23:09:53.790914425Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Output":"=== RUN TestInformedDecisionAttributeAdmission\n"}
+{"Time":"2026-10-17T23:09:53.803460931Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Output":"--- PASS: TestOpsWardenFetchCallerBindings (0.65s)\n"}
+{"Time":"2026-10-17T23:09:53.803534223Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchCallerBindings","Elapsed":0.65}
+{"Time":"2026-10-17T23:09:53.803547379Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy"}
+{"Time":"2026-10-17T23:09:53.803553745Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Output":"=== RUN TestOpsWardenFetchRegistryMatchesPolicy\n"}
+{"Time":"2026-10-17T23:09:53.808530085Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Output":"--- PASS: TestOpsWardenFetchRegistryMatchesPolicy (0.00s)\n"}
+{"Time":"2026-10-17T23:09:53.80860097Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestOpsWardenFetchRegistryMatchesPolicy","Elapsed":0}
+{"Time":"2026-10-17T23:09:53.808614613Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity"}
+{"Time":"2026-10-17T23:09:53.808620258Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Output":"=== RUN TestActualHTTPAllEffectsWithheldAtOutboxCapacity\n"}
+{"Time":"2026-10-17T23:09:53.813473248Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/emission","Output":"ok \tgithub.com/netkingdom/access-engine/internal/emission\t2.944s\n"}
+{"Time":"2026-10-17T23:09:53.813528028Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/emission","Elapsed":2.944}
+{"Time":"2026-10-17T23:09:53.818956102Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/readback"}
+{"Time":"2026-10-17T23:09:53.819448927Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/readback","Output":"? \tgithub.com/netkingdom/access-engine/internal/readback\t[no test files]\n"}
+{"Time":"2026-10-17T23:09:53.819498657Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/readback","Elapsed":0.001}
+{"Time":"2026-10-17T23:09:53.819579335Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/registry"}
+{"Time":"2026-10-17T23:09:53.848843809Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode"}
+{"Time":"2026-10-17T23:09:53.848906443Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Output":"=== RUN TestTaskRegistryNumericSourceAndStrictDecode\n"}
+{"Time":"2026-10-17T23:09:53.85369948Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Output":"--- PASS: TestTaskRegistryNumericSourceAndStrictDecode (0.00s)\n"}
+{"Time":"2026-10-17T23:09:53.853756776Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestTaskRegistryNumericSourceAndStrictDecode","Elapsed":0}
+{"Time":"2026-10-17T23:09:53.853773133Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse"}
+{"Time":"2026-10-17T23:09:53.853797606Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Output":"=== RUN TestRegistryManifestsParse\n"}
+{"Time":"2026-10-17T23:09:53.858062602Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Output":"--- PASS: TestRegistryManifestsParse (0.00s)\n"}
+{"Time":"2026-10-17T23:09:53.858126589Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestRegistryManifestsParse","Elapsed":0}
+{"Time":"2026-10-17T23:09:53.858147193Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse"}
+{"Time":"2026-10-17T23:09:53.858156562Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Output":"=== RUN TestExpandedRegistryExamplesParse\n"}
+{"Time":"2026-10-17T23:09:53.864406472Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Output":"--- PASS: TestExpandedRegistryExamplesParse (0.01s)\n"}
+{"Time":"2026-10-17T23:09:53.864473731Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestExpandedRegistryExamplesParse","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:53.864495878Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests"}
+{"Time":"2026-10-17T23:09:53.864504498Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Output":"=== RUN TestStoreImportsManifests\n"}
+{"Time":"2026-10-17T23:09:53.867583428Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Output":"--- PASS: TestStoreImportsManifests (0.00s)\n"}
+{"Time":"2026-10-17T23:09:53.867661797Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreImportsManifests","Elapsed":0}
+{"Time":"2026-10-17T23:09:53.867683772Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot"}
+{"Time":"2026-10-17T23:09:53.867691446Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Output":"=== RUN TestStoreLoadsAndSavesDeterministicSnapshot\n"}
+{"Time":"2026-10-17T23:09:53.872038105Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Output":"--- PASS: TestStoreLoadsAndSavesDeterministicSnapshot (0.00s)\n"}
+{"Time":"2026-10-17T23:09:53.872122669Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreLoadsAndSavesDeterministicSnapshot","Elapsed":0}
+{"Time":"2026-10-17T23:09:53.872142588Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges"}
+{"Time":"2026-10-17T23:09:53.872152092Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Output":"=== RUN TestStoreDigestChangesWhenSnapshotChanges\n"}
+{"Time":"2026-10-17T23:09:53.874153651Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Output":"--- PASS: TestStoreDigestChangesWhenSnapshotChanges (0.00s)\n"}
+{"Time":"2026-10-17T23:09:53.874207051Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreDigestChangesWhenSnapshotChanges","Elapsed":0}
+{"Time":"2026-10-17T23:09:53.874240901Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords"}
+{"Time":"2026-10-17T23:09:53.874276592Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Output":"=== RUN TestStoreRejectsInvalidRecords\n"}
+{"Time":"2026-10-17T23:09:53.874544954Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Output":"--- PASS: TestStoreRejectsInvalidRecords (0.00s)\n"}
+{"Time":"2026-10-17T23:09:53.874582511Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Test":"TestStoreRejectsInvalidRecords","Elapsed":0}
+{"Time":"2026-10-17T23:09:53.874739156Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:54.879901087Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/registry","Output":"ok \tgithub.com/netkingdom/access-engine/internal/registry\t1.060s\n"}
+{"Time":"2026-10-17T23:09:54.880050783Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/registry","Elapsed":1.06}
+{"Time":"2026-10-17T23:09:54.883886378Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/schemaguard"}
+{"Time":"2026-10-17T23:09:54.913101707Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas"}
+{"Time":"2026-10-17T23:09:54.913185342Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas\n"}
+{"Time":"2026-10-17T23:09:54.913266939Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json"}
+{"Time":"2026-10-17T23:09:54.913277183Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json\n"}
+{"Time":"2026-10-17T23:09:54.926035001Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json (0.01s)\n"}
+{"Time":"2026-10-17T23:09:54.926110106Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/decision_envelope.json","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:54.92646342Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json"}
+{"Time":"2026-10-17T23:09:54.926497234Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json\n"}
+{"Time":"2026-10-17T23:09:54.940854777Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json (0.01s)\n"}
+{"Time":"2026-10-17T23:09:54.940984345Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_rotate.json","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:54.941006555Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json"}
+{"Time":"2026-10-17T23:09:54.941045897Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json\n"}
+{"Time":"2026-10-17T23:09:54.95657442Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json (0.02s)\n"}
+{"Time":"2026-10-17T23:09:54.956637522Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/secrets-engine/replay/decision_destroy_dual_control.json","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:54.956655512Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json"}
+{"Time":"2026-10-17T23:09:54.956663041Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Output":"=== RUN TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json\n"}
+{"Time":"2026-10-17T23:09:54.967330724Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json (0.01s)\n"}
+{"Time":"2026-10-17T23:09:54.967400437Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas/examples/caring/action_authorization.json","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:54.967627848Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Output":"--- PASS: TestPublishedExamplesMatchTheirSchemas (0.05s)\n"}
+{"Time":"2026-10-17T23:09:54.967672709Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestPublishedExamplesMatchTheirSchemas","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:54.967741898Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime"}
+{"Time":"2026-10-17T23:09:54.967757958Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Output":"=== RUN TestEveryAllowExampleStatesItsLifetime\n"}
+{"Time":"2026-10-17T23:09:54.97985307Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Output":"--- PASS: TestEveryAllowExampleStatesItsLifetime (0.01s)\n"}
+{"Time":"2026-10-17T23:09:54.979938076Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestEveryAllowExampleStatesItsLifetime","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:54.979967084Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete"}
+{"Time":"2026-10-17T23:09:54.979974587Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":"=== RUN TestApprovalClaimsInFixturesAreComplete\n"}
+{"Time":"2026-10-17T23:09:54.980465522Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":" examples_test.go:91: approval-engine not checked out at /work/home/approval-engine/schemas/approval_claim.schema.json\n"}
+{"Time":"2026-10-17T23:09:54.980538526Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Output":"--- SKIP: TestApprovalClaimsInFixturesAreComplete (0.00s)\n"}
+{"Time":"2026-10-17T23:09:54.980563179Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestApprovalClaimsInFixturesAreComplete","Elapsed":0}
+{"Time":"2026-10-17T23:09:54.980586353Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds"}
+{"Time":"2026-10-17T23:09:54.980597084Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Output":"=== RUN TestArrayLengthBounds\n"}
+{"Time":"2026-10-17T23:09:54.980961912Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Output":"--- PASS: TestArrayLengthBounds (0.00s)\n"}
+{"Time":"2026-10-17T23:09:54.980990768Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Test":"TestArrayLengthBounds","Elapsed":0}
+{"Time":"2026-10-17T23:09:54.981017585Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:55.624128016Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Output":"--- PASS: TestActualHTTPAllEffectsWithheldAtOutboxCapacity (1.82s)\n"}
+{"Time":"2026-10-17T23:09:55.624192399Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestActualHTTPAllEffectsWithheldAtOutboxCapacity","Elapsed":1.82}
+{"Time":"2026-10-17T23:09:55.624216899Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins"}
+{"Time":"2026-10-17T23:09:55.624226349Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Output":"=== RUN TestReadbackPinMatchesParticipantPins\n"}
+{"Time":"2026-10-17T23:09:55.624430229Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00"}
+{"Time":"2026-10-17T23:09:55.624450707Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Output":"=== RUN TestReadbackPinMatchesParticipantPins/#00\n"}
+{"Time":"2026-10-17T23:09:55.630229317Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Output":"--- PASS: TestReadbackPinMatchesParticipantPins/#00 (0.01s)\n"}
+{"Time":"2026-10-17T23:09:55.630306938Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/#00","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:55.630334152Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/"}
+{"Time":"2026-10-17T23:09:55.630349328Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Output":"=== RUN TestReadbackPinMatchesParticipantPins/access-engine/\n"}
+{"Time":"2026-10-17T23:09:55.635116012Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Output":"--- PASS: TestReadbackPinMatchesParticipantPins/access-engine/ (0.00s)\n"}
+{"Time":"2026-10-17T23:09:55.63518136Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins/access-engine/","Elapsed":0}
+{"Time":"2026-10-17T23:09:55.635215535Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Output":"--- PASS: TestReadbackPinMatchesParticipantPins (0.01s)\n"}
+{"Time":"2026-10-17T23:09:55.635225662Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPinMatchesParticipantPins","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:55.635446674Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted"}
+{"Time":"2026-10-17T23:09:55.635469551Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Output":"=== RUN TestReadbackRowsInRequestOrderAndNeverOmitted\n"}
+{"Time":"2026-10-17T23:09:55.696691818Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Output":"--- PASS: TestReadbackRowsInRequestOrderAndNeverOmitted (0.06s)\n"}
+{"Time":"2026-10-17T23:09:55.696787194Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRowsInRequestOrderAndNeverOmitted","Elapsed":0.06}
+{"Time":"2026-10-17T23:09:55.696824814Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA"}
+{"Time":"2026-10-17T23:09:55.696839061Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Output":"=== RUN TestReadbackDeniesWithoutMFA\n"}
+{"Time":"2026-10-17T23:09:55.748075245Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Output":"--- PASS: TestReadbackDeniesWithoutMFA (0.05s)\n"}
+{"Time":"2026-10-17T23:09:55.748135065Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackDeniesWithoutMFA","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:55.74816594Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection"}
+{"Time":"2026-10-17T23:09:55.748179673Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Output":"=== RUN TestReadbackSystemsProjection\n"}
+{"Time":"2026-10-17T23:09:55.797041133Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Output":"--- PASS: TestReadbackSystemsProjection (0.05s)\n"}
+{"Time":"2026-10-17T23:09:55.797112044Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackSystemsProjection","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:55.797140936Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries"}
+{"Time":"2026-10-17T23:09:55.797149565Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Output":"=== RUN TestReadbackRefusesDuplicateSystemAcrossRegistries\n"}
+{"Time":"2026-10-17T23:09:55.797988532Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Output":"--- PASS: TestReadbackRefusesDuplicateSystemAcrossRegistries (0.00s)\n"}
+{"Time":"2026-10-17T23:09:55.798035575Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackRefusesDuplicateSystemAcrossRegistries","Elapsed":0}
+{"Time":"2026-10-17T23:09:55.798048217Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape"}
+{"Time":"2026-10-17T23:09:55.798056279Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Output":"=== RUN TestReadbackHTTPCallerAndRequestShape\n"}
+{"Time":"2026-10-17T23:09:55.881484024Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Output":"--- PASS: TestReadbackHTTPCallerAndRequestShape (0.08s)\n"}
+{"Time":"2026-10-17T23:09:55.881578958Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackHTTPCallerAndRequestShape","Elapsed":0.08}
+{"Time":"2026-10-17T23:09:55.881600933Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin"}
+{"Time":"2026-10-17T23:09:55.881609959Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Output":"=== RUN TestReadbackPrincipalCannotCheckOnEnforcementPin\n"}
+{"Time":"2026-10-17T23:09:55.988812337Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Output":"ok \tgithub.com/netkingdom/access-engine/internal/schemaguard\t1.105s\n"}
+{"Time":"2026-10-17T23:09:55.988879922Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/schemaguard","Elapsed":1.105}
+{"Time":"2026-10-17T23:09:55.990654408Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/sign"}
+{"Time":"2026-10-17T23:09:56.027163301Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility"}
+{"Time":"2026-10-17T23:09:56.027225538Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility\n"}
+{"Time":"2026-10-17T23:09:56.035534374Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1"}
+{"Time":"2026-10-17T23:09:56.035604123Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1\n"}
+{"Time":"2026-10-17T23:09:56.047606384Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1 (0.01s)\n"}
+{"Time":"2026-10-17T23:09:56.048417883Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:56.048480264Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0"}
+{"Time":"2026-10-17T23:09:56.048488542Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1.0\n"}
+{"Time":"2026-10-17T23:09:56.054175466Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1.0 (0.01s)\n"}
+{"Time":"2026-10-17T23:09:56.054254349Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.0","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:56.054556513Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0"}
+{"Time":"2026-10-17T23:09:56.05458921Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/-0.0\n"}
+{"Time":"2026-10-17T23:09:56.06156487Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/-0.0 (0.01s)\n"}
+{"Time":"2026-10-17T23:09:56.061682356Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/-0.0","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:56.061888445Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07"}
+{"Time":"2026-10-17T23:09:56.061911637Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1e-07\n"}
+{"Time":"2026-10-17T23:09:56.066175432Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1e-07 (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.066316462Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e-07","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.066333405Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20"}
+{"Time":"2026-10-17T23:09:56.066343811Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1e+20\n"}
+{"Time":"2026-10-17T23:09:56.071749852Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1e+20 (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.071830114Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1e+20","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.072177776Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993"}
+{"Time":"2026-10-17T23:09:56.072227091Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993\n"}
+{"Time":"2026-10-17T23:09:56.076667154Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993 (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.077028282Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/9007199254740993","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.07706638Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308"}
+{"Time":"2026-10-17T23:09:56.077075379Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308\n"}
+{"Time":"2026-10-17T23:09:56.08408739Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308 (0.01s)\n"}
+{"Time":"2026-10-17T23:09:56.084157463Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/1.7976931348623157e308","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:56.084190755Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324"}
+{"Time":"2026-10-17T23:09:56.084204281Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/5e-324\n"}
+{"Time":"2026-10-17T23:09:56.088130584Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/5e-324 (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.08846168Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/5e-324","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.088497Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true"}
+{"Time":"2026-10-17T23:09:56.088507496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/true\n"}
+{"Time":"2026-10-17T23:09:56.092964835Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/true (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.09302049Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/true","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.093031211Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\""}
+{"Time":"2026-10-17T23:09:56.093039832Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"\n"}
+{"Time":"2026-10-17T23:09:56.097438915Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\" (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.097506896Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/\"\u003c\u003e\u0026\\u2028\\u2029_café\"","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.097673715Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]"}
+{"Time":"2026-10-17T23:09:56.09768817Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]\n"}
+{"Time":"2026-10-17T23:09:56.103146337Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0] (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.103217619Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/[1,1.0,-0.0]","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.103237682Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}"}
+{"Time":"2026-10-17T23:09:56.103283354Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Output":"=== RUN TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}\n"}
+{"Time":"2026-10-17T23:09:56.105970173Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0} (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.106037036Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility/{\"nested\":1.0}","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.112095028Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Output":"--- PASS: TestProducerNumericEnvelopeDecodeCompatibility (0.08s)\n"}
+{"Time":"2026-10-17T23:09:56.112139249Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestProducerNumericEnvelopeDecodeCompatibility","Elapsed":0.08}
+{"Time":"2026-10-17T23:09:56.11214933Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip"}
+{"Time":"2026-10-17T23:09:56.112155137Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Output":"=== RUN TestSignAndVerifyRoundTrip\n"}
+{"Time":"2026-10-17T23:09:56.112888573Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Output":"--- PASS: TestSignAndVerifyRoundTrip (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.116055972Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestSignAndVerifyRoundTrip","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.116113276Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification"}
+{"Time":"2026-10-17T23:09:56.116186983Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Output":"=== RUN TestAlteredEnvelopeFailsVerification\n"}
+{"Time":"2026-10-17T23:09:56.117551694Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Output":"--- PASS: TestAlteredEnvelopeFailsVerification (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.117608836Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestAlteredEnvelopeFailsVerification","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.117681705Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify"}
+{"Time":"2026-10-17T23:09:56.117697214Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Output":"=== RUN TestUnsignedEnvelopeDoesNotVerify\n"}
+{"Time":"2026-10-17T23:09:56.118941937Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Output":"--- PASS: TestUnsignedEnvelopeDoesNotVerify (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.119005491Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestUnsignedEnvelopeDoesNotVerify","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.119040965Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure"}
+{"Time":"2026-10-17T23:09:56.119122418Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Output":"=== RUN TestReplayFixturesProveSuccessAndFailure\n"}
+{"Time":"2026-10-17T23:09:56.126181225Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Output":"--- PASS: TestReplayFixturesProveSuccessAndFailure (0.01s)\n"}
+{"Time":"2026-10-17T23:09:56.126283408Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestReplayFixturesProveSuccessAndFailure","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:56.12631899Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures"}
+{"Time":"2026-10-17T23:09:56.126331172Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":"=== RUN TestWriteReplaySignatureFixtures\n"}
+{"Time":"2026-10-17T23:09:56.126841918Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":" write_fixtures_test.go:15: set UPDATE_FIXTURES=1 to regenerate signed replay fixtures\n"}
+{"Time":"2026-10-17T23:09:56.126891585Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Output":"--- SKIP: TestWriteReplaySignatureFixtures (0.00s)\n"}
+{"Time":"2026-10-17T23:09:56.126903055Z","Action":"skip","Package":"github.com/netkingdom/access-engine/internal/sign","Test":"TestWriteReplaySignatureFixtures","Elapsed":0}
+{"Time":"2026-10-17T23:09:56.126916428Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:56.963811131Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Output":"--- PASS: TestReadbackPrincipalCannotCheckOnEnforcementPin (1.08s)\n"}
+{"Time":"2026-10-17T23:09:56.963901447Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackPrincipalCannotCheckOnEnforcementPin","Elapsed":1.08}
+{"Time":"2026-10-17T23:09:56.963933909Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects"}
+{"Time":"2026-10-17T23:09:56.963945316Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Output":"=== RUN TestReadbackWithholdsUncommittedEffects\n"}
+{"Time":"2026-10-17T23:09:57.080219689Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Output":"--- PASS: TestReadbackWithholdsUncommittedEffects (0.11s)\n"}
+{"Time":"2026-10-17T23:09:57.080289175Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackWithholdsUncommittedEffects","Elapsed":0.11}
+{"Time":"2026-10-17T23:09:57.080306732Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas"}
+{"Time":"2026-10-17T23:09:57.080316489Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Output":"=== RUN TestReadbackShapesMatchSchemas\n"}
+{"Time":"2026-10-17T23:09:57.135542523Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/sign","Output":"ok \tgithub.com/netkingdom/access-engine/internal/sign\t1.145s\n"}
+{"Time":"2026-10-17T23:09:57.135663192Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/sign","Elapsed":1.145}
+{"Time":"2026-10-17T23:09:57.13856836Z","Action":"start","Package":"github.com/netkingdom/access-engine/internal/taskexecution"}
+{"Time":"2026-10-17T23:09:57.182533396Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary"}
+{"Time":"2026-10-17T23:09:57.18259383Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary\n"}
+{"Time":"2026-10-17T23:09:57.188319447Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Output":"--- PASS: TestReadbackShapesMatchSchemas (0.11s)\n"}
+{"Time":"2026-10-17T23:09:57.188706468Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackShapesMatchSchemas","Elapsed":0.11}
+{"Time":"2026-10-17T23:09:57.188934748Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue"}
+{"Time":"2026-10-17T23:09:57.188956119Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Output":"=== RUN TestReadbackInformedDecisionCatalogue\n"}
+{"Time":"2026-10-17T23:09:57.236993587Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect"}
+{"Time":"2026-10-17T23:09:57.237047321Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/redirect\n"}
+{"Time":"2026-10-17T23:09:57.239219844Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/redirect (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.240022407Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/redirect","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.240487553Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status"}
+{"Time":"2026-10-17T23:09:57.24053235Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/status\n"}
+{"Time":"2026-10-17T23:09:57.242363879Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/status (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.242478443Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/status","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.242521744Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large"}
+{"Time":"2026-10-17T23:09:57.242537344Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/large\n"}
+{"Time":"2026-10-17T23:09:57.306396593Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/large (0.06s)\n"}
+{"Time":"2026-10-17T23:09:57.306469993Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/large","Elapsed":0.06}
+{"Time":"2026-10-17T23:09:57.306494656Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate"}
+{"Time":"2026-10-17T23:09:57.306506234Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/duplicate\n"}
+{"Time":"2026-10-17T23:09:57.316643953Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Output":"--- PASS: TestAttributeContextCarriedWithoutViewHash (6.41s)\n"}
+{"Time":"2026-10-17T23:09:57.317156728Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestAttributeContextCarriedWithoutViewHash","Elapsed":6.41}
+{"Time":"2026-10-17T23:09:57.32408505Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld"}
+{"Time":"2026-10-17T23:09:57.324146773Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Output":"=== RUN TestUncommittedDenyIsWithheld\n"}
+{"Time":"2026-10-17T23:09:57.337760977Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/duplicate (0.03s)\n"}
+{"Time":"2026-10-17T23:09:57.338046526Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:57.338274645Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8"}
+{"Time":"2026-10-17T23:09:57.338301651Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/invalid-utf8\n"}
+{"Time":"2026-10-17T23:09:57.340978739Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/invalid-utf8 (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.341053266Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/invalid-utf8","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.341072779Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media"}
+{"Time":"2026-10-17T23:09:57.341083907Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/media\n"}
+{"Time":"2026-10-17T23:09:57.348953935Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/media (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.349029743Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/media","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.349050798Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media"}
+{"Time":"2026-10-17T23:09:57.34905968Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/duplicate-media\n"}
+{"Time":"2026-10-17T23:09:57.38023122Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/duplicate-media (0.04s)\n"}
+{"Time":"2026-10-17T23:09:57.380302321Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/duplicate-media","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:57.380541981Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed"}
+{"Time":"2026-10-17T23:09:57.380592198Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/compressed\n"}
+{"Time":"2026-10-17T23:09:57.413913838Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/compressed (0.03s)\n"}
+{"Time":"2026-10-17T23:09:57.414842588Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/compressed","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:57.416091702Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow"}
+{"Time":"2026-10-17T23:09:57.416161063Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Output":"=== RUN TestFixedApprovalReaderRefusalBoundary/slow\n"}
+{"Time":"2026-10-17T23:09:57.468454846Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary/slow (0.05s)\n"}
+{"Time":"2026-10-17T23:09:57.46885101Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary/slow","Elapsed":0.05}
+{"Time":"2026-10-17T23:09:57.468921029Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Output":"--- PASS: TestUncommittedDenyIsWithheld (0.15s)\n"}
+{"Time":"2026-10-17T23:09:57.469010679Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedDenyIsWithheld","Elapsed":0.15}
+{"Time":"2026-10-17T23:09:57.469120671Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld"}
+{"Time":"2026-10-17T23:09:57.469141564Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Output":"=== RUN TestUncommittedAllowIsWithheld\n"}
+{"Time":"2026-10-17T23:09:57.471690012Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Output":"--- PASS: TestFixedApprovalReaderRefusalBoundary (0.29s)\n"}
+{"Time":"2026-10-17T23:09:57.476130845Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestFixedApprovalReaderRefusalBoundary","Elapsed":0.29}
+{"Time":"2026-10-17T23:09:57.476197789Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract"}
+{"Time":"2026-10-17T23:09:57.476209719Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Output":"=== RUN TestCryptographicInitiatorContract\n"}
+{"Time":"2026-10-17T23:09:57.576011951Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Output":"--- PASS: TestUncommittedAllowIsWithheld (0.11s)\n"}
+{"Time":"2026-10-17T23:09:57.576336049Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUncommittedAllowIsWithheld","Elapsed":0.11}
+{"Time":"2026-10-17T23:09:57.576582445Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow"}
+{"Time":"2026-10-17T23:09:57.576611778Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Output":"=== RUN TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow\n"}
+{"Time":"2026-10-17T23:09:57.684590237Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Output":"--- PASS: TestReadbackInformedDecisionCatalogue (0.50s)\n"}
+{"Time":"2026-10-17T23:09:57.688176395Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestReadbackInformedDecisionCatalogue","Elapsed":0.5}
+{"Time":"2026-10-17T23:09:57.688260832Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP"}
+{"Time":"2026-10-17T23:09:57.688275143Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Output":"=== RUN TestEnforcementWithholdsUncommittedDenyHTTP\n"}
+{"Time":"2026-10-17T23:09:57.701569759Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Output":"--- PASS: TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow (0.12s)\n"}
+{"Time":"2026-10-17T23:09:57.701808716Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCommitsOnceAndWithholdsOnAnyUncommittedAllow","Elapsed":0.12}
+{"Time":"2026-10-17T23:09:57.701975481Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit"}
+{"Time":"2026-10-17T23:09:57.701990017Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Output":"=== RUN TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit\n"}
+{"Time":"2026-10-17T23:09:57.746245258Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future"}
+{"Time":"2026-10-17T23:09:57.746324303Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Output":"=== RUN TestCryptographicInitiatorContract/future\n"}
+{"Time":"2026-10-17T23:09:57.75468862Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Output":"--- PASS: TestCryptographicInitiatorContract/future (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.760109841Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/future","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.760183079Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa"}
+{"Time":"2026-10-17T23:09:57.760200175Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Output":"=== RUN TestCryptographicInitiatorContract/no_mfa\n"}
+{"Time":"2026-10-17T23:09:57.765109449Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Output":"--- PASS: TestCryptographicInitiatorContract/no_mfa (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.768119605Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/no_mfa","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.768195864Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant"}
+{"Time":"2026-10-17T23:09:57.768214601Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Output":"=== RUN TestCryptographicInitiatorContract/registered_tenant\n"}
+{"Time":"2026-10-17T23:09:57.776067106Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Output":"--- PASS: TestCryptographicInitiatorContract/registered_tenant (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.780951946Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/registered_tenant","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.781026095Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant"}
+{"Time":"2026-10-17T23:09:57.781037934Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Output":"=== RUN TestCryptographicInitiatorContract/foreign_tenant\n"}
+{"Time":"2026-10-17T23:09:57.788163816Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Output":"--- PASS: TestCryptographicInitiatorContract/foreign_tenant (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.788238768Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/foreign_tenant","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.78825756Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience"}
+{"Time":"2026-10-17T23:09:57.788267298Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Output":"=== RUN TestCryptographicInitiatorContract/audience\n"}
+{"Time":"2026-10-17T23:09:57.793732649Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Output":"--- PASS: TestCryptographicInitiatorContract/audience (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.793966999Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/audience","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.794273945Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired"}
+{"Time":"2026-10-17T23:09:57.794311231Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Output":"=== RUN TestCryptographicInitiatorContract/expired\n"}
+{"Time":"2026-10-17T23:09:57.801108481Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Output":"--- PASS: TestCryptographicInitiatorContract/expired (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.801254732Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/expired","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.80128191Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa"}
+{"Time":"2026-10-17T23:09:57.801291757Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Output":"=== RUN TestCryptographicInitiatorContract/old_mfa\n"}
+{"Time":"2026-10-17T23:09:57.810213866Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Output":"--- PASS: TestCryptographicInitiatorContract/old_mfa (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.810283101Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/old_mfa","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.81029807Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service"}
+{"Time":"2026-10-17T23:09:57.810327385Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Output":"=== RUN TestCryptographicInitiatorContract/service\n"}
+{"Time":"2026-10-17T23:09:57.819892568Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Output":"--- PASS: TestCryptographicInitiatorContract/service (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.820060947Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/service","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.820100091Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer"}
+{"Time":"2026-10-17T23:09:57.820110848Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Output":"=== RUN TestCryptographicInitiatorContract/issuer\n"}
+{"Time":"2026-10-17T23:09:57.820341302Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Output":"--- PASS: TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit (0.12s)\n"}
+{"Time":"2026-10-17T23:09:57.820373277Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedWithholdsWhenAllCandidateDenialsFailCommit","Elapsed":0.12}
+{"Time":"2026-10-17T23:09:57.820488951Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext"}
+{"Time":"2026-10-17T23:09:57.820506597Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Output":"=== RUN TestCheckUsesExplicitCaringContext\n"}
+{"Time":"2026-10-17T23:09:57.827857592Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Output":"--- PASS: TestCryptographicInitiatorContract/issuer (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.827917692Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract/issuer","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.828235379Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Output":"--- PASS: TestCryptographicInitiatorContract (0.36s)\n"}
+{"Time":"2026-10-17T23:09:57.828269536Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestCryptographicInitiatorContract","Elapsed":0.36}
+{"Time":"2026-10-17T23:09:57.828319546Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON"}
+{"Time":"2026-10-17T23:09:57.828328401Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Output":"=== RUN TestStrictClaimJSON\n"}
+{"Time":"2026-10-17T23:09:57.828776269Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Output":"--- PASS: TestStrictClaimJSON (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.828814421Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestStrictClaimJSON","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.828826513Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding"}
+{"Time":"2026-10-17T23:09:57.82883297Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Output":"=== RUN TestServicePilotAuthenticatedBinding\n"}
+{"Time":"2026-10-17T23:09:57.834624176Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Output":"--- PASS: TestServicePilotAuthenticatedBinding (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.834702906Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotAuthenticatedBinding","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.834724863Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals"}
+{"Time":"2026-10-17T23:09:57.834734466Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Output":"=== RUN TestServicePilotRefusals\n"}
+{"Time":"2026-10-17T23:09:57.835072301Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport"}
+{"Time":"2026-10-17T23:09:57.83511177Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Output":"=== RUN TestServicePilotRefusals/expired_transport\n"}
+{"Time":"2026-10-17T23:09:57.8357179Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Output":"--- PASS: TestServicePilotRefusals/expired_transport (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.835762599Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/expired_transport","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.836079275Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry"}
+{"Time":"2026-10-17T23:09:57.836138879Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Output":"=== RUN TestServicePilotRefusals/missing_expiry\n"}
+{"Time":"2026-10-17T23:09:57.83618411Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Output":"--- PASS: TestServicePilotRefusals/missing_expiry (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.836547767Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/missing_expiry","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.836586685Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified"}
+{"Time":"2026-10-17T23:09:57.836595044Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Output":"=== RUN TestServicePilotRefusals/caller_verified\n"}
+{"Time":"2026-10-17T23:09:57.836839673Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Output":"--- PASS: TestServicePilotRefusals/caller_verified (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.836882695Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/caller_verified","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.836897258Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection"}
+{"Time":"2026-10-17T23:09:57.836904769Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Output":"=== RUN TestServicePilotRefusals/human_projection\n"}
+{"Time":"2026-10-17T23:09:57.837207099Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Output":"--- PASS: TestServicePilotRefusals/human_projection (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.837251879Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human_projection","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.837275486Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding"}
+{"Time":"2026-10-17T23:09:57.837285387Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Output":"=== RUN TestServicePilotRefusals/forged_binding\n"}
+{"Time":"2026-10-17T23:09:57.838026412Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Output":"--- PASS: TestServicePilotRefusals/forged_binding (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.838088405Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/forged_binding","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.838103266Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply"}
+{"Time":"2026-10-17T23:09:57.83811258Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Output":"=== RUN TestServicePilotRefusals/legacy_apply\n"}
+{"Time":"2026-10-17T23:09:57.838157802Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Output":"--- PASS: TestServicePilotRefusals/legacy_apply (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.838363019Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/legacy_apply","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.838403164Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant"}
+{"Time":"2026-10-17T23:09:57.838414607Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Output":"=== RUN TestServicePilotRefusals/foreigntenant\n"}
+{"Time":"2026-10-17T23:09:57.839189225Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Output":"--- PASS: TestServicePilotRefusals/foreigntenant (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.839250226Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/foreigntenant","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.839272427Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal"}
+{"Time":"2026-10-17T23:09:57.839283121Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Output":"=== RUN TestServicePilotRefusals/wrong_service_principal\n"}
+{"Time":"2026-10-17T23:09:57.839914867Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Output":"--- PASS: TestServicePilotRefusals/wrong_service_principal (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.840061046Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_service_principal","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.840217179Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience"}
+{"Time":"2026-10-17T23:09:57.840236981Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Output":"=== RUN TestServicePilotRefusals/wrong_audience\n"}
+{"Time":"2026-10-17T23:09:57.840658195Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Output":"--- PASS: TestServicePilotRefusals/wrong_audience (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.84070109Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/wrong_audience","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.840733985Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation"}
+{"Time":"2026-10-17T23:09:57.840745013Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Output":"=== RUN TestServicePilotRefusals/delegation\n"}
+{"Time":"2026-10-17T23:09:57.841080413Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Output":"--- PASS: TestServicePilotRefusals/delegation (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.841145373Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/delegation","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.841362734Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime"}
+{"Time":"2026-10-17T23:09:57.841389173Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Output":"=== RUN TestServicePilotRefusals/lifetime\n"}
+{"Time":"2026-10-17T23:09:57.841883579Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Output":"--- PASS: TestServicePilotRefusals/lifetime (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.841938711Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/lifetime","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.841957304Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human"}
+{"Time":"2026-10-17T23:09:57.841965204Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Output":"=== RUN TestServicePilotRefusals/human\n"}
+{"Time":"2026-10-17T23:09:57.842269202Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Output":"--- PASS: TestServicePilotRefusals/human (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.842307552Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/human","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.842470378Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject"}
+{"Time":"2026-10-17T23:09:57.842501244Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Output":"=== RUN TestServicePilotRefusals/subject\n"}
+{"Time":"2026-10-17T23:09:57.842740182Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Output":"--- PASS: TestServicePilotRefusals/subject (0.00s)\n"}
+{"Time":"2026-10-17T23:09:57.84280094Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals/subject","Elapsed":0}
+{"Time":"2026-10-17T23:09:57.843200675Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Output":"--- PASS: TestServicePilotRefusals (0.01s)\n"}
+{"Time":"2026-10-17T23:09:57.843239864Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServicePilotRefusals","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:57.843300081Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode"}
+{"Time":"2026-10-17T23:09:57.843320117Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Output":"=== RUN TestServiceInputRuntimeRecheckAndStrictHTTPDecode\n"}
+{"Time":"2026-10-17T23:09:57.883433925Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Output":"--- PASS: TestServiceInputRuntimeRecheckAndStrictHTTPDecode (0.04s)\n"}
+{"Time":"2026-10-17T23:09:57.883509634Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Test":"TestServiceInputRuntimeRecheckAndStrictHTTPDecode","Elapsed":0.04}
+{"Time":"2026-10-17T23:09:57.883627499Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:57.957419797Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Output":"--- PASS: TestCheckUsesExplicitCaringContext (0.14s)\n"}
+{"Time":"2026-10-17T23:09:57.957689909Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckUsesExplicitCaringContext","Elapsed":0.14}
+{"Time":"2026-10-17T23:09:57.958212152Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest"}
+{"Time":"2026-10-17T23:09:57.958256733Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Output":"=== RUN TestCallerProvenanceDoesNotChangeRequestDigest\n"}
+{"Time":"2026-10-17T23:09:58.060095859Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Output":"--- PASS: TestCallerProvenanceDoesNotChangeRequestDigest (0.10s)\n"}
+{"Time":"2026-10-17T23:09:58.06016824Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCallerProvenanceDoesNotChangeRequestDigest","Elapsed":0.1}
+{"Time":"2026-10-17T23:09:58.060187817Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor"}
+{"Time":"2026-10-17T23:09:58.060203958Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Output":"=== RUN TestCheckMatchesRegistryRelationshipDescriptor\n"}
+{"Time":"2026-10-17T23:09:58.150319117Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Output":"--- PASS: TestCheckMatchesRegistryRelationshipDescriptor (0.09s)\n"}
+{"Time":"2026-10-17T23:09:58.150394826Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckMatchesRegistryRelationshipDescriptor","Elapsed":0.09}
+{"Time":"2026-10-17T23:09:58.150420588Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder"}
+{"Time":"2026-10-17T23:09:58.150431977Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Output":"=== RUN TestBatchCheckPreservesResourceOrder\n"}
+{"Time":"2026-10-17T23:09:58.248211364Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Output":"--- PASS: TestBatchCheckPreservesResourceOrder (0.10s)\n"}
+{"Time":"2026-10-17T23:09:58.248279066Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestBatchCheckPreservesResourceOrder","Elapsed":0.1}
+{"Time":"2026-10-17T23:09:58.24831637Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources"}
+{"Time":"2026-10-17T23:09:58.248328282Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Output":"=== RUN TestListAllowedReturnsOnlyAllowedResources\n"}
+{"Time":"2026-10-17T23:09:58.355307173Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Output":"--- PASS: TestListAllowedReturnsOnlyAllowedResources (0.11s)\n"}
+{"Time":"2026-10-17T23:09:58.355458825Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestListAllowedReturnsOnlyAllowedResources","Elapsed":0.11}
+{"Time":"2026-10-17T23:09:58.355484957Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision"}
+{"Time":"2026-10-17T23:09:58.355501324Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Output":"=== RUN TestExplainUsesRecordedDecision\n"}
+{"Time":"2026-10-17T23:09:58.446492161Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Output":"--- PASS: TestExplainUsesRecordedDecision (0.09s)\n"}
+{"Time":"2026-10-17T23:09:58.446564606Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestExplainUsesRecordedDecision","Elapsed":0.09}
+{"Time":"2026-10-17T23:09:58.446645193Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest"}
+{"Time":"2026-10-17T23:09:58.446660486Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Output":"=== RUN TestCheckRecordsRegistrySnapshotDigest\n"}
+{"Time":"2026-10-17T23:09:58.636178085Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Output":"--- PASS: TestCheckRecordsRegistrySnapshotDigest (0.18s)\n"}
+{"Time":"2026-10-17T23:09:58.636246264Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckRecordsRegistrySnapshotDigest","Elapsed":0.18}
+{"Time":"2026-10-17T23:09:58.636271702Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes"}
+{"Time":"2026-10-17T23:09:58.636289114Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Output":"=== RUN TestCheckAllowLifetimes\n"}
+{"Time":"2026-10-17T23:09:58.8960857Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Output":"ok \tgithub.com/netkingdom/access-engine/internal/taskexecution\t1.757s\n"}
+{"Time":"2026-10-17T23:09:58.896230562Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/taskexecution","Elapsed":1.758}
+{"Time":"2026-10-17T23:09:58.904038975Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/api"}
+{"Time":"2026-10-17T23:09:58.924090398Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Output":"--- PASS: TestCheckAllowLifetimes (0.29s)\n"}
+{"Time":"2026-10-17T23:09:58.92419461Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckAllowLifetimes","Elapsed":0.29}
+{"Time":"2026-10-17T23:09:58.924268417Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog"}
+{"Time":"2026-10-17T23:09:58.924283674Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Output":"=== RUN TestCheckWritesDecisionLog\n"}
+{"Time":"2026-10-17T23:09:58.934075199Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim"}
+{"Time":"2026-10-17T23:09:58.934133947Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Output":"=== RUN TestApprovalBindingDigestSurvivesAttachingTheClaim\n"}
+{"Time":"2026-10-17T23:09:58.935843705Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Output":"--- PASS: TestApprovalBindingDigestSurvivesAttachingTheClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.936126865Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestSurvivesAttachingTheClaim","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.936362972Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached"}
+{"Time":"2026-10-17T23:09:58.936383315Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Output":"=== RUN TestRequestDigestStillMovesWhenTheClaimIsAttached\n"}
+{"Time":"2026-10-17T23:09:58.937814118Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Output":"--- PASS: TestRequestDigestStillMovesWhenTheClaimIsAttached (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.937873145Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestStillMovesWhenTheClaimIsAttached","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.937887248Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest"}
+{"Time":"2026-10-17T23:09:58.937895724Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Output":"=== RUN TestTheTwoDigestsDisagreeOnAClaimBearingRequest\n"}
+{"Time":"2026-10-17T23:09:58.937916365Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Output":"--- PASS: TestTheTwoDigestsDisagreeOnAClaimBearingRequest (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.942891198Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestTheTwoDigestsDisagreeOnAClaimBearingRequest","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.942971956Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim"}
+{"Time":"2026-10-17T23:09:58.942992867Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Output":"=== RUN TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim\n"}
+{"Time":"2026-10-17T23:09:58.943012714Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Output":"--- PASS: TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.943024139Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApprovalBindingDigestEqualsRequestDigestWithoutAClaim","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.943035176Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent"}
+{"Time":"2026-10-17T23:09:58.943044392Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Output":"=== RUN TestBindingOmitsApprovalDigestWhenNoClaimIsPresent\n"}
+{"Time":"2026-10-17T23:09:58.943056989Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Output":"--- PASS: TestBindingOmitsApprovalDigestWhenNoClaimIsPresent (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.943102372Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestBindingOmitsApprovalDigestWhenNoClaimIsPresent","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.943114915Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest"}
+{"Time":"2026-10-17T23:09:58.943124257Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Output":"=== RUN TestOtherContextClaimsStillBindUnderTheApprovalDigest\n"}
+{"Time":"2026-10-17T23:09:58.94314506Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Output":"--- PASS: TestOtherContextClaimsStillBindUnderTheApprovalDigest (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.943156097Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestOtherContextClaimsStillBindUnderTheApprovalDigest","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.943165818Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant"}
+{"Time":"2026-10-17T23:09:58.943174637Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Output":"=== RUN TestDecisionEffectsListsEveryConstant\n"}
+{"Time":"2026-10-17T23:09:58.967150158Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Output":"--- PASS: TestDecisionEffectsListsEveryConstant (0.03s)\n"}
+{"Time":"2026-10-17T23:09:58.972092377Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionEffectsListsEveryConstant","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:58.972169646Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection"}
+{"Time":"2026-10-17T23:09:58.972188726Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Output":"=== RUN TestRestrictsSplitsByDirection\n"}
+{"Time":"2026-10-17T23:09:58.97228604Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Output":"--- PASS: TestRestrictsSplitsByDirection (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.972316149Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRestrictsSplitsByDirection","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.972333056Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding"}
+{"Time":"2026-10-17T23:09:58.972346438Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding\n"}
+{"Time":"2026-10-17T23:09:58.972358422Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source"}
+{"Time":"2026-10-17T23:09:58.972367069Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/source\n"}
+{"Time":"2026-10-17T23:09:58.973681293Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/source (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.973832801Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/source","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.974006193Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method"}
+{"Time":"2026-10-17T23:09:58.974026167Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/method\n"}
+{"Time":"2026-10-17T23:09:58.975575713Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/method (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.977797163Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/method","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.977857569Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target"}
+{"Time":"2026-10-17T23:09:58.977867677Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/target\n"}
+{"Time":"2026-10-17T23:09:58.977900807Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/target (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.977915857Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/target","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.977924396Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant"}
+{"Time":"2026-10-17T23:09:58.977931276Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/tenant\n"}
+{"Time":"2026-10-17T23:09:58.979812529Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/tenant (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.979899645Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/tenant","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.979916543Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id"}
+{"Time":"2026-10-17T23:09:58.979925669Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id\n"}
+{"Time":"2026-10-17T23:09:58.981530144Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Output":"--- PASS: TestEnforcementWithholdsUncommittedDenyHTTP (1.30s)\n"}
+{"Time":"2026-10-17T23:09:58.981594753Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestEnforcementWithholdsUncommittedDenyHTTP","Elapsed":1.3}
+{"Time":"2026-10-17T23:09:58.981613517Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial"}
+{"Time":"2026-10-17T23:09:58.981622472Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial\n"}
+{"Time":"2026-10-17T23:09:58.98166974Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden"}
+{"Time":"2026-10-17T23:09:58.981682968Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden\n"}
+{"Time":"2026-10-17T23:09:58.982145761Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.982181009Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/operation_id","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.982214364Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body"}
+{"Time":"2026-10-17T23:09:58.982224175Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/body\n"}
+{"Time":"2026-10-17T23:09:58.983624139Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/body (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.983672065Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/body","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.983687584Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal"}
+{"Time":"2026-10-17T23:09:58.983695672Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/principal\n"}
+{"Time":"2026-10-17T23:09:58.985296364Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/principal (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.985373813Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/principal","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.985407736Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action"}
+{"Time":"2026-10-17T23:09:58.985416834Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/action\n"}
+{"Time":"2026-10-17T23:09:58.98695505Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/action (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.987023067Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/action","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.987068082Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog"}
+{"Time":"2026-10-17T23:09:58.987081166Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/catalog\n"}
+{"Time":"2026-10-17T23:09:58.988781452Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/catalog (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.988869568Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/catalog","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.988893879Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr"}
+{"Time":"2026-10-17T23:09:58.988909632Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Output":"=== RUN TestExecutionContractExactSemanticChangesInvalidateBinding/ccr\n"}
+{"Time":"2026-10-17T23:09:58.990591858Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding/ccr (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.990650776Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding/ccr","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.990681895Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Output":"--- PASS: TestExecutionContractExactSemanticChangesInvalidateBinding (0.02s)\n"}
+{"Time":"2026-10-17T23:09:58.990693617Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractExactSemanticChangesInvalidateBinding","Elapsed":0.02}
+{"Time":"2026-10-17T23:09:58.990926109Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment"}
+{"Time":"2026-10-17T23:09:58.990950059Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Output":"=== RUN TestExecutionContractApprovalJoinAndEnrichment\n"}
+{"Time":"2026-10-17T23:09:58.994879514Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Output":"--- PASS: TestExecutionContractApprovalJoinAndEnrichment (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.994950029Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestExecutionContractApprovalJoinAndEnrichment","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.995106055Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet"}
+{"Time":"2026-10-17T23:09:58.995126488Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Output":"=== RUN TestPurposeEntersDigestsOnlyWhenSet\n"}
+{"Time":"2026-10-17T23:09:58.995882277Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Output":"--- PASS: TestPurposeEntersDigestsOnlyWhenSet (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.996067906Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestPurposeEntersDigestsOnlyWhenSet","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.996109999Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses"}
+{"Time":"2026-10-17T23:09:58.996143092Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Output":"=== RUN TestCaringAccessDescriptorExampleParses\n"}
+{"Time":"2026-10-17T23:09:58.998607148Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Output":"--- PASS: TestCaringAccessDescriptorExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:09:58.998668637Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCaringAccessDescriptorExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:09:58.998689368Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses"}
+{"Time":"2026-10-17T23:09:58.998698015Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Output":"=== RUN TestCheckRequestExampleParses\n"}
+{"Time":"2026-10-17T23:09:59.002342649Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Output":"--- PASS: TestCheckRequestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.002430297Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestCheckRequestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.00251046Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse"}
+{"Time":"2026-10-17T23:09:59.002523292Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Output":"=== RUN TestRegistryExamplesParse\n"}
+{"Time":"2026-10-17T23:09:59.008023147Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Output":"--- PASS: TestRegistryExamplesParse (0.01s)\n"}
+{"Time":"2026-10-17T23:09:59.008098071Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRegistryExamplesParse","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:59.008145511Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse"}
+{"Time":"2026-10-17T23:09:59.008156503Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Output":"=== RUN TestDecisionAndAuditExamplesParse\n"}
+{"Time":"2026-10-17T23:09:59.014296936Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Output":"--- PASS: TestDecisionAndAuditExamplesParse (0.01s)\n"}
+{"Time":"2026-10-17T23:09:59.01436553Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestDecisionAndAuditExamplesParse","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:59.014384746Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses"}
+{"Time":"2026-10-17T23:09:59.01439434Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Output":"=== RUN TestActionAuthorizationExampleParses\n"}
+{"Time":"2026-10-17T23:09:59.017683039Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Output":"--- PASS: TestActionAuthorizationExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.017750759Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestActionAuthorizationExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.017766043Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction"}
+{"Time":"2026-10-17T23:09:59.017809154Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Output":"=== RUN TestRequestDigestIgnoresIDAndChangesWithAction\n"}
+{"Time":"2026-10-17T23:09:59.018465538Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Output":"--- PASS: TestRequestDigestIgnoresIDAndChangesWithAction (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.018504132Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestRequestDigestIgnoresIDAndChangesWithAction","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.018536693Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone"}
+{"Time":"2026-10-17T23:09:59.018548407Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Output":"=== RUN TestApplyAllowLifetimeDefaultDeclaredAndNone\n"}
+{"Time":"2026-10-17T23:09:59.018579967Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Output":"--- PASS: TestCheckWritesDecisionLog (0.09s)\n"}
+{"Time":"2026-10-17T23:09:59.018810431Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestCheckWritesDecisionLog","Elapsed":0.09}
+{"Time":"2026-10-17T23:09:59.018842803Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes"}
+{"Time":"2026-10-17T23:09:59.018852542Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Output":"=== RUN TestRegistryFactsOverrideCallerSuppliedAttributes\n"}
+{"Time":"2026-10-17T23:09:59.018879584Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Output":"--- PASS: TestApplyAllowLifetimeDefaultDeclaredAndNone (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.018894787Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestApplyAllowLifetimeDefaultDeclaredAndNone","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.019118469Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON"}
+{"Time":"2026-10-17T23:09:59.019144755Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Output":"=== RUN TestSchemaFilesAreJSON\n"}
+{"Time":"2026-10-17T23:09:59.019611722Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json"}
+{"Time":"2026-10-17T23:09:59.019643841Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/action_authorization.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.021261987Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/action_authorization.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.021328336Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/action_authorization.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.021342691Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json"}
+{"Time":"2026-10-17T23:09:59.021352033Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/audit_event.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.022291486Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/audit_event.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.022329169Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/audit_event.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.022377619Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json"}
+{"Time":"2026-10-17T23:09:59.022388295Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/caring_access_descriptor.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.026741831Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/caring_access_descriptor.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.026817639Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_access_descriptor.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.026837414Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json"}
+{"Time":"2026-10-17T23:09:59.026845674Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/caring_profile.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.027591085Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/caring_profile.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.027628777Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/caring_profile.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.027704711Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json"}
+{"Time":"2026-10-17T23:09:59.027720987Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/check_request.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.029279682Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/check_request.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.029354822Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/check_request.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.029566665Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json"}
+{"Time":"2026-10-17T23:09:59.029597269Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/decision_envelope.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.034156317Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/decision_envelope.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.034257833Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/decision_envelope.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.034520355Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json"}
+{"Time":"2026-10-17T23:09:59.0345817Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/policy_fixture.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.035827277Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/policy_fixture.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.0359046Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_fixture.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.035924474Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json"}
+{"Time":"2026-10-17T23:09:59.035934032Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/policy_package.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.038119074Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/policy_package.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.038203331Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/policy_package.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.038234865Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json"}
+{"Time":"2026-10-17T23:09:59.038243648Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/protected_system_manifest.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.039841118Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/protected_system_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.040118714Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/protected_system_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.04055292Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json"}
+{"Time":"2026-10-17T23:09:59.040599584Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_request.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.042170379Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_request.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.04223524Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_request.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.042485722Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json"}
+{"Time":"2026-10-17T23:09:59.042532422Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_response.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.044096593Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_response.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.044171121Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_response.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.044248236Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json"}
+{"Time":"2026-10-17T23:09:59.044291916Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/readback_systems.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.045696506Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/readback_systems.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.045747309Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/readback_systems.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.046015071Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json"}
+{"Time":"2026-10-17T23:09:59.046050094Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/relationship_fact.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.047269619Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/relationship_fact.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.047325273Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/relationship_fact.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.047651572Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json"}
+{"Time":"2026-10-17T23:09:59.047683015Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/resource_manifest.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.050058342Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/resource_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.050519078Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/resource_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.05062357Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json"}
+{"Time":"2026-10-17T23:09:59.050652209Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Output":"=== RUN TestSchemaFilesAreJSON/subject_manifest.schema.json\n"}
+{"Time":"2026-10-17T23:09:59.052872912Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Output":"--- PASS: TestSchemaFilesAreJSON/subject_manifest.schema.json (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.052958766Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON/subject_manifest.schema.json","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.053199726Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Output":"--- PASS: TestSchemaFilesAreJSON (0.03s)\n"}
+{"Time":"2026-10-17T23:09:59.053383561Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestSchemaFilesAreJSON","Elapsed":0.03}
+{"Time":"2026-10-17T23:09:59.053418557Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses"}
+{"Time":"2026-10-17T23:09:59.053428196Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Output":"=== RUN TestResourceManifestExampleParses\n"}
+{"Time":"2026-10-17T23:09:59.058492015Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Output":"--- PASS: TestResourceManifestExampleParses (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.058587959Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestExampleParses","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.058606146Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields"}
+{"Time":"2026-10-17T23:09:59.058616029Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Output":"=== RUN TestResourceManifestRequiredFields\n"}
+{"Time":"2026-10-17T23:09:59.059862249Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Output":"--- PASS: TestResourceManifestRequiredFields (0.00s)\n"}
+{"Time":"2026-10-17T23:09:59.059945713Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestResourceManifestRequiredFields","Elapsed":0}
+{"Time":"2026-10-17T23:09:59.060166103Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses"}
+{"Time":"2026-10-17T23:09:59.060202037Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Output":"=== RUN TestMarkitectProtectedSystemNamespaceExampleParses\n"}
+{"Time":"2026-10-17T23:09:59.073332798Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Output":"--- PASS: TestMarkitectProtectedSystemNamespaceExampleParses (0.01s)\n"}
+{"Time":"2026-10-17T23:09:59.073394683Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectProtectedSystemNamespaceExampleParses","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:59.073421717Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses"}
+{"Time":"2026-10-17T23:09:59.073444684Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Output":"=== RUN TestMarkitectNamespaceResourceManifestExampleParses\n"}
+{"Time":"2026-10-17T23:09:59.082667656Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Output":"--- PASS: TestMarkitectNamespaceResourceManifestExampleParses (0.01s)\n"}
+{"Time":"2026-10-17T23:09:59.083199998Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Test":"TestMarkitectNamespaceResourceManifestExampleParses","Elapsed":0.01}
+{"Time":"2026-10-17T23:09:59.083256581Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Output":"PASS\n"}
+{"Time":"2026-10-17T23:09:59.111097109Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Output":"--- PASS: TestRegistryFactsOverrideCallerSuppliedAttributes (0.09s)\n"}
+{"Time":"2026-10-17T23:09:59.111166759Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryFactsOverrideCallerSuppliedAttributes","Elapsed":0.09}
+{"Time":"2026-10-17T23:09:59.111190438Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved"}
+{"Time":"2026-10-17T23:09:59.111200681Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Output":"=== RUN TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved\n"}
+{"Time":"2026-10-17T23:09:59.193743415Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Output":"--- PASS: TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved (0.08s)\n"}
+{"Time":"2026-10-17T23:09:59.193837816Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestRegistryTenantWinsWhileSubjectTypeVocabularyIsPreserved","Elapsed":0.08}
+{"Time":"2026-10-17T23:09:59.193866708Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride"}
+{"Time":"2026-10-17T23:09:59.193886591Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Output":"=== RUN TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride\n"}
+{"Time":"2026-10-17T23:09:59.275171145Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Output":"--- PASS: TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride (0.08s)\n"}
+{"Time":"2026-10-17T23:09:59.275245177Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestUnregisteredResourceKeepsCallerAttributesAndReportsNoOverride","Elapsed":0.08}
+{"Time":"2026-10-17T23:09:59.275264907Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer"}
+{"Time":"2026-10-17T23:09:59.27527304Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Output":"=== RUN TestSubmittedRequestDigestIsComputableByTheConsumer\n"}
+{"Time":"2026-10-17T23:09:59.357821297Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Output":"--- PASS: TestSubmittedRequestDigestIsComputableByTheConsumer (0.08s)\n"}
+{"Time":"2026-10-17T23:09:59.357883192Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSubmittedRequestDigestIsComputableByTheConsumer","Elapsed":0.08}
+{"Time":"2026-10-17T23:09:59.357903553Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope"}
+{"Time":"2026-10-17T23:09:59.357922128Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Output":"=== RUN TestSignerAuthenticatesReturnedAndRecordedEnvelope\n"}
+{"Time":"2026-10-17T23:09:59.484163473Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Output":"--- PASS: TestSignerAuthenticatesReturnedAndRecordedEnvelope (0.12s)\n"}
+{"Time":"2026-10-17T23:09:59.484232671Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerAuthenticatesReturnedAndRecordedEnvelope","Elapsed":0.12}
+{"Time":"2026-10-17T23:09:59.484256287Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration"}
+{"Time":"2026-10-17T23:09:59.484267496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Output":"=== RUN TestSignerRejectsInvalidConfiguration\n"}
+{"Time":"2026-10-17T23:09:59.570634328Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Output":"--- PASS: TestSignerRejectsInvalidConfiguration (0.09s)\n"}
+{"Time":"2026-10-17T23:09:59.5707124Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Test":"TestSignerRejectsInvalidConfiguration","Elapsed":0.09}
+{"Time":"2026-10-17T23:09:59.57190466Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Output":"PASS\n"}
+{"Time":"2026-10-17T23:10:00.091268215Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/api","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/api\t1.187s\n"}
+{"Time":"2026-10-17T23:10:00.091351751Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/api","Elapsed":1.187}
+{"Time":"2026-10-17T23:10:00.098775932Z","Action":"start","Package":"github.com/netkingdom/access-engine/pkg/decisionpep"}
+{"Time":"2026-10-17T23:10:00.140256447Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision"}
+{"Time":"2026-10-17T23:10:00.140321137Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"=== RUN TestAuthenticDecisionProducerCanonicalPrecision\n"}
+{"Time":"2026-10-17T23:10:00.172856363Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Output":"--- PASS: TestAuthenticDecisionProducerCanonicalPrecision (0.03s)\n"}
+{"Time":"2026-10-17T23:10:00.172914019Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestAuthenticDecisionProducerCanonicalPrecision","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:00.173071893Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings"}
+{"Time":"2026-10-17T23:10:00.173125474Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"=== RUN TestDecisionAdverseBindings\n"}
+{"Time":"2026-10-17T23:10:00.176137713Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context"}
+{"Time":"2026-10-17T23:10:00.176192529Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"=== RUN TestDecisionAdverseBindings/context\n"}
+{"Time":"2026-10-17T23:10:00.187815781Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Output":"--- PASS: TestDecisionAdverseBindings/context (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.187952383Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/context","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.18803105Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision"}
+{"Time":"2026-10-17T23:10:00.188059256Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"=== RUN TestDecisionAdverseBindings/stale-decision\n"}
+{"Time":"2026-10-17T23:10:00.20280785Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Output":"--- PASS: TestDecisionAdverseBindings/stale-decision (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.202981269Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/stale-decision","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.203002613Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired"}
+{"Time":"2026-10-17T23:10:00.203012649Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"=== RUN TestDecisionAdverseBindings/expired\n"}
+{"Time":"2026-10-17T23:10:00.216033832Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Output":"--- PASS: TestDecisionAdverseBindings/expired (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.220128674Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/expired","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.220205916Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry"}
+{"Time":"2026-10-17T23:10:00.220221398Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"=== RUN TestDecisionAdverseBindings/subnanosecond-expiry\n"}
+{"Time":"2026-10-17T23:10:00.230585088Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Output":"--- PASS: TestDecisionAdverseBindings/subnanosecond-expiry (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.230653655Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/subnanosecond-expiry","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.230850862Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL"}
+{"Time":"2026-10-17T23:10:00.230882125Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"=== RUN TestDecisionAdverseBindings/excess-TTL\n"}
+{"Time":"2026-10-17T23:10:00.244147381Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Output":"--- PASS: TestDecisionAdverseBindings/excess-TTL (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.244450058Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/excess-TTL","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.244485486Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned"}
+{"Time":"2026-10-17T23:10:00.244495586Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"=== RUN TestDecisionAdverseBindings/unsigned\n"}
+{"Time":"2026-10-17T23:10:00.252964647Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Output":"--- PASS: TestDecisionAdverseBindings/unsigned (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.253037479Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/unsigned","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.253050824Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor"}
+{"Time":"2026-10-17T23:10:00.253057885Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"=== RUN TestDecisionAdverseBindings/actor\n"}
+{"Time":"2026-10-17T23:10:00.268059034Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Output":"--- PASS: TestDecisionAdverseBindings/actor (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.268141163Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/actor","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.268487433Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action"}
+{"Time":"2026-10-17T23:10:00.268531564Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"=== RUN TestDecisionAdverseBindings/action\n"}
+{"Time":"2026-10-17T23:10:00.279401194Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Output":"--- PASS: TestDecisionAdverseBindings/action (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.2794817Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/action","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.279510411Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile"}
+{"Time":"2026-10-17T23:10:00.279525983Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"=== RUN TestDecisionAdverseBindings/legacy-numeric-profile\n"}
+{"Time":"2026-10-17T23:10:00.291060057Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Output":"--- PASS: TestDecisionAdverseBindings/legacy-numeric-profile (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.29114582Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/legacy-numeric-profile","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.291180988Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn"}
+{"Time":"2026-10-17T23:10:00.291195478Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"=== RUN TestDecisionAdverseBindings/caller-warn\n"}
+{"Time":"2026-10-17T23:10:00.303606042Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Output":"--- PASS: TestDecisionAdverseBindings/caller-warn (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.303673103Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-warn","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.30391243Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience"}
+{"Time":"2026-10-17T23:10:00.303935234Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"=== RUN TestDecisionAdverseBindings/caller-audience\n"}
+{"Time":"2026-10-17T23:10:00.323562205Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Output":"--- PASS: TestDecisionAdverseBindings/caller-audience (0.02s)\n"}
+{"Time":"2026-10-17T23:10:00.323638689Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-audience","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:00.323882435Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation"}
+{"Time":"2026-10-17T23:10:00.323904608Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"=== RUN TestDecisionAdverseBindings/obligation\n"}
+{"Time":"2026-10-17T23:10:00.339048864Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Output":"--- PASS: TestDecisionAdverseBindings/obligation (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.339127611Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/obligation","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.339154843Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator"}
+{"Time":"2026-10-17T23:10:00.33916432Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"=== RUN TestDecisionAdverseBindings/evaluator\n"}
+{"Time":"2026-10-17T23:10:00.35294132Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Output":"--- PASS: TestDecisionAdverseBindings/evaluator (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.353044126Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/evaluator","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.35307657Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy"}
+{"Time":"2026-10-17T23:10:00.353098184Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"=== RUN TestDecisionAdverseBindings/policy\n"}
+{"Time":"2026-10-17T23:10:00.370993196Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Output":"--- PASS: TestDecisionAdverseBindings/policy (0.02s)\n"}
+{"Time":"2026-10-17T23:10:00.371070113Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:00.375223624Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry"}
+{"Time":"2026-10-17T23:10:00.375312931Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"=== RUN TestDecisionAdverseBindings/registry\n"}
+{"Time":"2026-10-17T23:10:00.383567577Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Output":"--- PASS: TestDecisionAdverseBindings/registry (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.383891052Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/registry","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.383924434Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant"}
+{"Time":"2026-10-17T23:10:00.383935156Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"=== RUN TestDecisionAdverseBindings/tenant\n"}
+{"Time":"2026-10-17T23:10:00.39693766Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Output":"--- PASS: TestDecisionAdverseBindings/tenant (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.397032107Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/tenant","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.397227394Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource"}
+{"Time":"2026-10-17T23:10:00.397253237Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"=== RUN TestDecisionAdverseBindings/resource\n"}
+{"Time":"2026-10-17T23:10:00.412829182Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Output":"--- PASS: TestDecisionAdverseBindings/resource (0.02s)\n"}
+{"Time":"2026-10-17T23:10:00.412910995Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/resource","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:00.412985559Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose"}
+{"Time":"2026-10-17T23:10:00.413000492Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"=== RUN TestDecisionAdverseBindings/purpose\n"}
+{"Time":"2026-10-17T23:10:00.426003733Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Output":"--- PASS: TestDecisionAdverseBindings/purpose (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.426097287Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/purpose","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.426117837Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted"}
+{"Time":"2026-10-17T23:10:00.426127287Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"=== RUN TestDecisionAdverseBindings/submitted\n"}
+{"Time":"2026-10-17T23:10:00.439334021Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Output":"--- PASS: TestDecisionAdverseBindings/submitted (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.439867301Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/submitted","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.439914191Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal"}
+{"Time":"2026-10-17T23:10:00.439925778Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"=== RUN TestDecisionAdverseBindings/caller-principal\n"}
+{"Time":"2026-10-17T23:10:00.454841308Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Output":"--- PASS: TestDecisionAdverseBindings/caller-principal (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.454916314Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-principal","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.454951292Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest"}
+{"Time":"2026-10-17T23:10:00.454966134Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"=== RUN TestDecisionAdverseBindings/policy-digest\n"}
+{"Time":"2026-10-17T23:10:00.472188125Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Output":"--- PASS: TestDecisionAdverseBindings/policy-digest (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.4722713Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/policy-digest","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.472291066Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired"}
+{"Time":"2026-10-17T23:10:00.472312337Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"=== RUN TestDecisionAdverseBindings/caller-expired\n"}
+{"Time":"2026-10-17T23:10:00.484963049Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Output":"--- PASS: TestDecisionAdverseBindings/caller-expired (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.485021661Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/caller-expired","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.485037874Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin"}
+{"Time":"2026-10-17T23:10:00.48504544Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"=== RUN TestDecisionAdverseBindings/future-begin\n"}
+{"Time":"2026-10-17T23:10:00.498381624Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Output":"--- PASS: TestDecisionAdverseBindings/future-begin (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.498476242Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/future-begin","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.498497874Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL"}
+{"Time":"2026-10-17T23:10:00.498508497Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"=== RUN TestDecisionAdverseBindings/missing-TTL\n"}
+{"Time":"2026-10-17T23:10:00.514478083Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Output":"--- PASS: TestDecisionAdverseBindings/missing-TTL (0.02s)\n"}
+{"Time":"2026-10-17T23:10:00.514556876Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/missing-TTL","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:00.514575127Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect"}
+{"Time":"2026-10-17T23:10:00.514584541Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"=== RUN TestDecisionAdverseBindings/effect\n"}
+{"Time":"2026-10-17T23:10:00.528701774Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Output":"--- PASS: TestDecisionAdverseBindings/effect (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.528779061Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/effect","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.529043122Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version"}
+{"Time":"2026-10-17T23:10:00.529084665Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"=== RUN TestDecisionAdverseBindings/version\n"}
+{"Time":"2026-10-17T23:10:00.542868648Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Output":"--- PASS: TestDecisionAdverseBindings/version (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.542945376Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings/version","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.542972067Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Output":"--- PASS: TestDecisionAdverseBindings (0.37s)\n"}
+{"Time":"2026-10-17T23:10:00.5432218Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestDecisionAdverseBindings","Elapsed":0.37}
+{"Time":"2026-10-17T23:10:00.543257796Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay"}
+{"Time":"2026-10-17T23:10:00.543268996Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"=== RUN TestSignatureForgeryAndReplay\n"}
+{"Time":"2026-10-17T23:10:00.543555978Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload"}
+{"Time":"2026-10-17T23:10:00.543585591Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"=== RUN TestSignatureForgeryAndReplay/forged-payload\n"}
+{"Time":"2026-10-17T23:10:00.559086833Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Output":"--- PASS: TestSignatureForgeryAndReplay/forged-payload (0.02s)\n"}
+{"Time":"2026-10-17T23:10:00.559181108Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/forged-payload","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:00.559202497Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key"}
+{"Time":"2026-10-17T23:10:00.559211938Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"=== RUN TestSignatureForgeryAndReplay/wrong-key\n"}
+{"Time":"2026-10-17T23:10:00.574584936Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Output":"--- PASS: TestSignatureForgeryAndReplay/wrong-key (0.02s)\n"}
+{"Time":"2026-10-17T23:10:00.574671033Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/wrong-key","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:00.574688364Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay"}
+{"Time":"2026-10-17T23:10:00.574694902Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"=== RUN TestSignatureForgeryAndReplay/replay\n"}
+{"Time":"2026-10-17T23:10:00.589210633Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/decision","Output":"ok \tgithub.com/netkingdom/access-engine/internal/decision\t9.748s\n"}
+{"Time":"2026-10-17T23:10:00.589282284Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/decision","Elapsed":9.749}
+{"Time":"2026-10-17T23:10:00.59328708Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Output":"--- PASS: TestSignatureForgeryAndReplay/replay (0.02s)\n"}
+{"Time":"2026-10-17T23:10:00.593347261Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay/replay","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:00.593522683Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Output":"--- PASS: TestSignatureForgeryAndReplay (0.05s)\n"}
+{"Time":"2026-10-17T23:10:00.593680494Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestSignatureForgeryAndReplay","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:00.593748393Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse"}
+{"Time":"2026-10-17T23:10:00.593764165Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"=== RUN TestUnavailableAndPublicTokenFileRefuse\n"}
+{"Time":"2026-10-17T23:10:00.601382383Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Output":"--- PASS: TestUnavailableAndPublicTokenFileRefuse (0.01s)\n"}
+{"Time":"2026-10-17T23:10:00.601451031Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestUnavailableAndPublicTokenFileRefuse","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:00.601603973Z","Action":"run","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource"}
+{"Time":"2026-10-17T23:10:00.601631791Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource","Output":"=== RUN TestConsumerExportMatchesProducerSource\n"}
+{"Time":"2026-10-17T23:10:00.601784527Z","Action":"start","Package":"github.com/netkingdom/access-engine/testsupport/signfixture"}
+{"Time":"2026-10-17T23:10:00.60184386Z","Action":"output","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Output":"? \tgithub.com/netkingdom/access-engine/testsupport/signfixture\t[no test files]\n"}
+{"Time":"2026-10-17T23:10:00.601863382Z","Action":"skip","Package":"github.com/netkingdom/access-engine/testsupport/signfixture","Elapsed":0}
+{"Time":"2026-10-17T23:10:00.601996955Z","Action":"start","Package":"github.com/netkingdom/access-engine/tools"}
+{"Time":"2026-10-17T23:10:00.602017136Z","Action":"output","Package":"github.com/netkingdom/access-engine/tools","Output":"? \tgithub.com/netkingdom/access-engine/tools\t[no test files]\n"}
+{"Time":"2026-10-17T23:10:00.602031058Z","Action":"skip","Package":"github.com/netkingdom/access-engine/tools","Elapsed":0}
+{"Time":"2026-10-17T23:10:00.721078801Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource","Output":"--- PASS: TestConsumerExportMatchesProducerSource (0.12s)\n"}
+{"Time":"2026-10-17T23:10:00.721147937Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Test":"TestConsumerExportMatchesProducerSource","Elapsed":0.12}
+{"Time":"2026-10-17T23:10:00.721221003Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"PASS\n"}
+{"Time":"2026-10-17T23:10:01.730341045Z","Action":"output","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Output":"ok \tgithub.com/netkingdom/access-engine/pkg/decisionpep\t1.631s\n"}
+{"Time":"2026-10-17T23:10:01.730436204Z","Action":"pass","Package":"github.com/netkingdom/access-engine/pkg/decisionpep","Elapsed":1.6320000000000001}
+{"Time":"2026-10-17T23:10:01.823450853Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":" runtime_rename_test.go:106: 10 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:01.823533469Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden (2.84s)\n"}
+{"Time":"2026-10-17T23:10:01.823557608Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden","Elapsed":2.84}
+{"Time":"2026-10-17T23:10:01.823769667Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch"}
+{"Time":"2026-10-17T23:10:01.823789839Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch\n"}
+{"Time":"2026-10-17T23:10:02.679357911Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Output":"--- PASS: TestInformedDecisionAttributeAdmission (8.89s)\n"}
+{"Time":"2026-10-17T23:10:02.679409535Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionAttributeAdmission","Elapsed":8.89}
+{"Time":"2026-10-17T23:10:02.679502241Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild"}
+{"Time":"2026-10-17T23:10:02.679513928Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Output":"=== RUN TestSittingImagePinMatchesRecordedBuild\n"}
+{"Time":"2026-10-17T23:10:02.679897152Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Output":"--- PASS: TestSittingImagePinMatchesRecordedBuild (0.00s)\n"}
+{"Time":"2026-10-17T23:10:02.679947053Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestSittingImagePinMatchesRecordedBuild","Elapsed":0}
+{"Time":"2026-10-17T23:10:02.680030544Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator"}
+{"Time":"2026-10-17T23:10:02.680058714Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":"=== RUN TestAdmissionSetGenerator\n"}
+{"Time":"2026-10-17T23:10:03.253033158Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Output":"--- PASS: TestAdmissionSetGenerator (0.57s)\n"}
+{"Time":"2026-10-17T23:10:03.253116558Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestAdmissionSetGenerator","Elapsed":0.57}
+{"Time":"2026-10-17T23:10:03.253140256Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle"}
+{"Time":"2026-10-17T23:10:03.253148317Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Output":"=== RUN TestInformedDecisionLifecycle\n"}
+{"Time":"2026-10-17T23:10:03.475294032Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access"}
+{"Time":"2026-10-17T23:10:03.475360814Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Output":"=== RUN TestInformedDecisionLifecycle/readback_application_access\n"}
+{"Time":"2026-10-17T23:10:03.520927164Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Output":"--- PASS: TestInformedDecisionLifecycle/readback_application_access (0.05s)\n"}
+{"Time":"2026-10-17T23:10:03.520995587Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/readback_application_access","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:03.52101161Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose"}
+{"Time":"2026-10-17T23:10:03.521018364Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Output":"=== RUN TestInformedDecisionLifecycle/application_access_without_readback_purpose\n"}
+{"Time":"2026-10-17T23:10:03.567736228Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_without_readback_purpose (0.05s)\n"}
+{"Time":"2026-10-17T23:10:03.567792739Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_readback_purpose","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:03.56788568Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access"}
+{"Time":"2026-10-17T23:10:03.56790219Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Output":"=== RUN TestInformedDecisionLifecycle/workload_application_access\n"}
+{"Time":"2026-10-17T23:10:03.611263967Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Output":"--- PASS: TestInformedDecisionLifecycle/workload_application_access (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.611342777Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_application_access","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.611364049Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group"}
+{"Time":"2026-10-17T23:10:03.611373788Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Output":"=== RUN TestInformedDecisionLifecycle/application_access_outside_group\n"}
+{"Time":"2026-10-17T23:10:03.653523764Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_outside_group (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.653574991Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_outside_group","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.653589644Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA"}
+{"Time":"2026-10-17T23:10:03.653594621Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Output":"=== RUN TestInformedDecisionLifecycle/application_access_stale_MFA\n"}
+{"Time":"2026-10-17T23:10:03.693302588Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_stale_MFA (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.69337661Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_stale_MFA","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.693393211Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp"}
+{"Time":"2026-10-17T23:10:03.6934012Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Output":"=== RUN TestInformedDecisionLifecycle/application_access_without_otp\n"}
+{"Time":"2026-10-17T23:10:03.73496375Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_without_otp (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.735029053Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_without_otp","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.735051578Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application"}
+{"Time":"2026-10-17T23:10:03.735065834Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Output":"=== RUN TestInformedDecisionLifecycle/application_access_other_application\n"}
+{"Time":"2026-10-17T23:10:03.774021146Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_other_application (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.774090471Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_other_application","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.774136035Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant"}
+{"Time":"2026-10-17T23:10:03.774147766Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Output":"=== RUN TestInformedDecisionLifecycle/application_access_foreign_tenant\n"}
+{"Time":"2026-10-17T23:10:03.807232254Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Output":"--- PASS: TestInformedDecisionLifecycle/application_access_foreign_tenant (0.03s)\n"}
+{"Time":"2026-10-17T23:10:03.807282886Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/application_access_foreign_tenant","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:03.807296412Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration"}
+{"Time":"2026-10-17T23:10:03.807302896Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Output":"=== RUN TestInformedDecisionLifecycle/human_registration\n"}
+{"Time":"2026-10-17T23:10:03.856084226Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Output":"--- PASS: TestInformedDecisionLifecycle/human_registration (0.05s)\n"}
+{"Time":"2026-10-17T23:10:03.856161152Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_registration","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:03.856184434Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration"}
+{"Time":"2026-10-17T23:10:03.856193677Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Output":"=== RUN TestInformedDecisionLifecycle/workload_registration\n"}
+{"Time":"2026-10-17T23:10:03.897876289Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Output":"--- PASS: TestInformedDecisionLifecycle/workload_registration (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.8979451Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/workload_registration","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.897965659Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload"}
+{"Time":"2026-10-17T23:10:03.897976417Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Output":"=== RUN TestInformedDecisionLifecycle/foreign_workload\n"}
+{"Time":"2026-10-17T23:10:03.937241758Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Output":"--- PASS: TestInformedDecisionLifecycle/foreign_workload (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.937311462Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_workload","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.937335096Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience"}
+{"Time":"2026-10-17T23:10:03.937343148Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Output":"=== RUN TestInformedDecisionLifecycle/wrong_workload_audience\n"}
+{"Time":"2026-10-17T23:10:03.978591579Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_workload_audience (0.04s)\n"}
+{"Time":"2026-10-17T23:10:03.978647847Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_workload_audience","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:03.978851212Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID"}
+{"Time":"2026-10-17T23:10:03.978872258Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Output":"=== RUN TestInformedDecisionLifecycle/missing_workload_UID\n"}
+{"Time":"2026-10-17T23:10:04.019068376Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Output":"--- PASS: TestInformedDecisionLifecycle/missing_workload_UID (0.04s)\n"}
+{"Time":"2026-10-17T23:10:04.019140298Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/missing_workload_UID","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:04.019155284Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant"}
+{"Time":"2026-10-17T23:10:04.019161569Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Output":"=== RUN TestInformedDecisionLifecycle/wrong_tenant\n"}
+{"Time":"2026-10-17T23:10:04.076755778Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_tenant (0.06s)\n"}
+{"Time":"2026-10-17T23:10:04.076821631Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_tenant","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:04.077049371Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group"}
+{"Time":"2026-10-17T23:10:04.077075882Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Output":"=== RUN TestInformedDecisionLifecycle/outside_human_group\n"}
+{"Time":"2026-10-17T23:10:04.134220243Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Output":"--- PASS: TestInformedDecisionLifecycle/outside_human_group (0.06s)\n"}
+{"Time":"2026-10-17T23:10:04.134296222Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/outside_human_group","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:04.134318964Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA"}
+{"Time":"2026-10-17T23:10:04.134329333Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Output":"=== RUN TestInformedDecisionLifecycle/stale_author_MFA\n"}
+{"Time":"2026-10-17T23:10:04.205710476Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/stale_author_MFA (0.07s)\n"}
+{"Time":"2026-10-17T23:10:04.205776185Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/stale_author_MFA","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:04.205795996Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA"}
+{"Time":"2026-10-17T23:10:04.205882751Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Output":"=== RUN TestInformedDecisionLifecycle/future_author_MFA\n"}
+{"Time":"2026-10-17T23:10:04.272141864Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Output":"--- PASS: TestInformedDecisionLifecycle/future_author_MFA (0.07s)\n"}
+{"Time":"2026-10-17T23:10:04.272216048Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/future_author_MFA","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:04.272234904Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity"}
+{"Time":"2026-10-17T23:10:04.272244922Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Output":"=== RUN TestInformedDecisionLifecycle/asserted_identity\n"}
+{"Time":"2026-10-17T23:10:04.341483328Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":" runtime_rename_test.go:106: 14 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:04.341567062Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch (2.52s)\n"}
+{"Time":"2026-10-17T23:10:04.341582283Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/ops-warden-fetch","Elapsed":2.52}
+{"Time":"2026-10-17T23:10:04.341698407Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine"}
+{"Time":"2026-10-17T23:10:04.341721662Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine\n"}
+{"Time":"2026-10-17T23:10:04.343051337Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Output":"--- PASS: TestInformedDecisionLifecycle/asserted_identity (0.07s)\n"}
+{"Time":"2026-10-17T23:10:04.343104899Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/asserted_identity","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:04.343116568Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read"}
+{"Time":"2026-10-17T23:10:04.343123899Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Output":"=== RUN TestInformedDecisionLifecycle/owner_read\n"}
+{"Time":"2026-10-17T23:10:04.415650065Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Output":"--- PASS: TestInformedDecisionLifecycle/owner_read (0.07s)\n"}
+{"Time":"2026-10-17T23:10:04.415723997Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/owner_read","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:04.415802564Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read"}
+{"Time":"2026-10-17T23:10:04.415820202Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Output":"=== RUN TestInformedDecisionLifecycle/foreign_unpublished_read\n"}
+{"Time":"2026-10-17T23:10:04.490308123Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Output":"--- PASS: TestInformedDecisionLifecycle/foreign_unpublished_read (0.07s)\n"}
+{"Time":"2026-10-17T23:10:04.490386861Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/foreign_unpublished_read","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:04.492129413Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator"}
+{"Time":"2026-10-17T23:10:04.492185428Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Output":"=== RUN TestInformedDecisionLifecycle/published_collaborator\n"}
+{"Time":"2026-10-17T23:10:04.562654593Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Output":"--- PASS: TestInformedDecisionLifecycle/published_collaborator (0.07s)\n"}
+{"Time":"2026-10-17T23:10:04.562744711Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/published_collaborator","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:04.562800879Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor"}
+{"Time":"2026-10-17T23:10:04.562819689Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Output":"=== RUN TestInformedDecisionLifecycle/new_revision_editor\n"}
+{"Time":"2026-10-17T23:10:04.632510415Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Output":"--- PASS: TestInformedDecisionLifecycle/new_revision_editor (0.07s)\n"}
+{"Time":"2026-10-17T23:10:04.632633067Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/new_revision_editor","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:04.632665926Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action"}
+{"Time":"2026-10-17T23:10:04.632676278Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Output":"=== RUN TestInformedDecisionLifecycle/unknown_action\n"}
+{"Time":"2026-10-17T23:10:04.683136844Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Output":"--- PASS: TestInformedDecisionLifecycle/unknown_action (0.05s)\n"}
+{"Time":"2026-10-17T23:10:04.683198252Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/unknown_action","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:04.68321276Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance"}
+{"Time":"2026-10-17T23:10:04.683221778Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Output":"=== RUN TestInformedDecisionLifecycle/agent_acceptance\n"}
+{"Time":"2026-10-17T23:10:04.739672906Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Output":"--- PASS: TestInformedDecisionLifecycle/agent_acceptance (0.06s)\n"}
+{"Time":"2026-10-17T23:10:04.739743529Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/agent_acceptance","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:04.739802917Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded"}
+{"Time":"2026-10-17T23:10:04.739813683Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Output":"=== RUN TestInformedDecisionLifecycle/human_acceptance_excluded\n"}
+{"Time":"2026-10-17T23:10:04.791623812Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Output":"--- PASS: TestInformedDecisionLifecycle/human_acceptance_excluded (0.05s)\n"}
+{"Time":"2026-10-17T23:10:04.791684102Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/human_acceptance_excluded","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:04.791708322Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group"}
+{"Time":"2026-10-17T23:10:04.791716329Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Output":"=== RUN TestInformedDecisionLifecycle/publish_initial_group\n"}
+{"Time":"2026-10-17T23:10:04.850141958Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Output":"--- PASS: TestInformedDecisionLifecycle/publish_initial_group (0.06s)\n"}
+{"Time":"2026-10-17T23:10:04.850227243Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_initial_group","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:04.85024993Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group"}
+{"Time":"2026-10-17T23:10:04.850256973Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Output":"=== RUN TestInformedDecisionLifecycle/publish_other_group\n"}
+{"Time":"2026-10-17T23:10:04.911336743Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Output":"--- PASS: TestInformedDecisionLifecycle/publish_other_group (0.06s)\n"}
+{"Time":"2026-10-17T23:10:04.911402695Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/publish_other_group","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:04.911428773Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing"}
+{"Time":"2026-10-17T23:10:04.911445383Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Output":"=== RUN TestInformedDecisionLifecycle/review_routing\n"}
+{"Time":"2026-10-17T23:10:04.97054601Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Output":"--- PASS: TestInformedDecisionLifecycle/review_routing (0.06s)\n"}
+{"Time":"2026-10-17T23:10:04.970599798Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/review_routing","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:04.970613487Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing"}
+{"Time":"2026-10-17T23:10:04.970619438Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Output":"=== RUN TestInformedDecisionLifecycle/wrong_review_routing\n"}
+{"Time":"2026-10-17T23:10:05.014744173Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Output":"--- PASS: TestInformedDecisionLifecycle/wrong_review_routing (0.04s)\n"}
+{"Time":"2026-10-17T23:10:05.014809331Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle/wrong_review_routing","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:05.014826843Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Output":"--- PASS: TestInformedDecisionLifecycle (1.76s)\n"}
+{"Time":"2026-10-17T23:10:05.014837411Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycle","Elapsed":1.76}
+{"Time":"2026-10-17T23:10:05.014851748Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins"}
+{"Time":"2026-10-17T23:10:05.01486018Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Output":"=== RUN TestInformedDecisionLifecycleReleasePins\n"}
+{"Time":"2026-10-17T23:10:10.540669285Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":" runtime_rename_test.go:106: 31 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:10.540752993Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine (6.20s)\n"}
+{"Time":"2026-10-17T23:10:10.540837187Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/secrets-engine","Elapsed":6.2}
+{"Time":"2026-10-17T23:10:10.540856989Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine"}
+{"Time":"2026-10-17T23:10:10.540865925Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine\n"}
+{"Time":"2026-10-17T23:10:11.920555396Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":" runtime_rename_test.go:106: 8 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:11.920652584Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine (1.38s)\n"}
+{"Time":"2026-10-17T23:10:11.920751972Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/user-engine","Elapsed":1.38}
+{"Time":"2026-10-17T23:10:11.920829845Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine"}
+{"Time":"2026-10-17T23:10:11.920841405Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine\n"}
+{"Time":"2026-10-17T23:10:14.754405124Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Output":"--- PASS: TestInformedDecisionLifecycleReleasePins (9.74s)\n"}
+{"Time":"2026-10-17T23:10:14.754468389Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestInformedDecisionLifecycleReleasePins","Elapsed":9.74}
+{"Time":"2026-10-17T23:10:14.754481446Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs"}
+{"Time":"2026-10-17T23:10:14.754486496Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Output":"=== RUN TestT03ReviewActs\n"}
+{"Time":"2026-10-17T23:10:27.502503289Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":" runtime_rename_test.go:106: 41 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:27.502666213Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine (12.00s)\n"}
+{"Time":"2026-10-17T23:10:27.502705348Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/tenant-engine","Elapsed":12}
+{"Time":"2026-10-17T23:10:27.502906883Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle"}
+{"Time":"2026-10-17T23:10:27.502942547Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle\n"}
+{"Time":"2026-10-17T23:10:28.205221381Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":" runtime_rename_test.go:106: 2 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:28.205360725Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle (0.70s)\n"}
+{"Time":"2026-10-17T23:10:28.205388805Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-lifecycle","Elapsed":0.7}
+{"Time":"2026-10-17T23:10:28.205406217Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting"}
+{"Time":"2026-10-17T23:10:28.20541802Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting\n"}
+{"Time":"2026-10-17T23:10:32.53795154Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Output":"--- PASS: TestT03ReviewActs (14.20s)\n"}
+{"Time":"2026-10-17T23:10:32.538050333Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestT03ReviewActs","Elapsed":14.2}
+{"Time":"2026-10-17T23:10:32.538072533Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords"}
+{"Time":"2026-10-17T23:10:32.538083111Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Output":"=== RUN TestWP0094ExactRecords\n"}
+{"Time":"2026-10-17T23:10:41.554495187Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":" runtime_rename_test.go:106: 4 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:41.554605927Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting (13.35s)\n"}
+{"Time":"2026-10-17T23:10:41.554623926Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-sitting","Elapsed":13.35}
+{"Time":"2026-10-17T23:10:41.554807812Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03"}
+{"Time":"2026-10-17T23:10:41.554846406Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":"=== RUN TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03\n"}
+{"Time":"2026-10-17T23:10:41.674303338Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Output":"--- PASS: TestWP0094ExactRecords (9.14s)\n"}
+{"Time":"2026-10-17T23:10:41.674367306Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestWP0094ExactRecords","Elapsed":9.14}
+{"Time":"2026-10-17T23:10:41.674384213Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T23:10:41.674395819Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Output":"=== RUN TestLoadPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T23:10:41.725178899Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":" runtime_rename_test.go:106: 1 owner-installed package fixtures preserved with both audiences\n"}
+{"Time":"2026-10-17T23:10:41.725257971Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03 (0.17s)\n"}
+{"Time":"2026-10-17T23:10:41.725648373Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial/informed-decision-t03","Elapsed":0.17}
+{"Time":"2026-10-17T23:10:41.725744876Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Output":"--- PASS: TestRuntimeRenamePinPackagesPreserveDecisionMaterial (39.16s)\n"}
+{"Time":"2026-10-17T23:10:41.725828511Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenamePinPackagesPreserveDecisionMaterial","Elapsed":39.16}
+{"Time":"2026-10-17T23:10:41.725898376Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary"}
+{"Time":"2026-10-17T23:10:41.725912723Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Output":"=== RUN TestRuntimeRenameReadbackRoutesPreserveCallerBoundary\n"}
+{"Time":"2026-10-17T23:10:41.733114326Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Output":"--- PASS: TestLoadPolicyPackageMarkdownValidates (0.06s)\n"}
+{"Time":"2026-10-17T23:10:41.733188033Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestLoadPolicyPackageMarkdownValidates","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:41.733199827Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T23:10:41.733206608Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Output":"=== RUN TestRedactPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T23:10:41.768401927Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Output":"--- PASS: TestRedactPolicyPackageMarkdownValidates (0.03s)\n"}
+{"Time":"2026-10-17T23:10:41.7684798Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestRedactPolicyPackageMarkdownValidates","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:41.768498069Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates"}
+{"Time":"2026-10-17T23:10:41.768506626Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Output":"=== RUN TestOpsWardenPolicyPackageMarkdownValidates\n"}
+{"Time":"2026-10-17T23:10:41.993926428Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Output":"--- PASS: TestRuntimeRenameReadbackRoutesPreserveCallerBoundary (0.27s)\n"}
+{"Time":"2026-10-17T23:10:41.993980081Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestRuntimeRenameReadbackRoutesPreserveCallerBoundary","Elapsed":0.27}
+{"Time":"2026-10-17T23:10:41.994001713Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny"}
+{"Time":"2026-10-17T23:10:41.994008656Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny\n"}
+{"Time":"2026-10-17T23:10:42.241215338Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign"}
+{"Time":"2026-10-17T23:10:42.241279306Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign\n"}
+{"Time":"2026-10-17T23:10:42.249125139Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign (0.01s)\n"}
+{"Time":"2026-10-17T23:10:42.249184797Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/foreign","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:42.249200739Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience"}
+{"Time":"2026-10-17T23:10:42.249207205Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience\n"}
+{"Time":"2026-10-17T23:10:42.255321179Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience (0.01s)\n"}
+{"Time":"2026-10-17T23:10:42.255404156Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/alternate-audience","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:42.255418484Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience"}
+{"Time":"2026-10-17T23:10:42.255424805Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience\n"}
+{"Time":"2026-10-17T23:10:42.26111501Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience (0.01s)\n"}
+{"Time":"2026-10-17T23:10:42.261174812Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/wrong-audience","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:42.261193992Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired"}
+{"Time":"2026-10-17T23:10:42.261202567Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired\n"}
+{"Time":"2026-10-17T23:10:42.267540886Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired (0.01s)\n"}
+{"Time":"2026-10-17T23:10:42.267610463Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/expired","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:42.267634242Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry"}
+{"Time":"2026-10-17T23:10:42.267643115Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry\n"}
+{"Time":"2026-10-17T23:10:42.274495138Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry (0.01s)\n"}
+{"Time":"2026-10-17T23:10:42.274615419Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/no-expiry","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:42.274642074Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated"}
+{"Time":"2026-10-17T23:10:42.274651993Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Output":"=== RUN TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated\n"}
+{"Time":"2026-10-17T23:10:42.280273534Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated (0.01s)\n"}
+{"Time":"2026-10-17T23:10:42.280326285Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny/unauthenticated","Elapsed":0.01}
+{"Time":"2026-10-17T23:10:42.597538488Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Output":"--- PASS: TestOpsWardenPolicyPackageMarkdownValidates (0.83s)\n"}
+{"Time":"2026-10-17T23:10:42.597898515Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenPolicyPackageMarkdownValidates","Elapsed":0.83}
+{"Time":"2026-10-17T23:10:42.598025685Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced"}
+{"Time":"2026-10-17T23:10:42.59804619Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Output":"=== RUN TestCaringFindingsAreAdvisoryUntilEnforced\n"}
+{"Time":"2026-10-17T23:10:42.62303932Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Output":"--- PASS: TestCaringFindingsAreAdvisoryUntilEnforced (0.02s)\n"}
+{"Time":"2026-10-17T23:10:42.62309198Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestCaringFindingsAreAdvisoryUntilEnforced","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:42.623190323Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead"}
+{"Time":"2026-10-17T23:10:42.623202306Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Output":"=== RUN TestValidateFlagsUndeclaredAttributeRead\n"}
+{"Time":"2026-10-17T23:10:42.645733352Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Output":"--- PASS: TestValidateFlagsUndeclaredAttributeRead (0.02s)\n"}
+{"Time":"2026-10-17T23:10:42.646296071Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestValidateFlagsUndeclaredAttributeRead","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:42.646361239Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared"}
+{"Time":"2026-10-17T23:10:42.646378272Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Output":"=== RUN TestOpsWardenAttributeReadsAreDeclared\n"}
+{"Time":"2026-10-17T23:10:42.663100303Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Output":"--- PASS: TestServicePilotRealHTTPAndTokenReviewSignedDeny (0.67s)\n"}
+{"Time":"2026-10-17T23:10:42.663155164Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotRealHTTPAndTokenReviewSignedDeny","Elapsed":0.67}
+{"Time":"2026-10-17T23:10:42.663167932Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse"}
+{"Time":"2026-10-17T23:10:42.663174704Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Output":"=== RUN TestServicePilotGenericEngineAndCLIBypassesRefuse\n"}
+{"Time":"2026-10-17T23:10:42.943318724Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Output":"--- PASS: TestServicePilotGenericEngineAndCLIBypassesRefuse (0.28s)\n"}
+{"Time":"2026-10-17T23:10:42.943375794Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotGenericEngineAndCLIBypassesRefuse","Elapsed":0.28}
+{"Time":"2026-10-17T23:10:42.943416813Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass"}
+{"Time":"2026-10-17T23:10:42.943428148Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Output":"=== RUN TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass\n"}
+{"Time":"2026-10-17T23:10:43.112083365Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Output":"--- PASS: TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass (0.17s)\n"}
+{"Time":"2026-10-17T23:10:43.112153808Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotSeparatelyNamedSyntheticAllowCannotBypass","Elapsed":0.17}
+{"Time":"2026-10-17T23:10:43.112171482Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord"}
+{"Time":"2026-10-17T23:10:43.11218003Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord\n"}
+{"Time":"2026-10-17T23:10:43.112717125Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned"}
+{"Time":"2026-10-17T23:10:43.112753735Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned\n"}
+{"Time":"2026-10-17T23:10:43.33315036Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned (0.22s)\n"}
+{"Time":"2026-10-17T23:10:43.333222398Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/unsigned","Elapsed":0.22}
+{"Time":"2026-10-17T23:10:43.333246898Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow"}
+{"Time":"2026-10-17T23:10:43.333256934Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Output":"=== RUN TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow\n"}
+{"Time":"2026-10-17T23:10:43.44800479Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Output":"--- PASS: TestOpsWardenAttributeReadsAreDeclared (0.80s)\n"}
+{"Time":"2026-10-17T23:10:43.448062825Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestOpsWardenAttributeReadsAreDeclared","Elapsed":0.8}
+{"Time":"2026-10-17T23:10:43.44807379Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage"}
+{"Time":"2026-10-17T23:10:43.448083763Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Output":"=== RUN TestFixtureMismatchInvalidatesPackage\n"}
+{"Time":"2026-10-17T23:10:43.463897302Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Output":"--- PASS: TestFixtureMismatchInvalidatesPackage (0.02s)\n"}
+{"Time":"2026-10-17T23:10:43.463950576Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestFixtureMismatchInvalidatesPackage","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:43.46405964Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses"}
+{"Time":"2026-10-17T23:10:43.464070929Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Output":"=== RUN TestPolicyPackageMetadataParses\n"}
+{"Time":"2026-10-17T23:10:43.465646639Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Output":"--- PASS: TestPolicyPackageMetadataParses (0.00s)\n"}
+{"Time":"2026-10-17T23:10:43.465693592Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyPackageMetadataParses","Elapsed":0}
+{"Time":"2026-10-17T23:10:43.465703214Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses"}
+{"Time":"2026-10-17T23:10:43.465708561Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Output":"=== RUN TestPolicyFixtureParses\n"}
+{"Time":"2026-10-17T23:10:43.468151388Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Output":"--- PASS: TestPolicyFixtureParses (0.00s)\n"}
+{"Time":"2026-10-17T23:10:43.46821936Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestPolicyFixtureParses","Elapsed":0}
+{"Time":"2026-10-17T23:10:43.468250208Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal"}
+{"Time":"2026-10-17T23:10:43.46826422Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Output":"=== RUN TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal\n"}
+{"Time":"2026-10-17T23:10:43.475953933Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow (0.14s)\n"}
+{"Time":"2026-10-17T23:10:43.476005331Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord/accidental-allow","Elapsed":0.14}
+{"Time":"2026-10-17T23:10:43.476019434Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Output":"--- PASS: TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord (0.36s)\n"}
+{"Time":"2026-10-17T23:10:43.476232438Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotWithholdsUnsignedOrAccidentalAllowBeforeRecord","Elapsed":0.36}
+{"Time":"2026-10-17T23:10:43.476266614Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI"}
+{"Time":"2026-10-17T23:10:43.476280221Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Output":"=== RUN TestServicePilotChildCLI\n"}
+{"Time":"2026-10-17T23:10:43.47648273Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Output":"--- PASS: TestServicePilotChildCLI (0.00s)\n"}
+{"Time":"2026-10-17T23:10:43.476502063Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestServicePilotChildCLI","Elapsed":0}
+{"Time":"2026-10-17T23:10:43.476528042Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals"}
+{"Time":"2026-10-17T23:10:43.476561379Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals\n"}
+{"Time":"2026-10-17T23:10:43.820687492Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T23:10:43.829659881Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect"}
+{"Time":"2026-10-17T23:10:43.829726608Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/redirect\n"}
+{"Time":"2026-10-17T23:10:43.846673731Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/redirect (0.02s)\n"}
+{"Time":"2026-10-17T23:10:43.846734435Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:43.846749161Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate"}
+{"Time":"2026-10-17T23:10:43.846755455Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T23:10:43.882473219Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate (0.04s)\n"}
+{"Time":"2026-10-17T23:10:43.882540659Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Elapsed":0.04}
+{"Time":"2026-10-17T23:10:43.882612779Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed"}
+{"Time":"2026-10-17T23:10:43.882628145Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/changed\n"}
+{"Time":"2026-10-17T23:10:43.903864836Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/changed (0.02s)\n"}
+{"Time":"2026-10-17T23:10:43.903928174Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:43.90412208Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired"}
+{"Time":"2026-10-17T23:10:43.904140025Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/expired\n"}
+{"Time":"2026-10-17T23:10:43.93066486Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/expired (0.03s)\n"}
+{"Time":"2026-10-17T23:10:43.930757386Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:43.93077607Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh"}
+{"Time":"2026-10-17T23:10:43.930785195Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T23:10:44.0490949Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh (0.12s)\n"}
+{"Time":"2026-10-17T23:10:44.049147173Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Elapsed":0.12}
+{"Time":"2026-10-17T23:10:44.049166424Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale"}
+{"Time":"2026-10-17T23:10:44.04917298Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T23:10:44.073806364Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale (0.02s)\n"}
+{"Time":"2026-10-17T23:10:44.073858312Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:44.073872316Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T23:10:44.073878393Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T23:10:44.097228921Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind (0.02s)\n"}
+{"Time":"2026-10-17T23:10:44.097301293Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:44.65814226Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals (1.18s)\n"}
+{"Time":"2026-10-17T23:10:44.658223857Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Elapsed":1.18}
+{"Time":"2026-10-17T23:10:44.658245336Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals"}
+{"Time":"2026-10-17T23:10:44.658260287Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals\n"}
+{"Time":"2026-10-17T23:10:45.26628024Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T23:10:45.276266079Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect"}
+{"Time":"2026-10-17T23:10:45.276321066Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect\n"}
+{"Time":"2026-10-17T23:10:45.292169135Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect (0.02s)\n"}
+{"Time":"2026-10-17T23:10:45.292218378Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:45.292228089Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate"}
+{"Time":"2026-10-17T23:10:45.29223359Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T23:10:45.320133857Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate (0.03s)\n"}
+{"Time":"2026-10-17T23:10:45.320201Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:45.320225635Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed"}
+{"Time":"2026-10-17T23:10:45.320235148Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed\n"}
+{"Time":"2026-10-17T23:10:45.34284707Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed (0.02s)\n"}
+{"Time":"2026-10-17T23:10:45.342915953Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:45.34294278Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired"}
+{"Time":"2026-10-17T23:10:45.342951743Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired\n"}
+{"Time":"2026-10-17T23:10:45.370748179Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired (0.03s)\n"}
+{"Time":"2026-10-17T23:10:45.370854565Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:45.370879362Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh"}
+{"Time":"2026-10-17T23:10:45.370892563Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T23:10:45.515083741Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh (0.14s)\n"}
+{"Time":"2026-10-17T23:10:45.515154896Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Elapsed":0.14}
+{"Time":"2026-10-17T23:10:45.515850066Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act"}
+{"Time":"2026-10-17T23:10:45.515889733Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act\n"}
+{"Time":"2026-10-17T23:10:45.539272225Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act (0.02s)\n"}
+{"Time":"2026-10-17T23:10:45.539328935Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Elapsed":0.02}
+{"Time":"2026-10-17T23:10:45.539352704Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale"}
+{"Time":"2026-10-17T23:10:45.539359602Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T23:10:45.56506448Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale (0.03s)\n"}
+{"Time":"2026-10-17T23:10:45.565127249Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:45.565142362Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T23:10:45.565148773Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T23:10:45.590775112Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind (0.03s)\n"}
+{"Time":"2026-10-17T23:10:45.590835735Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Elapsed":0.03}
+{"Time":"2026-10-17T23:10:46.166665857Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals (1.51s)\n"}
+{"Time":"2026-10-17T23:10:46.166735056Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Elapsed":1.51}
+{"Time":"2026-10-17T23:10:46.166754632Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse"}
+{"Time":"2026-10-17T23:10:46.166763866Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Output":"=== RUN TestTrustedServiceMissingAndGenericAdmissionRefuse\n"}
+{"Time":"2026-10-17T23:10:46.362882782Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Output":"--- PASS: TestTrustedServiceMissingAndGenericAdmissionRefuse (0.20s)\n"}
+{"Time":"2026-10-17T23:10:46.3630308Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceMissingAndGenericAdmissionRefuse","Elapsed":0.2}
+{"Time":"2026-10-17T23:10:46.363052802Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"PASS\n"}
+{"Time":"2026-10-17T23:10:46.64481753Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Output":"--- PASS: TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal (3.18s)\n"}
+{"Time":"2026-10-17T23:10:46.644881408Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestExecutionContractShippedPolicyDoesNotAdmitNewActionOrPrincipal","Elapsed":3.18}
+{"Time":"2026-10-17T23:10:46.644897242Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal"}
+{"Time":"2026-10-17T23:10:46.644904627Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal\n"}
+{"Time":"2026-10-17T23:10:47.124702143Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply"}
+{"Time":"2026-10-17T23:10:47.124748221Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply\n"}
+{"Time":"2026-10-17T23:10:47.180358604Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply (0.06s)\n"}
+{"Time":"2026-10-17T23:10:47.180503917Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/apply","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:47.180541384Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest"}
+{"Time":"2026-10-17T23:10:47.180546452Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest\n"}
+{"Time":"2026-10-17T23:10:47.244644628Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest (0.06s)\n"}
+{"Time":"2026-10-17T23:10:47.244734593Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/PDP_digest","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:47.244748786Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation"}
+{"Time":"2026-10-17T23:10:47.244754206Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation\n"}
+{"Time":"2026-10-17T23:10:47.298381853Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation (0.05s)\n"}
+{"Time":"2026-10-17T23:10:47.298505525Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/wrong_operation","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:47.298533379Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human"}
+{"Time":"2026-10-17T23:10:47.298552315Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/human\n"}
+{"Time":"2026-10-17T23:10:47.352055891Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/human (0.05s)\n"}
+{"Time":"2026-10-17T23:10:47.352110707Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/human","Elapsed":0.05}
+{"Time":"2026-10-17T23:10:47.352131952Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant"}
+{"Time":"2026-10-17T23:10:47.352137804Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant\n"}
+{"Time":"2026-10-17T23:10:47.378757556Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/access-engine\t56.165s\n"}
+{"Time":"2026-10-17T23:10:47.378815059Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":56.166}
+{"Time":"2026-10-17T23:10:47.423905218Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant (0.07s)\n"}
+{"Time":"2026-10-17T23:10:47.423976391Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/foreigntenant","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:47.423986716Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller"}
+{"Time":"2026-10-17T23:10:47.423991847Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller\n"}
+{"Time":"2026-10-17T23:10:47.491301883Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller (0.07s)\n"}
+{"Time":"2026-10-17T23:10:47.491351631Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/servicecaller","Elapsed":0.07}
+{"Time":"2026-10-17T23:10:47.491365157Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control"}
+{"Time":"2026-10-17T23:10:47.491371063Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control\n"}
+{"Time":"2026-10-17T23:10:47.552647955Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control (0.06s)\n"}
+{"Time":"2026-10-17T23:10:47.552719272Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/missing_human_control","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:47.553082388Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed"}
+{"Time":"2026-10-17T23:10:47.553155473Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed\n"}
+{"Time":"2026-10-17T23:10:47.613184885Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed (0.06s)\n"}
+{"Time":"2026-10-17T23:10:47.613237447Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/consumed","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:47.613257303Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation"}
+{"Time":"2026-10-17T23:10:47.613264282Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation","Output":"=== RUN TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation\n"}
+{"Time":"2026-10-17T23:10:47.674136525Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation (0.06s)\n"}
+{"Time":"2026-10-17T23:10:47.674220232Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal/expired_observation","Elapsed":0.06}
+{"Time":"2026-10-17T23:10:47.674266184Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Output":"--- PASS: TestServiceTaskExecutionSourcePredicateAndHardRefusal (1.03s)\n"}
+{"Time":"2026-10-17T23:10:47.674478394Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestServiceTaskExecutionSourcePredicateAndHardRefusal","Elapsed":1.03}
+{"Time":"2026-10-17T23:10:47.674506401Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission"}
+{"Time":"2026-10-17T23:10:47.674514706Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Output":"=== RUN TestTaskExecutionPackageClosedAdmission\n"}
+{"Time":"2026-10-17T23:10:47.938020426Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Output":"--- PASS: TestTaskExecutionPackageClosedAdmission (0.26s)\n"}
+{"Time":"2026-10-17T23:10:47.938070426Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionPackageClosedAdmission","Elapsed":0.26}
+{"Time":"2026-10-17T23:10:47.938083023Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch"}
+{"Time":"2026-10-17T23:10:47.938089128Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Output":"=== RUN TestTaskExecutionSourceHasNoActivationSwitch\n"}
+{"Time":"2026-10-17T23:10:47.938418363Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Output":"--- PASS: TestTaskExecutionSourceHasNoActivationSwitch (0.00s)\n"}
+{"Time":"2026-10-17T23:10:47.938450004Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionSourceHasNoActivationSwitch","Elapsed":0}
+{"Time":"2026-10-17T23:10:47.938466073Z","Action":"run","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection"}
+{"Time":"2026-10-17T23:10:47.938471709Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Output":"=== RUN TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection\n"}
+{"Time":"2026-10-17T23:10:48.346855805Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Output":"--- PASS: TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection (0.41s)\n"}
+{"Time":"2026-10-17T23:10:48.346926104Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Test":"TestTaskExecutionDescriptorOnlyAndRefusedHumanProjection","Elapsed":0.41}
+{"Time":"2026-10-17T23:10:48.346945942Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Output":"PASS\n"}
+{"Time":"2026-10-17T23:10:49.357601707Z","Action":"output","Package":"github.com/netkingdom/access-engine/internal/policy","Output":"ok \tgithub.com/netkingdom/access-engine/internal/policy\t52.046s\n"}
+{"Time":"2026-10-17T23:10:49.357652276Z","Action":"pass","Package":"github.com/netkingdom/access-engine/internal/policy","Elapsed":52.046}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-result-attempt2.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-result-attempt2.json
new file mode 100644
index 00000000..1c4fab4c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-result-attempt2.json
@@ -0,0 +1,104 @@
+{
+ "target": "producer",
+ "source_revision": "d328a2601095686f74376d87791bff01e2a3a2a3",
+ "returncode": 0,
+ "seconds": 65.82,
+ "argv": [
+ "bwrap",
+ "--unshare-net",
+ "--unshare-pid",
+ "--die-with-parent",
+ "--new-session",
+ "--ro-bind",
+ "/usr",
+ "/usr",
+ "--ro-bind",
+ "/lib",
+ "/lib",
+ "--ro-bind",
+ "/lib64",
+ "/lib64",
+ "--symlink",
+ "usr/bin",
+ "/bin",
+ "--proc",
+ "/proc",
+ "--dev",
+ "/dev",
+ "--tmpfs",
+ "/tmp",
+ "--bind",
+ "/tmp/custodian-resume-producer-xtoe0khs",
+ "/work",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+ "/toolchain",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod",
+ "/modules",
+ "--chdir",
+ "/work/source",
+ "--clearenv",
+ "--setenv",
+ "PATH",
+ "/toolchain/bin:/usr/bin:/bin",
+ "--setenv",
+ "HOME",
+ "/work/home",
+ "--setenv",
+ "GOTOOLCHAIN",
+ "local",
+ "--setenv",
+ "GOPROXY",
+ "off",
+ "--setenv",
+ "GOSUMDB",
+ "off",
+ "--setenv",
+ "GOMODCACHE",
+ "/modules",
+ "--setenv",
+ "GOCACHE",
+ "/work/gocache",
+ "--setenv",
+ "GOMAXPROCS",
+ "4",
+ "--setenv",
+ "CGO_ENABLED",
+ "0",
+ "--",
+ "go",
+ "test",
+ "-p",
+ "4",
+ "-json",
+ "./cmd/access-engine",
+ "-run",
+ "TestForgejoActualPolicySignedLosslessAndLegacy|TestTrustedServiceActualHTTPPositiveAndRefusals|TestTrustedServiceRetainedRegistryPreapprovalAndRefusals",
+ "-count=1"
+ ],
+ "workspace": "/tmp/custodian-resume-producer-xtoe0khs",
+ "network": "disabled",
+ "pid_namespace": "private",
+ "real_credentials": false,
+ "canonical_owner_modified": false,
+ "candidate_files": {
+ "adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
+ "adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
+ "adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
+ "adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
+ "adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
+ "adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
+ "adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
+ "adapters/go/decisionpep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee",
+ "adapters/go/decisionpep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa",
+ "adapters/go/decisionpep/testsupport/signfixture/sign.go": "24574585bd63b603ecf256eb945b2d4a894e4432b56d885d07234b80d39fddb5",
+ "cmd/access-engine/forgejo_application_profile_test.go": "931464acd69c34110c3cce3ddbdf732608f1b7249f5f111209a27df205b245e1",
+ "cmd/access-engine/main.go": "e4b6ad3b3dd4bb72e9a908fa7eb1296c8202ae92b81922c640c632415dbd6445",
+ "examples/forgejo-application-access/policy.md": "1ad11259f7ea8aae160f2542d88719cdb247037a2754c339c3a83e807953fa31",
+ "examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
+ "examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
+ "internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d",
+ "internal/decision/json_profile.go": "430d2c89f47d218ec843af76a9766b42e9d938a15063fc8e979f14c56306f4bc"
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-result.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-result.json
new file mode 100644
index 00000000..4acb74b9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-result.json
@@ -0,0 +1,85 @@
+{
+ "target": "producer",
+ "source_revision": "d328a2601095686f74376d87791bff01e2a3a2a3",
+ "returncode": 1,
+ "seconds": 66.81,
+ "argv": [
+ "bwrap",
+ "--unshare-net",
+ "--unshare-pid",
+ "--die-with-parent",
+ "--new-session",
+ "--ro-bind",
+ "/usr",
+ "/usr",
+ "--ro-bind",
+ "/lib",
+ "/lib",
+ "--ro-bind",
+ "/lib64",
+ "/lib64",
+ "--symlink",
+ "usr/bin",
+ "/bin",
+ "--proc",
+ "/proc",
+ "--dev",
+ "/dev",
+ "--tmpfs",
+ "/tmp",
+ "--bind",
+ "/tmp/custodian-resume-producer-1ir3az_t",
+ "/work",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+ "/toolchain",
+ "--ro-bind",
+ "/home/worsch/go/pkg/mod",
+ "/modules",
+ "--chdir",
+ "/work/source",
+ "--clearenv",
+ "--setenv",
+ "PATH",
+ "/toolchain/bin:/usr/bin:/bin",
+ "--setenv",
+ "HOME",
+ "/work/home",
+ "--setenv",
+ "GOTOOLCHAIN",
+ "local",
+ "--setenv",
+ "GOPROXY",
+ "off",
+ "--setenv",
+ "GOSUMDB",
+ "off",
+ "--setenv",
+ "GOMODCACHE",
+ "/modules",
+ "--setenv",
+ "GOCACHE",
+ "/work/gocache",
+ "--setenv",
+ "GOMAXPROCS",
+ "4",
+ "--setenv",
+ "CGO_ENABLED",
+ "0",
+ "--",
+ "go",
+ "test",
+ "-p",
+ "4",
+ "-json",
+ "./cmd/access-engine",
+ "-run",
+ "TestForgejoActualPolicySignedLosslessAndLegacy|TestTrustedServiceActualHTTPPositiveAndRefusals|TestTrustedServiceRetainedRegistryPreapprovalAndRefusals",
+ "-count=1"
+ ],
+ "workspace": "/tmp/custodian-resume-producer-1ir3az_t",
+ "network": "disabled",
+ "pid_namespace": "private",
+ "real_credentials": false,
+ "canonical_owner_modified": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-test-attempt2.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-test-attempt2.jsonl
new file mode 100644
index 00000000..a9c05468
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-test-attempt2.jsonl
@@ -0,0 +1,126 @@
+{"Time":"2026-10-17T22:50:49.514394056Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"}
+{"Time":"2026-10-17T22:50:49.533137271Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"}
+{"Time":"2026-10-17T22:50:49.533213845Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"}
+{"Time":"2026-10-17T22:50:49.595710681Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins"}
+{"Time":"2026-10-17T22:50:49.596022136Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins\n"}
+{"Time":"2026-10-17T22:50:49.612730726Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins (0.02s)\n"}
+{"Time":"2026-10-17T22:50:49.61278262Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Elapsed":0.02}
+{"Time":"2026-10-17T22:50:49.613566436Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners"}
+{"Time":"2026-10-17T22:50:49.613613217Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners\n"}
+{"Time":"2026-10-17T22:50:49.630240237Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners (0.02s)\n"}
+{"Time":"2026-10-17T22:50:49.630295386Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Elapsed":0.02}
+{"Time":"2026-10-17T22:50:49.630308777Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers"}
+{"Time":"2026-10-17T22:50:49.630315558Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers\n"}
+{"Time":"2026-10-17T22:50:49.649236847Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers (0.02s)\n"}
+{"Time":"2026-10-17T22:50:49.64929958Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Elapsed":0.02}
+{"Time":"2026-10-17T22:50:49.649318183Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action"}
+{"Time":"2026-10-17T22:50:49.649328111Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action\n"}
+{"Time":"2026-10-17T22:50:49.663413081Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.663487049Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.663504985Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource"}
+{"Time":"2026-10-17T22:50:49.66351356Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource\n"}
+{"Time":"2026-10-17T22:50:49.677835919Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.677896956Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.677916939Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut"}
+{"Time":"2026-10-17T22:50:49.677924982Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut\n"}
+{"Time":"2026-10-17T22:50:49.693350107Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut (0.02s)\n"}
+{"Time":"2026-10-17T22:50:49.693413931Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Elapsed":0.02}
+{"Time":"2026-10-17T22:50:49.693435563Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant"}
+{"Time":"2026-10-17T22:50:49.69345661Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant\n"}
+{"Time":"2026-10-17T22:50:49.706861893Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.706927268Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.706957774Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance"}
+{"Time":"2026-10-17T22:50:49.706967107Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance\n"}
+{"Time":"2026-10-17T22:50:49.721171004Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.721239517Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.721252565Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider"}
+{"Time":"2026-10-17T22:50:49.721258985Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/outsider\n"}
+{"Time":"2026-10-17T22:50:49.73814155Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/outsider (0.02s)\n"}
+{"Time":"2026-10-17T22:50:49.738203643Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Elapsed":0.02}
+{"Time":"2026-10-17T22:50:49.738226051Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups"}
+{"Time":"2026-10-17T22:50:49.738234284Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups\n"}
+{"Time":"2026-10-17T22:50:49.751882211Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.752014882Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.752033728Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer"}
+{"Time":"2026-10-17T22:50:49.752040897Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer\n"}
+{"Time":"2026-10-17T22:50:49.76587286Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.765931914Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.765961888Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer"}
+{"Time":"2026-10-17T22:50:49.765971194Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer\n"}
+{"Time":"2026-10-17T22:50:49.779735065Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.779787906Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.801093703Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy (0.27s)\n"}
+{"Time":"2026-10-17T22:50:49.801141071Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":0.27}
+{"Time":"2026-10-17T22:50:49.803536211Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals"}
+{"Time":"2026-10-17T22:50:49.803569097Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals\n"}
+{"Time":"2026-10-17T22:50:49.893766116Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T22:50:49.895266983Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect"}
+{"Time":"2026-10-17T22:50:49.895314585Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/redirect\n"}
+{"Time":"2026-10-17T22:50:49.903250446Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/redirect (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.903329068Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.903352819Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate"}
+{"Time":"2026-10-17T22:50:49.903370863Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T22:50:49.913845124Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.913902419Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.91393517Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed"}
+{"Time":"2026-10-17T22:50:49.913946811Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/changed\n"}
+{"Time":"2026-10-17T22:50:49.920414259Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/changed (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.920481501Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.920521339Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired"}
+{"Time":"2026-10-17T22:50:49.920534261Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/expired\n"}
+{"Time":"2026-10-17T22:50:49.929199396Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/expired (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.929263328Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.92930102Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh"}
+{"Time":"2026-10-17T22:50:49.929324771Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T22:50:49.957675043Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh (0.03s)\n"}
+{"Time":"2026-10-17T22:50:49.957739111Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Elapsed":0.03}
+{"Time":"2026-10-17T22:50:49.957763097Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale"}
+{"Time":"2026-10-17T22:50:49.957771961Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T22:50:49.963378736Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.963429648Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:49.964168162Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T22:50:49.96420993Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T22:50:49.97145752Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind (0.01s)\n"}
+{"Time":"2026-10-17T22:50:49.971524068Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:50.106157584Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals (0.30s)\n"}
+{"Time":"2026-10-17T22:50:50.106252464Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Elapsed":0.3}
+{"Time":"2026-10-17T22:50:50.106287162Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals"}
+{"Time":"2026-10-17T22:50:50.106400202Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals\n"}
+{"Time":"2026-10-17T22:50:50.209683094Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T22:50:50.21441439Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect"}
+{"Time":"2026-10-17T22:50:50.214469269Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect\n"}
+{"Time":"2026-10-17T22:50:50.218687389Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect (0.00s)\n"}
+{"Time":"2026-10-17T22:50:50.218731366Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Elapsed":0}
+{"Time":"2026-10-17T22:50:50.218874326Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate"}
+{"Time":"2026-10-17T22:50:50.218895047Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T22:50:50.229670287Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate (0.01s)\n"}
+{"Time":"2026-10-17T22:50:50.22973522Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:50.229754544Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed"}
+{"Time":"2026-10-17T22:50:50.229763426Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed\n"}
+{"Time":"2026-10-17T22:50:50.234511774Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed (0.00s)\n"}
+{"Time":"2026-10-17T22:50:50.234559611Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Elapsed":0}
+{"Time":"2026-10-17T22:50:50.234580594Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired"}
+{"Time":"2026-10-17T22:50:50.234586626Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired\n"}
+{"Time":"2026-10-17T22:50:50.241561501Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired (0.01s)\n"}
+{"Time":"2026-10-17T22:50:50.241626894Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:50.241646632Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh"}
+{"Time":"2026-10-17T22:50:50.241655587Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T22:50:50.265060146Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh (0.02s)\n"}
+{"Time":"2026-10-17T22:50:50.265120128Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Elapsed":0.02}
+{"Time":"2026-10-17T22:50:50.265144998Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act"}
+{"Time":"2026-10-17T22:50:50.265301637Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act\n"}
+{"Time":"2026-10-17T22:50:50.270375383Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act (0.00s)\n"}
+{"Time":"2026-10-17T22:50:50.270440064Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Elapsed":0}
+{"Time":"2026-10-17T22:50:50.270458793Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale"}
+{"Time":"2026-10-17T22:50:50.27047478Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T22:50:50.277250946Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale (0.01s)\n"}
+{"Time":"2026-10-17T22:50:50.277301379Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:50.277329964Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T22:50:50.277337664Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T22:50:50.282770016Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind (0.01s)\n"}
+{"Time":"2026-10-17T22:50:50.28292834Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Elapsed":0.01}
+{"Time":"2026-10-17T22:50:50.420567507Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals (0.31s)\n"}
+{"Time":"2026-10-17T22:50:50.420620754Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Elapsed":0.31}
+{"Time":"2026-10-17T22:50:50.420926195Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"PASS\n"}
+{"Time":"2026-10-17T22:50:50.425558858Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/access-engine\t0.910s\n"}
+{"Time":"2026-10-17T22:50:50.425685686Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":0.911}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-test.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-test.jsonl
new file mode 100644
index 00000000..52e827f7
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-test.jsonl
@@ -0,0 +1,339 @@
+{"Time":"2026-10-17T22:49:08.070924685Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"}
+{"Time":"2026-10-17T22:49:08.081350257Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"}
+{"Time":"2026-10-17T22:49:08.081401358Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"}
+{"Time":"2026-10-17T22:49:08.124026957Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" forgejo_application_profile_test.go:39: policy: \u003cnil\u003e \u0026{Source:../../examples/forgejo-application-access/policy.md Metadata:{ID:forgejo.application-access Name:Forgejo authenticated application access Namespace:forgejo:application Version:v1 Status:draft Package:flexauth.forgejo.application Actions:[application.access] Owner:railiance-apps Fixtures:[] Caring:{Profile:caring-0.4.0-rc2 Enforce:false CanonicalRoles:[] OrganizationRelations:[] Scopes:[] Planes:[] Capabilities:[] ExposureModes:[] Conditions:[] Restrictions:[] Metadata:map[]} Activation:map[] Metadata:map[] AllowTTL:10s} Prose:This source policy enforces the original three-group any-of in the sole PDP.\n"}
+{"Time":"2026-10-17T22:49:08.124075109Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" The registry identifies the application tenant and admitted issuer. Fresh identity\n"}
+{"Time":"2026-10-17T22:49:08.124081908Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" and UserInfo facts arrive only in request context from the admitted Forgejo caller,\n"}
+{"Time":"2026-10-17T22:49:08.124087445Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" which verifies issuer JOSE and current UserInfo before this request. They are not\n"}
+{"Time":"2026-10-17T22:49:08.124093162Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" static subject registry attributes. This policy requires aal2 assurance.\n"}
+{"Time":"2026-10-17T22:49:08.124098356Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" The PEP independently verifies the ID token and supplies fresh UserInfo groups;\n"}
+{"Time":"2026-10-17T22:49:08.124103541Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" the authenticated workload caller may represent only the Forgejo system. A\n"}
+{"Time":"2026-10-17T22:49:08.124108816Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" decision authorizes one login callback, never a later HTTP/Git/SSH/API operation.\n"}
+{"Time":"2026-10-17T22:49:08.124114118Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" The accompanying registry is synthetic test data, not an estate admission. RuleBlocks:[{Language:rego Tags:[] Info:rego Body:import rego.v1\n"}
+{"Time":"2026-10-17T22:49:08.124123279Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.124129907Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" default decision := {\"effect\": \"deny\", \"reason\": \"application_access_refused\"}\n"}
+{"Time":"2026-10-17T22:49:08.124153667Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.124162144Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" original_groups := {\"forge-admins\", \"forge-coulomb-owners\", \"forge-coulomb-readers\"}\n"}
+{"Time":"2026-10-17T22:49:08.124179322Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.124188429Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" decision := {\"effect\": \"allow\", \"reason\": \"current_authenticated_application_access\"} if {\n"}
+{"Time":"2026-10-17T22:49:08.12419604Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.action == \"application.access\"\n"}
+{"Time":"2026-10-17T22:49:08.124218312Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" object.get(input, \"purpose\", \"\") == \"\"\n"}
+{"Time":"2026-10-17T22:49:08.124235752Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.id == \"application:forgejo\"\n"}
+{"Time":"2026-10-17T22:49:08.124249584Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.type == \"application\"\n"}
+{"Time":"2026-10-17T22:49:08.124254814Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.system == \"forgejo\"\n"}
+{"Time":"2026-10-17T22:49:08.124259828Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.tenant\n"}
+{"Time":"2026-10-17T22:49:08.124264787Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.attributes.tenant\n"}
+{"Time":"2026-10-17T22:49:08.124269954Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.tenant == input.tenant\n"}
+{"Time":"2026-10-17T22:49:08.124274904Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_tenant == input.tenant\n"}
+{"Time":"2026-10-17T22:49:08.124279837Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.id == input.context.identity_subject\n"}
+{"Time":"2026-10-17T22:49:08.124284905Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == input.context.identity_principal_type\n"}
+{"Time":"2026-10-17T22:49:08.12429008Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == \"human\"\n"}
+{"Time":"2026-10-17T22:49:08.124307718Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_issuer == input.resource.attributes.identity_issuer\n"}
+{"Time":"2026-10-17T22:49:08.124313318Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_assurance == \"aal2\"\n"}
+{"Time":"2026-10-17T22:49:08.124318656Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.required_groups_any_of) == 3\n"}
+{"Time":"2026-10-17T22:49:08.124323643Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" {g | g := input.context.required_groups_any_of[_]} == original_groups\n"}
+{"Time":"2026-10-17T22:49:08.124330144Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" some group in input.context.current_userinfo_groups\n"}
+{"Time":"2026-10-17T22:49:08.124338079Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" group in original_groups\n"}
+{"Time":"2026-10-17T22:49:08.124357403Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" is_string(input.context.decisionpep_request_nonce)\n"}
+{"Time":"2026-10-17T22:49:08.124371759Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.decisionpep_request_nonce) == 64\n"}
+{"Time":"2026-10-17T22:49:08.124379099Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" } StartLine:12}] TestBlocks:[{Language:rego Tags:[test] Info:rego test Body:package flexauth.forgejo.application_test\n"}
+{"Time":"2026-10-17T22:49:08.124390614Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" import rego.v1\n"}
+{"Time":"2026-10-17T22:49:08.124396682Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" import data.flexauth.forgejo.application\n"}
+{"Time":"2026-10-17T22:49:08.124401561Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.124406385Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" valid_request := {\n"}
+{"Time":"2026-10-17T22:49:08.124411254Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124416277Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"subject\": {\n"}
+{"Time":"2026-10-17T22:49:08.124421254Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"user:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124426223Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"human\",\n"}
+{"Time":"2026-10-17T22:49:08.124440569Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\"\n"}
+{"Time":"2026-10-17T22:49:08.124445962Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.12445084Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"action\": \"application.access\",\n"}
+{"Time":"2026-10-17T22:49:08.124455817Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"resource\": {\n"}
+{"Time":"2026-10-17T22:49:08.124460759Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"application:forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.124465809Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"application\",\n"}
+{"Time":"2026-10-17T22:49:08.124470813Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"system\": \"forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.124475863Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124482193Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"attributes\": {\n"}
+{"Time":"2026-10-17T22:49:08.124488Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124493005Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_issuer\": \"https://issuer.invalid\"\n"}
+{"Time":"2026-10-17T22:49:08.124498172Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124514213Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.124519173Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"context\": {\n"}
+{"Time":"2026-10-17T22:49:08.124524195Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124544087Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_subject\": \"user:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124550832Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_principal_type\": \"human\",\n"}
+{"Time":"2026-10-17T22:49:08.124561743Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_issuer\": \"https://issuer.invalid\",\n"}
+{"Time":"2026-10-17T22:49:08.124567199Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_assurance\": \"aal2\",\n"}
+{"Time":"2026-10-17T22:49:08.124572447Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"current_userinfo_groups\": [\n"}
+{"Time":"2026-10-17T22:49:08.124577388Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-admins\"\n"}
+{"Time":"2026-10-17T22:49:08.124582284Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" ],\n"}
+{"Time":"2026-10-17T22:49:08.1245871Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"required_groups_any_of\": [\n"}
+{"Time":"2026-10-17T22:49:08.12459233Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-admins\",\n"}
+{"Time":"2026-10-17T22:49:08.12459728Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-coulomb-owners\",\n"}
+{"Time":"2026-10-17T22:49:08.124602213Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-coulomb-readers\"\n"}
+{"Time":"2026-10-17T22:49:08.124609507Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" ],\n"}
+{"Time":"2026-10-17T22:49:08.124616469Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"decisionpep_request_nonce\": \"0000000000000000000000000000000000000000000000000000000000000000\"\n"}
+{"Time":"2026-10-17T22:49:08.124633475Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124641816Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124647614Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.124654026Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_original_groups_allow if {\n"}
+{"Time":"2026-10-17T22:49:08.124660906Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" every group in [\"forge-admins\", \"forge-coulomb-owners\", \"forge-coulomb-readers\"] {\n"}
+{"Time":"2026-10-17T22:49:08.12467812Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"allow\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"current_userinfo_groups\": [group]})})\n"}
+{"Time":"2026-10-17T22:49:08.12470151Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124718706Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124727805Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.124733107Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_outsider_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.124738625Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"current_userinfo_groups\": [\"outsider\"]})})\n"}
+{"Time":"2026-10-17T22:49:08.124744153Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124749031Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.12478923Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_missing_identity_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.124795164Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.remove(valid_request.context, [\"identity_issuer\"])})\n"}
+{"Time":"2026-10-17T22:49:08.124800583Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124805389Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.124810213Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_low_assurance_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.12481529Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"identity_assurance\": \"aal1\"})})\n"}
+{"Time":"2026-10-17T22:49:08.124820655Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.124825371Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.12483217Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_changed_group_contract_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.124839907Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"required_groups_any_of\": [\"outsider\"]})})\n"}
+{"Time":"2026-10-17T22:49:08.124862252Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" } StartLine:43}] FixtureBlocks:[{Language:yaml Tags:[fixture] Info:yaml fixture Body:[\n"}
+{"Time":"2026-10-17T22:49:08.124870169Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" {\n"}
+{"Time":"2026-10-17T22:49:08.124876671Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"allowed-original-group\",\n"}
+{"Time":"2026-10-17T22:49:08.124887942Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"request\": {\n"}
+{"Time":"2026-10-17T22:49:08.124899601Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124913154Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"subject\": {\n"}
+{"Time":"2026-10-17T22:49:08.124919845Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"user:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124926879Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"human\",\n"}
+{"Time":"2026-10-17T22:49:08.124934128Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\"\n"}
+{"Time":"2026-10-17T22:49:08.124941171Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.124947627Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"action\": \"application.access\",\n"}
+{"Time":"2026-10-17T22:49:08.12495513Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"resource\": {\n"}
+{"Time":"2026-10-17T22:49:08.124962731Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"application:forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.124969683Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"application\",\n"}
+{"Time":"2026-10-17T22:49:08.124975869Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"system\": \"forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.12498274Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.124988836Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"attributes\": {\n"}
+{"Time":"2026-10-17T22:49:08.125009359Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125026258Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_issuer\": \"https://issuer.invalid\"\n"}
+{"Time":"2026-10-17T22:49:08.125035194Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125042426Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125047953Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"context\": {\n"}
+{"Time":"2026-10-17T22:49:08.125055762Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125062769Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_subject\": \"user:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.12506808Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_principal_type\": \"human\",\n"}
+{"Time":"2026-10-17T22:49:08.125073147Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_issuer\": \"https://issuer.invalid\",\n"}
+{"Time":"2026-10-17T22:49:08.125078179Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_assurance\": \"aal2\",\n"}
+{"Time":"2026-10-17T22:49:08.125083265Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"current_userinfo_groups\": [\n"}
+{"Time":"2026-10-17T22:49:08.125088332Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-admins\"\n"}
+{"Time":"2026-10-17T22:49:08.125093211Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" ],\n"}
+{"Time":"2026-10-17T22:49:08.125098035Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"required_groups_any_of\": [\n"}
+{"Time":"2026-10-17T22:49:08.12510359Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-admins\",\n"}
+{"Time":"2026-10-17T22:49:08.125108486Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-coulomb-owners\",\n"}
+{"Time":"2026-10-17T22:49:08.125113382Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-coulomb-readers\"\n"}
+{"Time":"2026-10-17T22:49:08.125125691Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" ],\n"}
+{"Time":"2026-10-17T22:49:08.125131182Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"decisionpep_request_nonce\": \"0000000000000000000000000000000000000000000000000000000000000000\"\n"}
+{"Time":"2026-10-17T22:49:08.125136638Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125141489Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125146277Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"expect\": {\n"}
+{"Time":"2026-10-17T22:49:08.125151264Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"effect\": \"allow\",\n"}
+{"Time":"2026-10-17T22:49:08.125158802Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"reason\": \"current_authenticated_application_access\"\n"}
+{"Time":"2026-10-17T22:49:08.125163825Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125169163Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125173897Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" {\n"}
+{"Time":"2026-10-17T22:49:08.125178694Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"missing-identity-context\",\n"}
+{"Time":"2026-10-17T22:49:08.125183681Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"request\": {\n"}
+{"Time":"2026-10-17T22:49:08.125188568Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125193546Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"subject\": {\n"}
+{"Time":"2026-10-17T22:49:08.125198424Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"user:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125203393Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"human\",\n"}
+{"Time":"2026-10-17T22:49:08.125208334Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\"\n"}
+{"Time":"2026-10-17T22:49:08.125213248Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125236143Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"action\": \"application.access\",\n"}
+{"Time":"2026-10-17T22:49:08.125241391Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"resource\": {\n"}
+{"Time":"2026-10-17T22:49:08.125246666Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"application:forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.125251734Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"application\",\n"}
+{"Time":"2026-10-17T22:49:08.125256856Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"system\": \"forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.12526177Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.12526838Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"attributes\": {\n"}
+{"Time":"2026-10-17T22:49:08.125274602Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125281644Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_issuer\": \"https://issuer.invalid\"\n"}
+{"Time":"2026-10-17T22:49:08.125286712Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.12529159Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125296396Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"context\": {}\n"}
+{"Time":"2026-10-17T22:49:08.125301771Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125306568Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"expect\": {\n"}
+{"Time":"2026-10-17T22:49:08.125311554Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"effect\": \"deny\",\n"}
+{"Time":"2026-10-17T22:49:08.125316577Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"reason\": \"application_access_refused\"\n"}
+{"Time":"2026-10-17T22:49:08.1253216Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125331609Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125336676Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" ] StartLine:107}] RegoModule:package flexauth.forgejo.application\n"}
+{"Time":"2026-10-17T22:49:08.125341618Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125346496Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" import rego.v1\n"}
+{"Time":"2026-10-17T22:49:08.125351248Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125356217Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" default decision := {\"effect\": \"deny\", \"reason\": \"application_access_refused\"}\n"}
+{"Time":"2026-10-17T22:49:08.125361474Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125366668Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" original_groups := {\"forge-admins\", \"forge-coulomb-owners\", \"forge-coulomb-readers\"}\n"}
+{"Time":"2026-10-17T22:49:08.12537188Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125376948Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" decision := {\"effect\": \"allow\", \"reason\": \"current_authenticated_application_access\"} if {\n"}
+{"Time":"2026-10-17T22:49:08.125382241Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.action == \"application.access\"\n"}
+{"Time":"2026-10-17T22:49:08.125387245Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" object.get(input, \"purpose\", \"\") == \"\"\n"}
+{"Time":"2026-10-17T22:49:08.125392403Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.id == \"application:forgejo\"\n"}
+{"Time":"2026-10-17T22:49:08.12539748Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.type == \"application\"\n"}
+{"Time":"2026-10-17T22:49:08.125402638Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.resource.system == \"forgejo\"\n"}
+{"Time":"2026-10-17T22:49:08.125407696Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.tenant\n"}
+{"Time":"2026-10-17T22:49:08.125412773Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.tenant == input.resource.attributes.tenant\n"}
+{"Time":"2026-10-17T22:49:08.125424306Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.tenant == input.tenant\n"}
+{"Time":"2026-10-17T22:49:08.125431881Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_tenant == input.tenant\n"}
+{"Time":"2026-10-17T22:49:08.125443801Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.id == input.context.identity_subject\n"}
+{"Time":"2026-10-17T22:49:08.125459023Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == input.context.identity_principal_type\n"}
+{"Time":"2026-10-17T22:49:08.125467436Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.subject.type == \"human\"\n"}
+{"Time":"2026-10-17T22:49:08.125523523Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_issuer == input.resource.attributes.identity_issuer\n"}
+{"Time":"2026-10-17T22:49:08.125539123Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" input.context.identity_assurance == \"aal2\"\n"}
+{"Time":"2026-10-17T22:49:08.125544308Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.required_groups_any_of) == 3\n"}
+{"Time":"2026-10-17T22:49:08.125551341Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" {g | g := input.context.required_groups_any_of[_]} == original_groups\n"}
+{"Time":"2026-10-17T22:49:08.125559042Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" some group in input.context.current_userinfo_groups\n"}
+{"Time":"2026-10-17T22:49:08.125566598Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" group in original_groups\n"}
+{"Time":"2026-10-17T22:49:08.125573767Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" is_string(input.context.decisionpep_request_nonce)\n"}
+{"Time":"2026-10-17T22:49:08.125581423Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" count(input.context.decisionpep_request_nonce) == 64\n"}
+{"Time":"2026-10-17T22:49:08.125586806Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125592117Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" TestModule:package flexauth.forgejo.application_test\n"}
+{"Time":"2026-10-17T22:49:08.125597095Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125601874Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" import rego.v1\n"}
+{"Time":"2026-10-17T22:49:08.125617392Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" import data.flexauth.forgejo.application\n"}
+{"Time":"2026-10-17T22:49:08.125629683Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125634823Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" valid_request := {\n"}
+{"Time":"2026-10-17T22:49:08.125639665Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125644688Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"subject\": {\n"}
+{"Time":"2026-10-17T22:49:08.125649701Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"user:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125654607Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"human\",\n"}
+{"Time":"2026-10-17T22:49:08.125659539Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\"\n"}
+{"Time":"2026-10-17T22:49:08.125664544Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125669332Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"action\": \"application.access\",\n"}
+{"Time":"2026-10-17T22:49:08.125677628Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"resource\": {\n"}
+{"Time":"2026-10-17T22:49:08.125684634Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"id\": \"application:forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.125689783Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"type\": \"application\",\n"}
+{"Time":"2026-10-17T22:49:08.125695581Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"system\": \"forgejo\",\n"}
+{"Time":"2026-10-17T22:49:08.125700955Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125706203Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"attributes\": {\n"}
+{"Time":"2026-10-17T22:49:08.125711587Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125716699Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_issuer\": \"https://issuer.invalid\"\n"}
+{"Time":"2026-10-17T22:49:08.125730712Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125736249Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" },\n"}
+{"Time":"2026-10-17T22:49:08.125741163Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"context\": {\n"}
+{"Time":"2026-10-17T22:49:08.125755861Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_tenant\": \"tenant:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.12576101Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_subject\": \"user:synthetic\",\n"}
+{"Time":"2026-10-17T22:49:08.125766105Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_principal_type\": \"human\",\n"}
+{"Time":"2026-10-17T22:49:08.125771173Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_issuer\": \"https://issuer.invalid\",\n"}
+{"Time":"2026-10-17T22:49:08.125776159Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"identity_assurance\": \"aal2\",\n"}
+{"Time":"2026-10-17T22:49:08.125782543Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"current_userinfo_groups\": [\n"}
+{"Time":"2026-10-17T22:49:08.125787683Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-admins\"\n"}
+{"Time":"2026-10-17T22:49:08.125792553Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" ],\n"}
+{"Time":"2026-10-17T22:49:08.12579744Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"required_groups_any_of\": [\n"}
+{"Time":"2026-10-17T22:49:08.125803139Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-admins\",\n"}
+{"Time":"2026-10-17T22:49:08.125808062Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-coulomb-owners\",\n"}
+{"Time":"2026-10-17T22:49:08.125813139Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"forge-coulomb-readers\"\n"}
+{"Time":"2026-10-17T22:49:08.125817972Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" ],\n"}
+{"Time":"2026-10-17T22:49:08.125823085Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \"decisionpep_request_nonce\": \"0000000000000000000000000000000000000000000000000000000000000000\"\n"}
+{"Time":"2026-10-17T22:49:08.125834203Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125839073Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.12584378Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125851174Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_original_groups_allow if {\n"}
+{"Time":"2026-10-17T22:49:08.125856187Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" every group in [\"forge-admins\", \"forge-coulomb-owners\", \"forge-coulomb-readers\"] {\n"}
+{"Time":"2026-10-17T22:49:08.125861607Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"allow\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"current_userinfo_groups\": [group]})})\n"}
+{"Time":"2026-10-17T22:49:08.125867297Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125872004Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125876701Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125881472Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_outsider_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.125886675Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"current_userinfo_groups\": [\"outsider\"]})})\n"}
+{"Time":"2026-10-17T22:49:08.125892094Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125896801Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.12590158Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_missing_identity_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.125906657Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.remove(valid_request.context, [\"identity_issuer\"])})\n"}
+{"Time":"2026-10-17T22:49:08.125911923Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125924024Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.1259303Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_low_assurance_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.125935674Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"identity_assurance\": \"aal1\"})})\n"}
+{"Time":"2026-10-17T22:49:08.12594104Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.12594581Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" \n"}
+{"Time":"2026-10-17T22:49:08.125950706Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" test_changed_group_contract_denied if {\n"}
+{"Time":"2026-10-17T22:49:08.125956107Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" application.decision.effect == \"deny\" with input as object.union(valid_request, {\"context\": object.union(valid_request.context, {\"required_groups_any_of\": [\"outsider\"]})})\n"}
+{"Time":"2026-10-17T22:49:08.12596214Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" }\n"}
+{"Time":"2026-10-17T22:49:08.125978506Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":" TestPackage:flexauth.forgejo.application_test Fixtures:[{ID:allowed-original-group Request:{ID: Tenant:tenant:synthetic Subject:{ID:user:synthetic Type:human Tenant:tenant:synthetic Attributes:map[]} Action:application.access Resource:{ID:application:forgejo Type:application System:forgejo Tenant:tenant:synthetic Attributes:map[identity_issuer:https://issuer.invalid tenant:tenant:synthetic]} Context:map[current_userinfo_groups:[forge-admins] decisionpep_request_nonce:0000000000000000000000000000000000000000000000000000000000000000 identity_assurance:aal2 identity_issuer:https://issuer.invalid identity_principal_type:human identity_subject:user:synthetic identity_tenant:tenant:synthetic required_groups_any_of:[forge-admins forge-coulomb-owners forge-coulomb-readers]] CaringContext:\u003cnil\u003e PolicyVersion: Purpose:} Expect:{Effect:allow Reason:current_authenticated_application_access Obligations:[] ConformanceFindings:[]} Metadata:map[]} {ID:missing-identity-context Request:{ID: Tenant:tenant:synthetic Sub"}
+{"Time":"2026-10-17T22:49:08.125988768Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"ject:{ID:user:synthetic Type:human Tenant:tenant:synthetic Attributes:map[]} Action:application.access Resource:{ID:application:forgejo Type:application System:forgejo Tenant:tenant:synthetic Attributes:map[identity_issuer:https://issuer.invalid tenant:tenant:synthetic]} Context:map[] CaringContext:\u003cnil\u003e PolicyVersion: Purpose:} Expect:{Effect:deny Reason:application_access_refused Obligations:[] ConformanceFindings:[]} Metadata:map[]}] Validation:{Valid:false Diagnostics:[] CaringFindings:[{Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed canonical roles Fields:[caring.canonical_roles] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed organization relations Fields:[caring.organization_relations] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed scopes Fields:[caring.scopes] Descriptor: Metadata:map[]"}
+{"Time":"2026-10-17T22:49:08.126002032Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed planes Fields:[caring.planes] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed capabilities Fields:[caring.capabilities] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed exposure modes Fields:[caring.exposure_modes] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed conditions Fields:[caring.conditions] Descriptor: Metadata:map[]} {Code:CARING-POLICY-MISSING-DIMENSION Severity:warning Message:policy package should declare governed restrictions Fields:[caring.restrictions] Descriptor: Metadata:map[]}] Tests:[{Name:test_changed_group_contract_denied Passed:true Error:} {Name:test_low_assurance_denied Passed:true Error:} {Name:test_missing_identity_denied Passed:false Error"}
+{"Time":"2026-10-17T22:49:08.126009895Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":":test rule evaluated to false or undefined} {Name:test_original_groups_allow Passed:true Error:} {Name:test_outsider_denied Passed:true Error:}] Fixtures:[{ID:allowed-original-group Passed:true Expected:{Effect:allow Reason:current_authenticated_application_access Obligations:[] ConformanceFindings:[]} Actual:{Effect:allow Reason:current_authenticated_application_access Obligations:[] ConformanceFindings:[]} Error:} {ID:missing-identity-context Passed:true Expected:{Effect:deny Reason:application_access_refused Obligations:[] ConformanceFindings:[]} Actual:{Effect:deny Reason:application_access_refused Obligations:[] ConformanceFindings:[]} Error:}]} Valid:false}\n"}
+{"Time":"2026-10-17T22:49:08.126023953Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- FAIL: TestForgejoActualPolicySignedLosslessAndLegacy (0.04s)\n"}
+{"Time":"2026-10-17T22:49:08.126031239Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":0.04}
+{"Time":"2026-10-17T22:49:08.126051131Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals"}
+{"Time":"2026-10-17T22:49:08.12605674Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals\n"}
+{"Time":"2026-10-17T22:49:08.202270945Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T22:49:08.204055053Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect"}
+{"Time":"2026-10-17T22:49:08.204094017Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/redirect\n"}
+{"Time":"2026-10-17T22:49:08.208897544Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/redirect (0.00s)\n"}
+{"Time":"2026-10-17T22:49:08.20896887Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/redirect","Elapsed":0}
+{"Time":"2026-10-17T22:49:08.208984912Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate"}
+{"Time":"2026-10-17T22:49:08.208992595Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T22:49:08.218181791Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.218242747Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/duplicate","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.218278041Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed"}
+{"Time":"2026-10-17T22:49:08.218291864Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/changed\n"}
+{"Time":"2026-10-17T22:49:08.224853212Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/changed (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.224898136Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/changed","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.224909984Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired"}
+{"Time":"2026-10-17T22:49:08.224915584Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/expired\n"}
+{"Time":"2026-10-17T22:49:08.229229607Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/expired (0.00s)\n"}
+{"Time":"2026-10-17T22:49:08.229282024Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/expired","Elapsed":0}
+{"Time":"2026-10-17T22:49:08.229308571Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh"}
+{"Time":"2026-10-17T22:49:08.229317426Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T22:49:08.248287502Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh (0.02s)\n"}
+{"Time":"2026-10-17T22:49:08.248353689Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/short-fresh","Elapsed":0.02}
+{"Time":"2026-10-17T22:49:08.248370686Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale"}
+{"Time":"2026-10-17T22:49:08.248376566Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T22:49:08.253598824Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.253636814Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/original-stale","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.253644641Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T22:49:08.253649366Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T22:49:08.257235488Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind (0.00s)\n"}
+{"Time":"2026-10-17T22:49:08.257274596Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals/native-number-kind","Elapsed":0}
+{"Time":"2026-10-17T22:49:08.364592231Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Output":"--- PASS: TestTrustedServiceActualHTTPPositiveAndRefusals (0.24s)\n"}
+{"Time":"2026-10-17T22:49:08.364652466Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceActualHTTPPositiveAndRefusals","Elapsed":0.24}
+{"Time":"2026-10-17T22:49:08.364672593Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals"}
+{"Time":"2026-10-17T22:49:08.364681754Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals\n"}
+{"Time":"2026-10-17T22:49:08.457647438Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":" trusted_service_http_test.go:237: actual HTTP source policy pin: secrets-engine.task-execution.service-pilot v2 sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d\n"}
+{"Time":"2026-10-17T22:49:08.459500203Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect"}
+{"Time":"2026-10-17T22:49:08.459549032Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect\n"}
+{"Time":"2026-10-17T22:49:08.464519381Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect (0.00s)\n"}
+{"Time":"2026-10-17T22:49:08.464585405Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/redirect","Elapsed":0}
+{"Time":"2026-10-17T22:49:08.464608814Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate"}
+{"Time":"2026-10-17T22:49:08.464624711Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate\n"}
+{"Time":"2026-10-17T22:49:08.476276202Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.476329233Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/duplicate","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.476353092Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed"}
+{"Time":"2026-10-17T22:49:08.476360378Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed\n"}
+{"Time":"2026-10-17T22:49:08.4818022Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.481870759Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/changed","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.481894357Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired"}
+{"Time":"2026-10-17T22:49:08.481904131Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired\n"}
+{"Time":"2026-10-17T22:49:08.49030167Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.490371446Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/expired","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.490396189Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh"}
+{"Time":"2026-10-17T22:49:08.490405748Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh\n"}
+{"Time":"2026-10-17T22:49:08.513151322Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh (0.02s)\n"}
+{"Time":"2026-10-17T22:49:08.513213793Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/short-fresh","Elapsed":0.02}
+{"Time":"2026-10-17T22:49:08.513233866Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act"}
+{"Time":"2026-10-17T22:49:08.51323979Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act\n"}
+{"Time":"2026-10-17T22:49:08.519855417Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.519905689Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/registry-drift-cannot-rebind-approved-act","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.519922019Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale"}
+{"Time":"2026-10-17T22:49:08.519930197Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale\n"}
+{"Time":"2026-10-17T22:49:08.525507841Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.525556011Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/original-stale","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.52576936Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind"}
+{"Time":"2026-10-17T22:49:08.525788287Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"=== RUN TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind\n"}
+{"Time":"2026-10-17T22:49:08.532503419Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind (0.01s)\n"}
+{"Time":"2026-10-17T22:49:08.532560778Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals/native-number-kind","Elapsed":0.01}
+{"Time":"2026-10-17T22:49:08.668954317Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Output":"--- PASS: TestTrustedServiceRetainedRegistryPreapprovalAndRefusals (0.30s)\n"}
+{"Time":"2026-10-17T22:49:08.715893357Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestTrustedServiceRetainedRegistryPreapprovalAndRefusals","Elapsed":0.3}
+{"Time":"2026-10-17T22:49:08.715974395Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"FAIL\n"}
+{"Time":"2026-10-17T22:49:08.71609491Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"FAIL\tgithub.com/netkingdom/access-engine/cmd/access-engine\t0.644s\n"}
+{"Time":"2026-10-17T22:49:08.716114874Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":0.645}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/recovered-source/models/db/context.go b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/recovered-source/models/db/context.go
new file mode 100644
index 00000000..2a39cbe2
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/recovered-source/models/db/context.go
@@ -0,0 +1,340 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package db
+
+import (
+ "context"
+ "database/sql"
+
+ "xorm.io/builder"
+ "xorm.io/xorm"
+)
+
+// DefaultContext is the default context to run xorm queries in
+// will be overwritten by Init with HammerContext
+var DefaultContext context.Context
+
+// contextKey is a value for use with context.WithValue.
+type contextKey struct {
+ name string
+}
+
+// enginedContextKey is a context key. It is used with context.Value() to get the current Engined for the context
+var (
+ enginedContextKey = &contextKey{"engined"}
+ _ Engined = &Context{}
+)
+
+// Context represents a db context
+type Context struct {
+ context.Context
+ e Engine
+ transaction bool
+}
+
+func newContext(ctx context.Context, e Engine, transaction bool) *Context {
+ return &Context{
+ Context: ctx,
+ e: e,
+ transaction: transaction,
+ }
+}
+
+// InTransaction if context is in a transaction
+func (ctx *Context) InTransaction() bool {
+ return ctx.transaction
+}
+
+// Engine returns db engine
+func (ctx *Context) Engine() Engine {
+ return ctx.e
+}
+
+// Value shadows Value for context.Context but allows us to get ourselves and an Engined object
+func (ctx *Context) Value(key any) any {
+ if key == enginedContextKey {
+ return ctx
+ }
+ return ctx.Context.Value(key)
+}
+
+// WithContext returns this engine tied to this context
+func (ctx *Context) WithContext(other context.Context) *Context {
+ return newContext(ctx, ctx.e.Context(other), ctx.transaction)
+}
+
+// Engined structs provide an Engine
+type Engined interface {
+ Engine() Engine
+}
+
+// GetEngine will get a db Engine from this context or return an Engine restricted to this context
+func GetEngine(ctx context.Context) Engine {
+ if e := getEngine(ctx); e != nil {
+ // A private-query marker must reach XORM's real query hooks, including
+ // inside an existing engine/transaction context. Wrapping the Go
+ // context alone does not change XORM's stored session context.
+ if isSensitiveSQL(ctx) {
+ return e.Context(ctx)
+ }
+ return e
+ }
+ return x.Context(ctx)
+}
+
+// getEngine will get a db Engine from this context or return nil
+func getEngine(ctx context.Context) Engine {
+ if engined, ok := ctx.(Engined); ok {
+ return engined.Engine()
+ }
+ enginedInterface := ctx.Value(enginedContextKey)
+ if enginedInterface != nil {
+ return enginedInterface.(Engined).Engine()
+ }
+ return nil
+}
+
+// Committer represents an interface to Commit or Close the Context
+type Committer interface {
+ Commit() error
+ Close() error
+}
+
+// halfCommitter is a wrapper of Committer.
+// It can be closed early, but can't be committed early, it is useful for reusing a transaction.
+type halfCommitter struct {
+ committer Committer
+ committed bool
+}
+
+func (c *halfCommitter) Commit() error {
+ c.committed = true
+ // should do nothing, and the parent committer will commit later
+ return nil
+}
+
+func (c *halfCommitter) Close() error {
+ if c.committed {
+ // it's "commit and close", should do nothing, and the parent committer will commit later
+ return nil
+ }
+
+ // it's "rollback and close", let the parent committer rollback right now
+ return c.committer.Close()
+}
+
+// TxContext represents a transaction Context,
+// it will reuse the existing transaction in the parent context or create a new one.
+// Some tips to use:
+//
+// 1 It's always recommended to use `WithTx` in new code instead of `TxContext`, since `WithTx` will handle the transaction automatically.
+// 2. To maintain the old code which uses `TxContext`:
+// a. Always call `Close()` before returning regardless of whether `Commit()` has been called.
+// b. Always call `Commit()` before returning if there are no errors, even if the code did not change any data.
+// c. Remember the `Committer` will be a halfCommitter when a transaction is being reused.
+// So calling `Commit()` will do nothing, but calling `Close()` without calling `Commit()` will rollback the transaction.
+// And all operations submitted by the caller stack will be rollbacked as well, not only the operations in the current function.
+// d. It doesn't mean rollback is forbidden, but always do it only when there is an error, and you do want to rollback.
+func TxContext(parentCtx context.Context) (*Context, Committer, error) {
+ if sess, ok := inTransaction(parentCtx); ok {
+ return newContext(parentCtx, sess, true), &halfCommitter{committer: sess}, nil
+ }
+
+ sess := x.NewSession()
+ if err := sess.Begin(); err != nil {
+ sess.Close()
+ return nil, nil, err
+ }
+
+ return newContext(DefaultContext, sess, true), sess, nil
+}
+
+// WithTx represents executing database operations on a transaction, if the transaction exist,
+// this function will reuse it otherwise will create a new one and close it when finished.
+func WithTx(parentCtx context.Context, f func(ctx context.Context) error) error {
+ if sess, ok := inTransaction(parentCtx); ok {
+ err := f(newContext(parentCtx, sess, true))
+ if err != nil {
+ // rollback immediately, in case the caller ignores returned error and tries to commit the transaction.
+ _ = sess.Close()
+ }
+ return err
+ }
+ return txWithNoCheck(parentCtx, f)
+}
+
+func txWithNoCheck(parentCtx context.Context, f func(ctx context.Context) error) error {
+ sess := x.NewSession()
+ defer sess.Close()
+ if err := sess.Begin(); err != nil {
+ return err
+ }
+
+ if err := f(newContext(parentCtx, sess, true)); err != nil {
+ return err
+ }
+
+ return sess.Commit()
+}
+
+// Insert inserts records into database
+func Insert(ctx context.Context, beans ...any) error {
+ _, err := GetEngine(ctx).Insert(beans...)
+ return err
+}
+
+// Exec executes a sql with args
+func Exec(ctx context.Context, sqlAndArgs ...any) (sql.Result, error) {
+ return GetEngine(ctx).Exec(sqlAndArgs...)
+}
+
+func Get[T any](ctx context.Context, cond builder.Cond) (object *T, exist bool, err error) {
+ if !cond.IsValid() {
+ panic("cond is invalid in db.Get(ctx, cond). This should not be possible.")
+ }
+
+ var bean T
+ has, err := GetEngine(ctx).Where(cond).NoAutoCondition().Get(&bean)
+ if err != nil {
+ return nil, false, err
+ } else if !has {
+ return nil, false, nil
+ }
+ return &bean, true, nil
+}
+
+func GetByID[T any](ctx context.Context, id int64) (object *T, exist bool, err error) {
+ var bean T
+ has, err := GetEngine(ctx).ID(id).NoAutoCondition().Get(&bean)
+ if err != nil {
+ return nil, false, err
+ } else if !has {
+ return nil, false, nil
+ }
+ return &bean, true, nil
+}
+
+func Exist[T any](ctx context.Context, cond builder.Cond) (bool, error) {
+ if !cond.IsValid() {
+ panic("cond is invalid in db.Exist(ctx, cond). This should not be possible.")
+ }
+
+ var bean T
+ return GetEngine(ctx).Where(cond).NoAutoCondition().Exist(&bean)
+}
+
+func ExistByID[T any](ctx context.Context, id int64) (bool, error) {
+ var bean T
+ return GetEngine(ctx).ID(id).NoAutoCondition().Exist(&bean)
+}
+
+// DeleteByID deletes the given bean with the given ID
+func DeleteByID[T any](ctx context.Context, id int64) (int64, error) {
+ var bean T
+ return GetEngine(ctx).ID(id).NoAutoCondition().NoAutoTime().Delete(&bean)
+}
+
+func DeleteByIDs[T any](ctx context.Context, ids ...int64) error {
+ if len(ids) == 0 {
+ return nil
+ }
+
+ var bean T
+ _, err := GetEngine(ctx).In("id", ids).NoAutoCondition().NoAutoTime().Delete(&bean)
+ return err
+}
+
+func Delete[T any](ctx context.Context, opts FindOptions) (int64, error) {
+ if opts == nil || !opts.ToConds().IsValid() {
+ panic("opts are empty or invalid in db.Delete(ctx, opts). This should not be possible.")
+ }
+
+ var bean T
+ return GetEngine(ctx).Where(opts.ToConds()).NoAutoCondition().NoAutoTime().Delete(&bean)
+}
+
+// DeleteByBean deletes all records according non-empty fields of the bean as conditions.
+func DeleteByBean(ctx context.Context, bean any) (int64, error) {
+ return GetEngine(ctx).Delete(bean)
+}
+
+// FindIDs finds the IDs for the given table name satisfying the given condition
+// By passing a different value than "id" for "idCol", you can query for foreign IDs, i.e. the repo IDs which satisfy the condition
+func FindIDs(ctx context.Context, tableName, idCol string, cond builder.Cond) ([]int64, error) {
+ ids := make([]int64, 0, 10)
+ if err := GetEngine(ctx).Table(tableName).
+ Cols(idCol).
+ Where(cond).
+ Find(&ids); err != nil {
+ return nil, err
+ }
+ return ids, nil
+}
+
+// DecrByIDs decreases the given column for entities of the "bean" type with one of the given ids by one
+// Timestamps of the entities won't be updated
+func DecrByIDs(ctx context.Context, ids []int64, decrCol string, bean any) error {
+ if len(ids) == 0 {
+ return nil
+ }
+ _, err := GetEngine(ctx).Decr(decrCol).In("id", ids).NoAutoCondition().NoAutoTime().Update(bean)
+ return err
+}
+
+// DeleteBeans deletes all given beans, beans must contain delete conditions.
+func DeleteBeans(ctx context.Context, beans ...any) (err error) {
+ e := GetEngine(ctx)
+ for i := range beans {
+ if _, err = e.Delete(beans[i]); err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
+// TruncateBeans deletes all given beans, beans may contain delete conditions.
+func TruncateBeans(ctx context.Context, beans ...any) (err error) {
+ e := GetEngine(ctx)
+ for i := range beans {
+ if _, err = e.Truncate(beans[i]); err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
+// CountByBean counts the number of database records according non-empty fields of the bean as conditions.
+func CountByBean(ctx context.Context, bean any) (int64, error) {
+ return GetEngine(ctx).Count(bean)
+}
+
+// TableName returns the table name according a bean object
+func TableName(bean any) string {
+ return x.TableName(bean)
+}
+
+// InTransaction returns true if the engine is in a transaction otherwise return false
+func InTransaction(ctx context.Context) bool {
+ _, ok := inTransaction(ctx)
+ return ok
+}
+
+func inTransaction(ctx context.Context) (*xorm.Session, bool) {
+ e := getEngine(ctx)
+ if e == nil {
+ return nil, false
+ }
+
+ switch t := e.(type) {
+ case *xorm.Engine:
+ return nil, false
+ case *xorm.Session:
+ if t.IsInTx() {
+ return t, true
+ }
+ return nil, false
+ default:
+ return nil, false
+ }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/reproduce.py b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/reproduce.py
new file mode 100644
index 00000000..62612ef0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/reproduce.py
@@ -0,0 +1,128 @@
+"""Reconstruct interrupted public source tests without touching owner checkouts."""
+from pathlib import Path
+import argparse
+import hashlib
+import io
+import json
+import shutil
+import subprocess
+import tarfile
+import tempfile
+import time
+
+HERE = Path(__file__).resolve().parent
+PACKET = HERE
+OWNER = Path('/home/worsch/access-engine')
+REVISION = 'd328a2601095686f74376d87791bff01e2a3a2a3'
+TOOLCHAIN = Path('/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64')
+MODULES = Path('/home/worsch/go/pkg/mod')
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('target', choices=['adapter', 'producer', 'producer-all', 'producer-race'])
+ parser.add_argument('--attempt', type=int, default=1)
+ args = parser.parse_args()
+ suffix = '' if args.attempt == 1 else '-attempt' + str(args.attempt)
+ result_path = HERE / (args.target + '-result' + suffix + '.json')
+ log_path = HERE / (args.target + '-test' + suffix + '.jsonl')
+ if result_path.exists() or log_path.exists():
+ raise SystemExit('Refusing to overwrite an earlier attempt')
+ work = Path(tempfile.mkdtemp(prefix='custodian-resume-' + args.target + '-'))
+ source = work / 'source'
+ overlay = PACKET / 'access-engine-source'
+ candidate_pins = {str(f.relative_to(overlay)): hashlib.sha256(f.read_bytes()).hexdigest()
+ for f in sorted(overlay.rglob('*')) if f.is_file()}
+ pins = json.loads((overlay / 'adapters/go/decisionpep/producer-source.json').read_text())
+ for name, digest in pins['exact_unchanged_files'].items():
+ raw = (overlay / 'adapters/go/decisionpep' / name).read_bytes()
+ assert hashlib.sha256(raw).hexdigest() == digest, name
+ assert raw == subprocess.check_output(['git', '-C', str(OWNER), 'show', REVISION + ':' + name]), name
+ if args.target == 'adapter':
+ shutil.copytree(overlay / 'adapters/go/decisionpep', source)
+ test = ['go', 'test', '-p', '4', '-json', './...', '-count=1']
+ else:
+ source.mkdir()
+ archive = subprocess.check_output(['git', '-C', str(OWNER), 'archive', REVISION])
+ with tarfile.open(fileobj=io.BytesIO(archive)) as tar:
+ tar.extractall(source, filter='data')
+ for preimage in (PACKET / 'preimages/access-engine').rglob('*'):
+ if preimage.is_file():
+ assert preimage.read_bytes() == (source / preimage.relative_to(PACKET / 'preimages/access-engine')).read_bytes()
+ for item in overlay.rglob('*'):
+ if item.is_file():
+ target = source / item.relative_to(overlay)
+ target.parent.mkdir(parents=True, exist_ok=True)
+ shutil.copyfile(item, target)
+ # Test the exact producer-owned adapter in the real producer module.
+ for item in (overlay / 'adapters/go/decisionpep').rglob('*.go'):
+ target = source / item.relative_to(overlay / 'adapters/go/decisionpep')
+ target.parent.mkdir(parents=True, exist_ok=True)
+ if target.exists():
+ assert target.read_bytes() == item.read_bytes()
+ else:
+ shutil.copyfile(item, target)
+ test = ['go', 'test', '-p', '4', '-json', './cmd/access-engine', '-run',
+ 'TestForgejoActualPolicySignedLosslessAndLegacy|TestTrustedServiceActualHTTPPositiveAndRefusals|TestTrustedServiceRetainedRegistryPreapprovalAndRefusals', '-count=1']
+ if args.target in ['producer-all', 'producer-race']:
+ test = ['go', 'test', '-p', '4', '-json', './...', '-count=1']
+ if args.target == 'producer-race':
+ test.insert(2, '-race')
+ (work / 'home').mkdir()
+ fixture_binding = []
+ fixture_pins = {}
+ if args.target in ['producer-all', 'producer-race']:
+ # Existing full-suite tests execute real sibling producer generators.
+ # Supply committed public source and only the required package code;
+ # never mount a host HOME, full virtualenv, custody file or credential.
+ fixture = work / 'public-fixtures'
+ secret_source = fixture / 'secrets-engine'
+ secret_source.mkdir(parents=True)
+ secret_revision = subprocess.check_output(['git', '-C', '/home/worsch/secrets-engine', 'rev-parse', 'HEAD'], text=True).strip()
+ archive = subprocess.check_output(['git', '-C', '/home/worsch/secrets-engine', 'archive', secret_revision, 'src'])
+ with tarfile.open(fileobj=io.BytesIO(archive)) as tar:
+ tar.extractall(secret_source, filter='data')
+ (secret_source / '.venv/bin').mkdir(parents=True)
+ (secret_source / '.venv/bin/python').symlink_to('/usr/bin/python3')
+ shutil.copytree('/home/worsch/secrets-engine/.venv/lib/python3.12/site-packages/yaml', fixture / 'python/yaml', ignore=shutil.ignore_patterns('__pycache__'))
+ registry = subprocess.check_output(['git', '-C', '/home/worsch/informed-decision', 'show', 'HEAD:deploy/intake-submitters.json'])
+ registry_file = work / 'home/informed-decision/deploy/intake-submitters.json'
+ registry_file.parent.mkdir(parents=True)
+ registry_file.write_bytes(registry)
+ fixture_pins = {str(f.relative_to(fixture)): hashlib.sha256(f.read_bytes()).hexdigest()
+ for f in sorted(fixture.rglob('*')) if f.is_file() and not f.is_symlink()}
+ fixture_pins['intake-submitters.json'] = hashlib.sha256(registry).hexdigest()
+ fixture_pins['secrets_source_revision'] = secret_revision
+ fixture_binding = ['--ro-bind', str(secret_source), '/home/worsch/secrets-engine']
+ argv = ['bwrap', '--unshare-net', '--unshare-pid', '--die-with-parent', '--new-session']
+ for name in ['/usr', '/lib', '/lib64']:
+ argv += ['--ro-bind', name, name]
+ argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev',
+ '--tmpfs', '/tmp', '--bind', str(work), '/work',
+ '--ro-bind', str(TOOLCHAIN), '/toolchain', '--ro-bind', str(MODULES), '/modules',
+ '--chdir', '/work/source', '--clearenv']
+ argv += fixture_binding
+ environment = {'PATH': '/toolchain/bin:/usr/bin:/bin', 'HOME': '/work/home',
+ 'GOTOOLCHAIN': 'local', 'GOPROXY': 'off', 'GOSUMDB': 'off',
+ 'GOMODCACHE': '/modules', 'GOCACHE': '/work/gocache',
+ 'GOMAXPROCS': '4', 'CGO_ENABLED': '1' if args.target == 'producer-race' else '0'}
+ if fixture_binding:
+ environment['PYTHONPATH'] = '/work/public-fixtures/python'
+ for key, value in environment.items():
+ argv += ['--setenv', key, value]
+ argv += ['--'] + test
+ start = time.monotonic()
+ with log_path.open('xb') as log:
+ run = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=900)
+ result = {'target': args.target, 'source_revision': REVISION, 'returncode': run.returncode,
+ 'seconds': round(time.monotonic() - start, 2), 'argv': argv,
+ 'workspace': str(work), 'network': 'disabled', 'pid_namespace': 'private',
+ 'real_credentials': False, 'canonical_owner_modified': False,
+ 'candidate_files': candidate_pins, 'public_fixture_pins': fixture_pins}
+ result_path.write_text(json.dumps(result, indent=2) + '\n')
+ print(json.dumps({'target': args.target, 'returncode': run.returncode, 'seconds': result['seconds']}))
+ raise SystemExit(run.returncode)
+
+
+if __name__ == '__main__':
+ main()
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/run_producer_refinement.py b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/run_producer_refinement.py
new file mode 100644
index 00000000..7b25349b
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/run_producer_refinement.py
@@ -0,0 +1,32 @@
+"""Reproduce shape counterexamples and their correction in the actual producer."""
+from pathlib import Path
+import hashlib
+import json
+import shutil
+import subprocess
+import sys
+import time
+
+HERE = Path(__file__).resolve().parent
+label = sys.argv[1]
+assert label in ['shapes-before', 'shapes-after']
+prior = json.loads((HERE / 'producer-all-result.json').read_text())
+assert prior['returncode'] != 0 # Completed initial full run with missing fixtures.
+source = Path(prior['workspace']) / 'source'
+overlay = HERE / 'access-engine-source'
+pins = {}
+for item in overlay.rglob('*'):
+ if item.is_file():
+ target = source / item.relative_to(overlay)
+ target.parent.mkdir(parents=True, exist_ok=True)
+ shutil.copyfile(item, target)
+ pins[str(item.relative_to(overlay))] = hashlib.sha256(item.read_bytes()).hexdigest()
+argv = prior['argv'][:prior['argv'].index('--') + 1] + ['go', 'test', '-p', '4', '-json', './cmd/access-engine', '-run', '^TestForgejoActualPolicySignedLosslessAndLegacy$', '-count=1']
+log = HERE / (label + '.jsonl')
+assert not log.exists()
+start = time.monotonic()
+with log.open('xb') as output:
+ run = subprocess.run(argv, stdout=output, stderr=subprocess.STDOUT, timeout=180)
+(HERE / (label + '.json')).write_text(json.dumps({'returncode': run.returncode, 'seconds': round(time.monotonic() - start, 2), 'argv': argv, 'source_pins': pins, 'network': 'disabled', 'pid_namespace': 'private'}, indent=2) + '\n')
+print(json.dumps({'phase': label, 'returncode': run.returncode}))
+raise SystemExit(run.returncode)
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-after.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-after.jsonl
new file mode 100644
index 00000000..9b6b8dbf
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-after.jsonl
@@ -0,0 +1,64 @@
+{"Time":"2026-10-17T23:02:42.636996993Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"}
+{"Time":"2026-10-17T23:02:42.646026443Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"}
+{"Time":"2026-10-17T23:02:42.64607436Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"}
+{"Time":"2026-10-17T23:02:42.687480707Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins"}
+{"Time":"2026-10-17T23:02:42.687522808Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins\n"}
+{"Time":"2026-10-17T23:02:42.698710773Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.698759565Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.698777257Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners"}
+{"Time":"2026-10-17T23:02:42.698784318Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners\n"}
+{"Time":"2026-10-17T23:02:42.709737369Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.709802834Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.709814349Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers"}
+{"Time":"2026-10-17T23:02:42.709821274Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers\n"}
+{"Time":"2026-10-17T23:02:42.719256293Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.719301379Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.719310919Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups"}
+{"Time":"2026-10-17T23:02:42.719316573Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups\n"}
+{"Time":"2026-10-17T23:02:42.72680925Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.726880585Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.726891929Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant"}
+{"Time":"2026-10-17T23:02:42.726898106Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant\n"}
+{"Time":"2026-10-17T23:02:42.735786052Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.735825124Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.735834159Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer"}
+{"Time":"2026-10-17T23:02:42.735838559Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer\n"}
+{"Time":"2026-10-17T23:02:42.743414049Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.743461958Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.743471634Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance"}
+{"Time":"2026-10-17T23:02:42.743476873Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance\n"}
+{"Time":"2026-10-17T23:02:42.752150093Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.752196875Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.752208281Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups"}
+{"Time":"2026-10-17T23:02:42.752215351Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups\n"}
+{"Time":"2026-10-17T23:02:42.760682007Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.76073492Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.76074391Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider"}
+{"Time":"2026-10-17T23:02:42.760747995Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/outsider\n"}
+{"Time":"2026-10-17T23:02:42.770777151Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/outsider (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.770835709Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.770846935Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups"}
+{"Time":"2026-10-17T23:02:42.770852427Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups\n"}
+{"Time":"2026-10-17T23:02:42.777920512Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.777985842Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.778012271Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer"}
+{"Time":"2026-10-17T23:02:42.778026735Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer\n"}
+{"Time":"2026-10-17T23:02:42.786891809Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.786932116Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.786939682Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action"}
+{"Time":"2026-10-17T23:02:42.78694383Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action\n"}
+{"Time":"2026-10-17T23:02:42.795039209Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.795082023Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.795104494Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource"}
+{"Time":"2026-10-17T23:02:42.79510893Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource\n"}
+{"Time":"2026-10-17T23:02:42.80195675Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.802007698Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.80201832Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut"}
+{"Time":"2026-10-17T23:02:42.80202805Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut\n"}
+{"Time":"2026-10-17T23:02:42.811920714Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut (0.01s)\n"}
+{"Time":"2026-10-17T23:02:42.811968316Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Elapsed":0.01}
+{"Time":"2026-10-17T23:02:42.828555999Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy (0.18s)\n"}
+{"Time":"2026-10-17T23:02:42.828606441Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":0.18}
+{"Time":"2026-10-17T23:02:42.828622194Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"PASS\n"}
+{"Time":"2026-10-17T23:02:42.832859699Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"ok \tgithub.com/netkingdom/access-engine/cmd/access-engine\t0.195s\n"}
+{"Time":"2026-10-17T23:02:42.832918438Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":0.196}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-before.jsonl b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-before.jsonl
new file mode 100644
index 00000000..b383c1f5
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-before.jsonl
@@ -0,0 +1,66 @@
+{"Time":"2026-10-17T23:01:47.490515679Z","Action":"start","Package":"github.com/netkingdom/access-engine/cmd/access-engine"}
+{"Time":"2026-10-17T23:01:47.528993671Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy"}
+{"Time":"2026-10-17T23:01:47.529062716Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy\n"}
+{"Time":"2026-10-17T23:01:47.678493323Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins"}
+{"Time":"2026-10-17T23:01:47.678565894Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins\n"}
+{"Time":"2026-10-17T23:01:47.714806242Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins (0.03s)\n"}
+{"Time":"2026-10-17T23:01:47.714959986Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-admins","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:47.714984675Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners"}
+{"Time":"2026-10-17T23:01:47.714994666Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners\n"}
+{"Time":"2026-10-17T23:01:47.744208882Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners (0.03s)\n"}
+{"Time":"2026-10-17T23:01:47.744291778Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-owners","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:47.744315484Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers"}
+{"Time":"2026-10-17T23:01:47.744324077Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers\n"}
+{"Time":"2026-10-17T23:01:47.767281983Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers (0.03s)\n"}
+{"Time":"2026-10-17T23:01:47.768215215Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forge-coulomb-readers","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:47.768287533Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant"}
+{"Time":"2026-10-17T23:01:47.768298606Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant\n"}
+{"Time":"2026-10-17T23:01:47.786986918Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant (0.02s)\n"}
+{"Time":"2026-10-17T23:01:47.787157389Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-tenant","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:47.787183981Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer"}
+{"Time":"2026-10-17T23:01:47.787194414Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer\n"}
+{"Time":"2026-10-17T23:01:47.828058556Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer (0.04s)\n"}
+{"Time":"2026-10-17T23:01:47.828131479Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/forged-resource-issuer","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:47.828155798Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance"}
+{"Time":"2026-10-17T23:01:47.828167241Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance\n"}
+{"Time":"2026-10-17T23:01:47.854622614Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance (0.03s)\n"}
+{"Time":"2026-10-17T23:01:47.854699568Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-assurance","Elapsed":0.03}
+{"Time":"2026-10-17T23:01:47.854717521Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource"}
+{"Time":"2026-10-17T23:01:47.854727025Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource\n"}
+{"Time":"2026-10-17T23:01:47.873861799Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource (0.02s)\n"}
+{"Time":"2026-10-17T23:01:47.873927661Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-resource","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:47.873944081Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut"}
+{"Time":"2026-10-17T23:01:47.873952891Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut\n"}
+{"Time":"2026-10-17T23:01:47.947872691Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut (0.07s)\n"}
+{"Time":"2026-10-17T23:01:47.948100493Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/claim-shortcut","Elapsed":0.07}
+{"Time":"2026-10-17T23:01:47.948174282Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups"}
+{"Time":"2026-10-17T23:01:47.948187591Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups\n"}
+{"Time":"2026-10-17T23:01:47.991945801Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Output":" forgejo_application_profile_test.go:122: actual PDP allowed adverse input\n"}
+{"Time":"2026-10-17T23:01:47.992029499Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Output":"--- FAIL: TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups (0.04s)\n"}
+{"Time":"2026-10-17T23:01:47.992047624Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-current-groups","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:47.992061285Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer"}
+{"Time":"2026-10-17T23:01:47.992070131Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer\n"}
+{"Time":"2026-10-17T23:01:48.03916284Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer (0.05s)\n"}
+{"Time":"2026-10-17T23:01:48.039228305Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-issuer","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:48.039246312Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action"}
+{"Time":"2026-10-17T23:01:48.039256285Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action\n"}
+{"Time":"2026-10-17T23:01:48.075858483Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action (0.04s)\n"}
+{"Time":"2026-10-17T23:01:48.075935743Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/wrong-action","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:48.075951325Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups"}
+{"Time":"2026-10-17T23:01:48.07595935Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups\n"}
+{"Time":"2026-10-17T23:01:48.114404291Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Output":" forgejo_application_profile_test.go:122: actual PDP allowed adverse input\n"}
+{"Time":"2026-10-17T23:01:48.116214261Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Output":"--- FAIL: TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups (0.04s)\n"}
+{"Time":"2026-10-17T23:01:48.116275632Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/object-required-groups","Elapsed":0.04}
+{"Time":"2026-10-17T23:01:48.116289032Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider"}
+{"Time":"2026-10-17T23:01:48.116297607Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/outsider\n"}
+{"Time":"2026-10-17T23:01:48.163857554Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/outsider (0.05s)\n"}
+{"Time":"2026-10-17T23:01:48.163928177Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/outsider","Elapsed":0.05}
+{"Time":"2026-10-17T23:01:48.163944147Z","Action":"run","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups"}
+{"Time":"2026-10-17T23:01:48.163952876Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"=== RUN TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups\n"}
+{"Time":"2026-10-17T23:01:48.181178835Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Output":"--- PASS: TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups (0.02s)\n"}
+{"Time":"2026-10-17T23:01:48.181243633Z","Action":"pass","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy/empty-current-groups","Elapsed":0.02}
+{"Time":"2026-10-17T23:01:48.237903183Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Output":"--- FAIL: TestForgejoActualPolicySignedLosslessAndLegacy (0.71s)\n"}
+{"Time":"2026-10-17T23:01:48.238185189Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Test":"TestForgejoActualPolicySignedLosslessAndLegacy","Elapsed":0.71}
+{"Time":"2026-10-17T23:01:48.238415877Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"FAIL\n"}
+{"Time":"2026-10-17T23:01:48.246822218Z","Action":"output","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Output":"FAIL\tgithub.com/netkingdom/access-engine/cmd/access-engine\t0.755s\n"}
+{"Time":"2026-10-17T23:01:48.247040589Z","Action":"fail","Package":"github.com/netkingdom/access-engine/cmd/access-engine","Elapsed":0.757}
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/test_composed_cli.py b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/test_composed_cli.py
new file mode 100644
index 00000000..7c1dfe8f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/test_composed_cli.py
@@ -0,0 +1,99 @@
+import pathlib,subprocess,json,sqlite3,os,shlex,time
+w=pathlib.Path('/tmp/custodian-forgejo-successor-attempt2/cli-work');s='/tmp/forgejo-private-input-r1';r='/tmp/forgejo-independent-r1'
+fixtures=w/'fixtures'; fixtures.mkdir(exist_ok=True)
+A='AbCdEf012345678-'*4;B='ZyXwVu_987654321'*4 # synthetic exact64
+assert len(A)==64 and len(B)==64
+for name,data,mode in [('good',A,0o400),('replacement',B,0o440),('newline',A+'\n',0o400),('short',A[:-1],0o400),('long',A+'A',0o400),('badbyte',A[:-1]+'=',0o400),('world',A,0o444),('writable',A,0o600),('executable',A,0o500),('empty','',0o400),('CLIENT_SECRET','',0o400)]:
+ p=fixtures/name
+ if p.exists():p.chmod(0o600)
+ p.write_text(data);p.chmod(mode)
+for name in ['symlink']:
+ p=fixtures/name
+ if not p.exists():p.symlink_to('good')
+if not (fixtures/'fifo').exists():os.mkfifo(fixtures/'fifo',0o400)
+(fixtures/'directory').mkdir(exist_ok=True)
+(fixtures/'badparent').mkdir(exist_ok=True);(fixtures/'badparent').chmod(0o777)
+if (fixtures/'badparent/value').exists():(fixtures/'badparent/value').chmod(0o600)
+(fixtures/'badparent/value').write_text(A);(fixtures/'badparent/value').chmod(0o400)
+if not (fixtures/'parentlink').exists():(fixtures/'parentlink').symlink_to('directory',target_is_directory=True)
+(w/'runtime').mkdir(exist_ok=True)
+dbfile=w/'runtime/test.db'
+if dbfile.exists():dbfile.unlink() # isolated synthetic test database only
+ini=w/'runtime/app.ini';ini.write_text('''APP_NAME = synthetic-private-input-test
+RUN_USER = worsch
+WORK_PATH = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = SYNTHETIC-TEST-KEY
+[database]
+DB_TYPE = sqlite3
+SLOW_QUERY_THRESHOLD = 1ns
+PATH = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime/test.db
+[server]
+APP_DATA_PATH = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime/data
+OFFLINE_MODE = true
+[repository]
+ROOT = /tmp/custodian-forgejo-successor-attempt2/cli-work/runtime/repos
+[log]
+MODE = console
+LEVEL = Error
+''')
+env={'PATH':'/usr/bin:/bin','HOME':str(w/'home'),'GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':str(w/'home/test.gitconfig'),'GIT_TERMINAL_PROMPT':'0','USER':'worsch','GITEA_WORK_DIR':str(w/'runtime')}
+base=['bwrap','--unshare-pid','--unshare-net','--ro-bind','/usr','/usr','--ro-bind','/lib','/lib','--ro-bind','/lib64','/lib64','--symlink','usr/bin','/bin','--proc','/proc','--dev','/dev','--tmpfs','/tmp','--bind',str(w),str(w),'--dir','/run','--ro-bind',str(fixtures),'/run/forgejo-oidc','--ro-bind',str(fixtures/'good'),'/run/forgejo-oidc/CLIENT_SECRET','--bind',str(fixtures),'/run/writable-input','--chdir',str(w/'runtime'),'--','env','-i']+[k+'='+v for k,v in env.items()]+[str(w/'forgejo'),'--config',str(ini)]
+results=[]
+def run(args,ok=True,reason=None):
+ p=subprocess.run(base+args,capture_output=True,text=True,timeout=60); output=p.stdout+p.stderr
+ assert A not in output and B not in output, 'synthetic input leaked in output'
+ assert all(A not in arg and B not in arg for arg in base+args), 'synthetic input in argv'
+ assert all(A not in v and B not in v for v in env.values()), 'synthetic input in env'
+ results.append({'operation':args,'returncode':p.returncode,'stdout_stderr_secret_absent':True})
+ (w/'cli-attempts.json').write_text(json.dumps(results,indent=2))
+ if (p.returncode==0)!=ok:raise AssertionError('CLI unexpected status: '+repr(args)+'\n'+output[-5000:])
+ if reason:assert reason in output,output[-2000:]
+ return p
+run(['migrate'])
+clean_ini=ini.read_text()
+ini.write_text(clean_ini.replace('DB_TYPE = sqlite3', 'DB_TYPE = sqlite3\nLOG_SQL = true'))
+run(['admin','auth','add-oauth','--name','refused-debug-logging','--provider','github','--secret-file','/run/forgejo-oidc/CLIENT_SECRET'],False,'OAuth configuration requires SQL logging disabled')
+ini.write_text(clean_ini)
+def rows():
+ with sqlite3.connect(w/'runtime/test.db') as db:return db.execute('select id,name,cfg from login_source order by id').fetchall()
+def cfg():return json.loads(rows()[0][2])
+run(['admin','auth','add-oauth','--name','synthetic-oauth','--provider','github','--key','synthetic-public-id','--secret-file','/run/forgejo-oidc/CLIENT_SECRET','--group-claim-name','groups','--admin-group','unchanged-admin','--scopes','read:user,user:email'])
+assert len(rows())==1 and cfg()['ClientSecret']==A
+id=str(rows()[0][0]); before=cfg()
+run(['admin','auth','update-oauth','--id',id,'--icon-url','https://synthetic.invalid/icon'])
+assert cfg()['ClientSecret']==A
+preserved=cfg()
+run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/replacement'])
+after=cfg();assert after['ClientSecret']==B
+assert {k:v for k,v in after.items() if k!='ClientSecret'}=={k:v for k,v in preserved.items() if k!='ClientSecret'},'secret replacement changed unrelated config'
+# Guarded inactive source exercises actual update omission and strict list semantics
+# without discovery/network or claiming a browser login.
+with sqlite3.connect(w/'runtime/test.db') as db:
+ guarded=after|{'Provider':'openidConnect','OpenIDConnectAutoDiscoveryURL':'https://synthetic.invalid/.well-known/openid-configuration','RequiredClaimName':'groups','RequiredClaimValues':['forge-admins','forge-coulomb-owners','forge-coulomb-readers']}
+ db.execute('update login_source set is_active=0,cfg=? where id=?',(json.dumps(guarded),id))
+run(['admin','auth','update-oauth','--id',id,'--name','synthetic-guarded'])
+assert cfg()['RequiredClaimValues']==guarded['RequiredClaimValues'] and cfg()['ClientSecret']==B
+run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/good'])
+assert cfg()['ClientSecret']==A and cfg()['RequiredClaimValues']==guarded['RequiredClaimValues']
+for path in ['/run/forgejo-oidc/'+n for n in ['newline','short','long','badbyte','world','writable','executable','empty','symlink','fifo','directory','missing','badparent/value','parentlink/value']]+['relative','','/run/forgejo-oidc/../forgejo-oidc/good','/run/writable-input/good']:
+ before=rows()
+ for cmd in [['admin','auth','add-oauth','--name','refused','--provider','github'],['admin','auth','update-oauth','--id',id,'--name','refused']]:
+ run(cmd+['--secret-file',path],False,'secret-file input refused')
+ assert rows()==before,'failure changed DB'
+for action in [['add-oauth','--name','refused'],['update-oauth','--id',id]]:
+ before=rows();run(['admin','auth']+action+['--secret','','--secret-file','/run/forgejo-oidc/good'],False,'mutually exclusive');assert rows()==before
+# Failure to clear/ambiguously replace gate keeps stored application bytes unchanged.
+before=rows();run(['admin','auth','update-oauth','--id',id,'--required-claim-values',''],False);assert rows()==before
+# Actual XORM error hook under a failing SQLite trigger must not disclose cfg.
+before=rows()
+with sqlite3.connect(w/'runtime/test.db') as database:
+ database.execute("create trigger synthetic_private_error before update on login_source begin select raise(abort, 'synthetic-db-failure'); end")
+run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/replacement'],False,'OAuth source update failed')
+assert rows()==before
+with sqlite3.connect(w/'runtime/test.db') as database:database.execute('drop trigger synthetic_private_error')
+# Legacy explicit secret remains supported; synthetic legacy string is not private input.
+run(['admin','auth','update-oauth','--id',id,'--secret','synthetic-legacy-literal'])
+assert cfg()['ClientSecret']=='synthetic-legacy-literal' and cfg()['RequiredClaimValues']==guarded['RequiredClaimValues']
+(w/'cli-results.json').write_text(json.dumps({'passed':True,'subprocesses':len(results),'real_backend_cli_and_sqlite':True,'network':'disabled by bwrap','secret_inputs':'synthetic only','values_never_in_argv_env_output':True,'actual_browser_login':False,'actual_readonly_file_bind':True,'replacement_preserves_other_config':True,'unsafe_SQL_logging_refused':True,'actual_error_and_slow_hooks_no_leak':True},indent=2));print('CLI integrations passed:',len(results))
diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/forgejo-v11.0.3/custom/conf/app.example.ini b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/forgejo-v11.0.3/custom/conf/app.example.ini
new file mode 100644
index 00000000..f8fa95bb
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/upstream/forgejo-v11.0.3/custom/conf/app.example.ini
@@ -0,0 +1,2778 @@
+; This file lists the default values used by Forgejo
+;; Copy required sections to your own app.ini (default is custom/conf/app.ini)
+;; and modify as needed.
+;; Do not copy the whole file as-is, as it contains some invalid sections for illustrative purposes.
+;; If you don't know what a setting is you should not set it.
+;;
+;; see https://forgejo.org/docs/next/admin/config-cheat-sheet for additional documentation.
+
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Default Configuration (non-`app.ini` configuration)
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; These values are environment-dependent but form the basis of a lot of values. They will be
+;; reported as part of the default configuration when running `gitea help` or on start-up. The order they are emitted there is slightly different but we will list them here in the order they are set-up.
+;;
+;; - _`AppPath`_: This is the absolute path of the running gitea binary.
+;; - _`AppWorkPath`_: This refers to "working path" of the `gitea` binary. It is determined by using the first set thing in the following hierarchy:
+;; - The "WORK_PATH" option in "app.ini" file
+;; - The `--work-path` flag passed to the binary
+;; - The environment variable `$GITEA_WORK_DIR`
+;; - A built-in value set at build time (see building from source)
+;; - Otherwise it defaults to the directory of the _`AppPath`_
+;; - If any of the above are relative paths then they are made absolute against the directory of the _`AppPath`_
+;; - _`CustomPath`_: This is the base directory for custom templates and other options. It is determined by using the first set thing in the following hierarchy:
+;; - The `--custom-path` flag passed to the binary
+;; - The environment variable `$GITEA_CUSTOM`
+;; - A built-in value set at build time (see building from source)
+;; - Otherwise it defaults to _`AppWorkPath`_`/custom`
+;; - If any of the above are relative paths then they are made absolute against the directory of the _`AppWorkPath`_
+;; - _`CustomConf`_: This is the path to the `app.ini` file.
+;; - The `--config` flag passed to the binary
+;; - A built-in value set at build time (see building from source)
+;; - Otherwise it defaults to _`CustomPath`_`/conf/app.ini`
+;; - If any of the above are relative paths then they are made absolute against the directory of the _`CustomPath`_
+;;
+;; In addition there is _`StaticRootPath`_ which can be set as a built-in at build time, but will otherwise default to _`AppWorkPath`_
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; General Settings
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; App name that shows in every page title
+APP_NAME = ; Forgejo: Beyond coding. We Forge.
+;;
+;; APP_SLOGAN shows a slogan near the App name in every page title.
+;APP_SLOGAN =
+;;
+;; APP_DISPLAY_NAME_FORMAT defines how the AppDisplayName should be presented
+;; It is used only if APP_SLOGAN is set.
+;APP_DISPLAY_NAME_FORMAT = {APP_NAME}: {APP_SLOGAN}
+;;
+;; RUN_USER will automatically detect the current user - but you can set it here change it if you run locally
+RUN_USER = ; git
+;;
+;; Application run mode, affects performance and debugging: "dev" or "prod", default is "prod"
+;; Mode "dev" makes Gitea easier to develop and debug, values other than "dev" are treated as "prod" which is for production use.
+;RUN_MODE = prod
+;;
+;; The working directory, see the comment of AppWorkPath above
+;WORK_PATH =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[server]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; The protocol the server listens on. One of 'http', 'https', 'http+unix', 'fcgi' or 'fcgi+unix'. Defaults to 'http'
+;; Note: Value must be lowercase.
+;PROTOCOL = http
+;;
+;; Expect PROXY protocol headers on connections
+;USE_PROXY_PROTOCOL = false
+;;
+;; Use PROXY protocol in TLS Bridging mode
+;PROXY_PROTOCOL_TLS_BRIDGING = false
+;;
+; Timeout to wait for PROXY protocol header (set to 0 to have no timeout)
+;PROXY_PROTOCOL_HEADER_TIMEOUT=5s
+;;
+; Accept PROXY protocol headers with UNKNOWN type
+;PROXY_PROTOCOL_ACCEPT_UNKNOWN=false
+;;
+;; Set the domain for the server
+;DOMAIN = localhost
+;;
+;; Overwrite the automatically generated public URL. Necessary for proxies and docker.
+;ROOT_URL = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/
+;;
+;; when STATIC_URL_PREFIX is empty it will follow ROOT_URL
+;STATIC_URL_PREFIX =
+;;
+;; The address to listen on. Either a IPv4/IPv6 address or the path to a unix socket.
+;; If PROTOCOL is set to `http+unix` or `fcgi+unix`, this should be the name of the Unix socket file to use.
+;; Relative paths will be made absolute against the _`AppWorkPath`_.
+;HTTP_ADDR = 0.0.0.0
+;;
+;; The port to listen on. Leave empty when using a unix socket.
+;HTTP_PORT = 3000
+;;
+;; If REDIRECT_OTHER_PORT is true, and PROTOCOL is set to https an http server
+;; will be started on PORT_TO_REDIRECT and it will redirect plain, non-secure http requests to the main
+;; ROOT_URL. Defaults are false for REDIRECT_OTHER_PORT and 80 for
+;; PORT_TO_REDIRECT.
+;REDIRECT_OTHER_PORT = false
+;PORT_TO_REDIRECT = 80
+;;
+;; expect PROXY protocol header on connections to https redirector.
+;REDIRECTOR_USE_PROXY_PROTOCOL = %(USE_PROXY_PROTOCOL)s
+;; Minimum and maximum supported TLS versions
+;SSL_MIN_VERSION=TLSv1.2
+;SSL_MAX_VERSION=
+;;
+;; SSL Curve Preferences
+;SSL_CURVE_PREFERENCES=X25519,P256
+;;
+;; SSL Cipher Suites
+;SSL_CIPHER_SUITES=; Will default to "ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305" if aes is supported by hardware, otherwise chacha will be first.
+;;
+;; Timeout for any write to the connection. (Set to -1 to disable all timeouts.)
+;PER_WRITE_TIMEOUT = 30s
+;;
+;; Timeout per Kb written to connections.
+;PER_WRITE_PER_KB_TIMEOUT = 30s
+;;
+;; Permission for unix socket
+;UNIX_SOCKET_PERMISSION = 666
+;;
+;; Local (DMZ) URL for Gitea workers (such as SSH update) accessing web service. In
+;; most cases you do not need to change the default value. Alter it only if
+;; your SSH server node is not the same as HTTP node. For different protocol, the default
+;; values are different. If `PROTOCOL` is `http+unix`, the default value is `http://unix/`.
+;; If `PROTOCOL` is `fcgi` or `fcgi+unix`, the default value is `%(PROTOCOL)s://%(HTTP_ADDR)s:%(HTTP_PORT)s/`.
+;; If listen on `0.0.0.0`, the default value is `%(PROTOCOL)s://localhost:%(HTTP_PORT)s/`, Otherwise the default
+;; value is `%(PROTOCOL)s://%(HTTP_ADDR)s:%(HTTP_PORT)s/`.
+;LOCAL_ROOT_URL = %(PROTOCOL)s://%(HTTP_ADDR)s:%(HTTP_PORT)s/
+;;
+;; When making local connections pass the PROXY protocol header.
+;LOCAL_USE_PROXY_PROTOCOL = %(USE_PROXY_PROTOCOL)s
+;;
+;; Disable SSH feature when not available
+;DISABLE_SSH = false
+;;
+;; Whether to use the builtin SSH server or not.
+;START_SSH_SERVER = false
+;;
+;; Expect PROXY protocol header on connections to the built-in SSH server
+;SSH_SERVER_USE_PROXY_PROTOCOL = false
+;;
+;; Username to use for the builtin SSH server. If blank, then it is the value of RUN_USER.
+;BUILTIN_SSH_SERVER_USER = %(RUN_USER)s
+;;
+;; Domain name to be exposed in clone URL
+;SSH_DOMAIN = %(DOMAIN)s
+;;
+;; SSH username displayed in clone URLs.
+;SSH_USER = %(BUILTIN_SSH_SERVER_USER)s
+;;
+;; The network interface the builtin SSH server should listen on
+;SSH_LISTEN_HOST =
+;;
+;; Port number to be exposed in clone URL
+;SSH_PORT = 22
+;;
+;; The port number the builtin SSH server should listen on
+;SSH_LISTEN_PORT = %(SSH_PORT)s
+;;
+;; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'.
+;SSH_ROOT_PATH =
+;;
+;; Gitea will create a authorized_keys file by default when it is not using the internal ssh server
+;; If you intend to use the AuthorizedKeysCommand functionality then you should turn this off.
+;SSH_CREATE_AUTHORIZED_KEYS_FILE = true
+;;
+;; Gitea will create a authorized_principals file by default when it is not using the internal ssh server
+;; If you intend to use the AuthorizedPrincipalsCommand functionality then you should turn this off.
+;SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE = true
+;;
+;; For the built-in SSH server, choose the ciphers to support for SSH connections,
+;; for system SSH this setting has no effect
+;SSH_SERVER_CIPHERS = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
+;;
+;; For the built-in SSH server, choose the key exchange algorithms to support for SSH connections,
+;; for system SSH this setting has no effect
+;SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1
+;;
+;; For the built-in SSH server, choose the MACs to support for SSH connections,
+;; for system SSH this setting has no effect
+;SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1
+;;
+;; For the built-in SSH server, choose the keypair to offer as the host key
+;; The private key should be at SSH_SERVER_HOST_KEY and the public SSH_SERVER_HOST_KEY.pub
+;; relative paths are made absolute relative to the %(APP_DATA_PATH)s
+;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gogs.rsa
+;;
+;; Directory to create temporary files in when testing public keys using ssh-keygen,
+;; default is the system temporary directory.
+;SSH_KEY_TEST_PATH =
+;;
+;; Use `ssh-keygen` to parse public SSH keys. The value is passed to the shell. By default, Gitea does the parsing itself.
+;SSH_KEYGEN_PATH =
+;;
+;; Enable SSH Authorized Key Backup when rewriting all keys, default is false
+;SSH_AUTHORIZED_KEYS_BACKUP = false
+;;
+;; Determines which principals to allow
+;; - empty: if SSH_TRUSTED_USER_CA_KEYS is empty this will default to off, otherwise will default to email, username.
+;; - off: Do not allow authorized principals
+;; - email: the principal must match the user's email
+;; - username: the principal must match the user's username
+;; - anything: there will be no checking on the content of the principal
+;SSH_AUTHORIZED_PRINCIPALS_ALLOW = email, username
+;;
+;; Enable SSH Authorized Principals Backup when rewriting all keys, default is true
+;SSH_AUTHORIZED_PRINCIPALS_BACKUP = true
+;;
+;; Specifies the public keys of certificate authorities that are trusted to sign user certificates for authentication.
+;; Multiple keys should be comma separated.
+;; E.g."ssh- ". or "ssh- , ssh- ".
+;; For more information see "TrustedUserCAKeys" in the sshd config manpages.
+;SSH_TRUSTED_USER_CA_KEYS =
+;; Absolute path of the `TrustedUserCaKeys` file gitea will manage.
+;; Default this `RUN_USER`/.ssh/gitea-trusted-user-ca-keys.pem
+;; If you're running your own ssh server and you want to use the gitea managed file you'll also need to modify your
+;; sshd_config to point to this file. The official docker image will automatically work without further configuration.
+;SSH_TRUSTED_USER_CA_KEYS_FILENAME =
+;;
+;; Enable exposure of SSH clone URL to anonymous visitors, default is false
+;SSH_EXPOSE_ANONYMOUS = false
+;;
+;; Command template for authorized keys entries
+;SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE = {{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}
+;;
+;; Timeout for any write to ssh connections. (Set to -1 to disable all timeouts.)
+;; Will default to the PER_WRITE_TIMEOUT.
+;SSH_PER_WRITE_TIMEOUT = 30s
+;;
+;; Timeout per Kb written to ssh connections.
+;; Will default to the PER_WRITE_PER_KB_TIMEOUT.
+;SSH_PER_WRITE_PER_KB_TIMEOUT = 30s
+;;
+;; Indicate whether to check minimum key size with corresponding type
+;MINIMUM_KEY_SIZE_CHECK = false
+;;
+;; Disable CDN even in "prod" mode
+;OFFLINE_MODE = true
+;;
+;; TLS Settings: Either ACME or manual
+;; (Other common TLS configuration are found before)
+;ENABLE_ACME = false
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; ACME automatic TLS settings
+;;
+;; ACME directory URL (e.g. LetsEncrypt's staging/testing URL: https://acme-staging-v02.api.letsencrypt.org/directory)
+;; Leave empty to default to LetsEncrypt's (production) URL
+;ACME_URL =
+;;
+;; Explicitly accept the ACME's TOS. The specific TOS cannot be retrieved at the moment.
+;ACME_ACCEPTTOS = false
+;;
+;; If the ACME CA is not in your system's CA trust chain, it can be manually added here
+;ACME_CA_ROOT =
+;;
+;; Email used for the ACME registration service
+;; Can be left blank to initialize at first run and use the cached value
+;ACME_EMAIL =
+;;
+;; ACME live directory (not to be confused with ACME directory URL: ACME_URL)
+;; (Refer to caddy's ACME manager https://github.com/caddyserver/certmagic)
+;ACME_DIRECTORY = https
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Manual TLS settings: (Only applicable if ENABLE_ACME=false)
+;;
+;; Generate steps:
+;; $ ./gitea cert -ca=true -duration=8760h0m0s -host=myhost.example.com
+;;
+;; Or from a .pfx file exported from the Windows certificate store (do
+;; not forget to export the private key):
+;; $ openssl pkcs12 -in cert.pfx -out cert.pem -nokeys
+;; $ openssl pkcs12 -in cert.pfx -out key.pem -nocerts -nodes
+;; Paths are relative to CUSTOM_PATH
+;CERT_FILE = https/cert.pem
+;KEY_FILE = https/key.pem
+;;
+;; Root directory containing templates and static files.
+;; default is the path where Gitea is executed
+;STATIC_ROOT_PATH = ; Will default to the built-in value _`StaticRootPath`_
+;;
+;; Default path for App data
+;APP_DATA_PATH = data ; relative paths will be made absolute with _`AppWorkPath`_
+;;
+;; Enable gzip compression for runtime-generated content, static resources excluded
+;ENABLE_GZIP = false
+;;
+;; Application profiling (memory and cpu)
+;; For "web" command it listens on localhost:6060
+;; For "serve" command it dumps to disk at PPROF_DATA_PATH as (cpuprofile|memprofile)__
+;ENABLE_PPROF = false
+;;
+;; PPROF_DATA_PATH, use an absolute path when you start gitea as service
+;PPROF_DATA_PATH = data/tmp/pprof ; Path is relative to _`AppWorkPath`_
+;;
+;; Landing page, can be "home", "explore", "organizations", "login", or any URL such as "/org/repo" or even "https://anotherwebsite.com"
+;; The "login" choice is not a security measure but just a UI flow change, use REQUIRE_SIGNIN_VIEW to force users to log in.
+;LANDING_PAGE = home
+;;
+;; Enables git-lfs support. true or false, default is false.
+;LFS_START_SERVER = false
+;;
+;;
+;; LFS authentication secret, change this yourself
+;LFS_JWT_SECRET =
+;;
+;; Alternative location to specify LFS authentication secret. You cannot specify both this and LFS_JWT_SECRET, and must pick one
+;LFS_JWT_SECRET_URI = file:/etc/gitea/lfs_jwt_secret
+;;
+;; LFS authentication validity period (in time.Duration), pushes taking longer than this may fail.
+;LFS_HTTP_AUTH_EXPIRY = 24h
+;;
+;; Maximum allowed LFS file size in bytes (Set to 0 for no limit).
+;LFS_MAX_FILE_SIZE = 0
+;;
+;; Maximum number of locks returned per page
+;LFS_LOCKS_PAGING_NUM = 50
+;;
+;; When clients make lfs batch requests, reject them if there are more pointers than this number
+;; zero means 'unlimited'
+;LFS_MAX_BATCH_SIZE = 0
+;;
+;; Allow graceful restarts using SIGHUP to fork
+;ALLOW_GRACEFUL_RESTARTS = true
+;;
+;; After a restart the parent will finish ongoing requests before
+;; shutting down. Force shutdown if this process takes longer than this delay.
+;; set to a negative value to disable
+;GRACEFUL_HAMMER_TIME = 60s
+;;
+;; Allows the setting of a startup timeout and waithint for Windows as SVC service
+;; 0 disables this.
+;STARTUP_TIMEOUT = 0
+;;
+;; Static resources, includes resources on custom/, public/ and all uploaded avatars web browser cache time. Note that this cache is disabled when RUN_MODE is "dev". Default is 6h
+;STATIC_CACHE_TIME = 6h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[database]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Database to use. Either "sqlite3", "mySQL" or "postgres".
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; SQLite Configuration
+;;
+DB_TYPE = sqlite3
+;PATH= ; defaults to data/forgejo.db
+;SQLITE_TIMEOUT = ; Query timeout defaults to: 500
+;SQLITE_JOURNAL_MODE = ; defaults to sqlite database default (often DELETE), can be used to enable WAL mode. https://www.sqlite.org/pragma.html#pragma_journal_mode
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; MySQL Configuration
+;;
+;DB_TYPE = mysql
+;HOST = 127.0.0.1:3306 ; can use socket e.g. /var/run/mysqld/mysqld.sock
+;NAME = gitea
+;USER = root
+;PASSWD = ;Use PASSWD = `your password` for quoting if you use special characters in the password.
+;SSL_MODE = false ; either "false" (default), "true", or "skip-verify"
+;CHARSET_COLLATION = ; Empty as default, Gitea will try to find a case-sensitive collation. Don't change it unless you clearly know what you need.
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Postgres Configuration
+;;
+;DB_TYPE = postgres
+;HOST = 127.0.0.1:5432 ; can use socket e.g. /var/run/postgresql/
+;NAME = gitea
+;USER = root
+;PASSWD =
+;SCHEMA =
+;SSL_MODE=disable ;either "disable" (default), "require", or "verify-full"
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Other settings
+;;
+;; For iterate buffer, default is 50
+;ITERATE_BUFFER_SIZE = 50
+;;
+;; Show the database generated SQL
+;LOG_SQL = false
+;;
+;; Maximum number of DB Connect retries
+;DB_RETRIES = 10
+;;
+;; Backoff time per DB retry (time.Duration)
+;DB_RETRY_BACKOFF = 3s
+;;
+;; Max idle database connections on connection pool, default is 2
+;MAX_IDLE_CONNS = 2
+;;
+;; Database connection max life time, default is 0 or 3s mysql (See #6804 & #7071 for reasoning)
+;CONN_MAX_LIFETIME = 3s
+;;
+;; Database connection max idle time, 0 prevents closing due to idle time.
+;CONN_MAX_IDLETIME = 0
+;;
+;; Database maximum number of open connections, default is 100 which is the lowest default from Postgres (MariaDB + MySQL default to 151). Ensure you only increase the value if you configured your database server accordingly.
+;MAX_OPEN_CONNS = 100
+;;
+;; Whether execute database models migrations automatically
+;AUTO_MIGRATION = true
+;;
+;; Threshold value (in seconds) beyond which query execution time is logged as a warning in the xorm logger
+;;
+;SLOW_QUERY_TRESHOLD = 5s
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[security]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Whether the installer is disabled (set to true to disable the installer)
+INSTALL_LOCK = false
+;;
+;; Global secret key that will be used
+;; This key is VERY IMPORTANT. If you lose it, the data encrypted by it (like 2FA secret) can't be decrypted anymore.
+SECRET_KEY =
+;;
+;; Alternative location to specify secret key, instead of this file; you cannot specify both this and SECRET_KEY, and must pick one
+;; This key is VERY IMPORTANT. If you lose it, the data encrypted by it (like 2FA secret) can't be decrypted anymore.
+;SECRET_KEY_URI = file:/etc/gitea/secret_key
+;;
+;; Secret used to validate communication within Gitea binary.
+INTERNAL_TOKEN =
+;;
+;; Alternative location to specify internal token, instead of this file; you cannot specify both this and INTERNAL_TOKEN, and must pick one
+;INTERNAL_TOKEN_URI = file:/etc/gitea/internal_token
+;;
+;; How long to remember that a user is logged in before requiring relogin (in days)
+;LOGIN_REMEMBER_DAYS = 31
+;;
+;; Name of cookie used to store authentication information.
+;COOKIE_REMEMBER_NAME = gitea_incredible
+;;
+;; Reverse proxy authentication header name of user name, email, and full name
+;REVERSE_PROXY_AUTHENTICATION_USER = X-WEBAUTH-USER
+;REVERSE_PROXY_AUTHENTICATION_EMAIL = X-WEBAUTH-EMAIL
+;REVERSE_PROXY_AUTHENTICATION_FULL_NAME = X-WEBAUTH-FULLNAME
+;;
+;; Interpret X-Forwarded-For header or the X-Real-IP header and set this as the remote IP for the request
+;REVERSE_PROXY_LIMIT = 1
+;;
+;; List of IP addresses and networks separated by comma of trusted proxy servers. Use `*` to trust all.
+;REVERSE_PROXY_TRUSTED_PROXIES = 127.0.0.0/8,::1/128
+;;
+;; The minimum password length for new Users
+;MIN_PASSWORD_LENGTH = 8
+;;
+;; Set to true to allow users to import local server paths
+;IMPORT_LOCAL_PATHS = false
+;;
+;; Set to false to allow users with git hook privileges to create custom git hooks.
+;; Custom git hooks can be used to perform arbitrary code execution on the host operating system.
+;; This enables the users to access and modify this config file and the Gitea database and interrupt the Gitea service.
+;; By modifying the Gitea database, users can gain Gitea administrator privileges.
+;; It also enables them to access other resources available to the user on the operating system that is running the Gitea instance and perform arbitrary actions in the name of the Gitea OS user.
+;; WARNING: This maybe harmful to you website or your operating system.
+;; WARNING: Setting this to true does not change existing hooks in git repos; adjust it before if necessary.
+;DISABLE_GIT_HOOKS = true
+;;
+;; Set to true to disable webhooks feature.
+;DISABLE_WEBHOOKS = false
+;;
+;; Set to false to allow pushes to gitea repositories despite having an incomplete environment - NOT RECOMMENDED
+;ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET = true
+;;
+;;Comma separated list of character classes required to pass minimum complexity.
+;;If left empty or no valid values are specified, the default is off (no checking)
+;;Classes include "lower,upper,digit,spec"
+;PASSWORD_COMPLEXITY = off
+;;
+;; Password Hash algorithm, either "argon2", "pbkdf2"/"pbkdf2_v2", "pbkdf2_hi", "scrypt" or "bcrypt"
+;PASSWORD_HASH_ALGO = pbkdf2_hi
+;;
+;; Set false to allow JavaScript to read CSRF cookie
+;CSRF_COOKIE_HTTP_ONLY = true
+;;
+;; Validate against https://haveibeenpwned.com/Passwords to see if a password has been exposed
+;PASSWORD_CHECK_PWN = false
+;;
+;; Cache successful token hashes. API tokens are stored in the DB as pbkdf2 hashes however, this means that there is a potentially significant hashing load when there are multiple API operations.
+;; This cache will store the successfully hashed tokens in a LRU cache as a balance between performance and security.
+;SUCCESSFUL_TOKENS_CACHE_SIZE = 20
+;;
+;; Reject API tokens sent in URL query string (Accept Header-based API tokens only). This avoids security vulnerabilities
+;; stemming from cached/logged plain-text API tokens.
+;; In future releases, this will become the default behavior
+;DISABLE_QUERY_AUTH_TOKEN = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[camo]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; At the moment we only support images
+;;
+;; if the camo is enabled
+;ENABLED = false
+;; url to a camo image proxy, it **is required** if camo is enabled.
+;SERVER_URL =
+;; HMAC to encode urls with, it **is required** if camo is enabled.
+;HMAC_KEY =
+;; Set to true to use camo for https too lese only non https urls are proxyed
+;; ALLWAYS is deprecated and will be removed in the future
+;ALWAYS = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[oauth2]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Enables OAuth2 provider
+ENABLED = true
+;;
+;; Algorithm used to sign OAuth2 tokens. Valid values: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, EdDSA
+;JWT_SIGNING_ALGORITHM = RS256
+;;
+;; Private key file path used to sign OAuth2 tokens. The path is relative to APP_DATA_PATH.
+;; This setting is only needed if JWT_SIGNING_ALGORITHM is set to RS256, RS384, RS512, ES256, ES384 or ES512.
+;; The file must contain a RSA or ECDSA private key in the PKCS8 format. If no key exists a 4096 bit key will be created for you.
+;JWT_SIGNING_PRIVATE_KEY_FILE = jwt/private.pem
+;;
+;; OAuth2 authentication secret for access and refresh tokens, change this yourself to a unique string. CLI generate option is helpful in this case. https://docs.gitea.io/en-us/command-line/#generate
+;; This setting is only needed if JWT_SIGNING_ALGORITHM is set to HS256, HS384 or HS512.
+;JWT_SECRET =
+;;
+;; Alternative location to specify OAuth2 authentication secret. You cannot specify both this and JWT_SECRET, and must pick one
+;JWT_SECRET_URI = file:/etc/gitea/oauth2_jwt_secret
+;;
+;; Lifetime of an OAuth2 access token in seconds
+;ACCESS_TOKEN_EXPIRATION_TIME = 3600
+;;
+;; Lifetime of an OAuth2 refresh token in hours
+;REFRESH_TOKEN_EXPIRATION_TIME = 730
+;;
+;; Check if refresh token got already used
+;INVALIDATE_REFRESH_TOKENS = false
+;;
+;; Maximum length of oauth2 token/cookie stored on server
+;MAX_TOKEN_LENGTH = 32767
+;;
+;; Pre-register OAuth2 applications for some universally useful services
+;; * https://github.com/hickford/git-credential-oauth
+;; * https://github.com/git-ecosystem/git-credential-manager
+;; * https://gitea.com/gitea/tea
+;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[log]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Root path for the log files - defaults to %(GITEA_WORK_DIR)/log
+;ROOT_PATH =
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Main Logger
+;;
+;; Either "console", "file" or "conn", default is "console"
+;; Use comma to separate multiple modes, e.g. "console, file"
+MODE = console
+;;
+;; Either "Trace", "Debug", "Info", "Warn", "Error" or "None", default is "Info"
+LEVEL = Info
+;;
+;; Print Stacktrace with logs (rarely helpful, do not set) Either "Trace", "Debug", "Info", "Warn", "Error", default is "None"
+;STACKTRACE_LEVEL = None
+;;
+;; Buffer length of the channel, keep it as it is if you don't know what it is.
+;BUFFER_LEN = 10000
+;;
+;; Sub logger modes, a single comma means use default MODE above, empty means disable it
+;logger.access.MODE=
+;logger.router.MODE=,
+;logger.xorm.MODE=,
+;;
+;; Collect SSH logs (Creates log from ssh git request)
+;;
+;ENABLE_SSH_LOG = false
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Access Logger (Creates log in NCSA common log format)
+;;
+;; Print request id which parsed from request headers in access log, when access log is enabled.
+;; * E.g:
+;; * In request Header: X-Request-ID: test-id-123
+;; * Configuration in app.ini: REQUEST_ID_HEADERS = X-Request-ID
+;; * Print in log: 127.0.0.1:58384 - - [14/Feb/2023:16:33:51 +0800] "test-id-123"
+;;
+;; If you configure more than one in the .ini file, it will match in the order of configuration,
+;; and the first match will be finally printed in the log.
+;; * E.g:
+;; * In request Header: X-Trace-ID: trace-id-1q2w3e4r
+;; * Configuration in app.ini: REQUEST_ID_HEADERS = X-Request-ID, X-Trace-ID, X-Req-ID
+;; * Print in log: 127.0.0.1:58384 - - [14/Feb/2023:16:33:51 +0800] "trace-id-1q2w3e4r"
+;;
+;REQUEST_ID_HEADERS =
+;;
+;; Sets the template used to create the access log.
+;ACCESS_LOG_TEMPLATE = {{.Ctx.RemoteHost}} - {{.Identity}} {{.Start.Format "[02/Jan/2006:15:04:05 -0700]" }} "{{.Ctx.Req.Method}} {{.Ctx.Req.URL.RequestURI}} {{.Ctx.Req.Proto}}" {{.ResponseWriter.Status}} {{.ResponseWriter.Size}} "{{.Ctx.Req.Referer}}" "{{.Ctx.Req.UserAgent}}"
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Log modes (aka log writers)
+;;
+;[log.%(WriterMode)]
+;MODE=console/file/conn/...
+;LEVEL=
+;FLAGS = stdflags or journald
+;EXPRESSION =
+;PREFIX =
+;COLORIZE = false
+;;
+;[log.console]
+;STDERR = false
+;;
+;[log.file]
+;; Set the file_name for the logger. If this is a relative path this will be relative to ROOT_PATH
+;FILE_NAME =
+;; This enables automated log rotate(switch of following options), default is true
+;LOG_ROTATE = true
+;; Max size shift of a single file, default is 28 means 1 << 28, 256MB
+;MAX_SIZE_SHIFT = 28
+;; Segment log daily, default is true
+;DAILY_ROTATE = true
+;; delete the log file after n days, default is 7
+;MAX_DAYS = 7
+;; compress logs with gzip
+;COMPRESS = true
+;; compression level see godoc for compress/gzip
+;COMPRESSION_LEVEL = -1
+;;
+;[log.conn]
+;; Reconnect host for every single message, default is false
+;RECONNECT_ON_MSG = false
+;; Try to reconnect when connection is lost, default is false
+;RECONNECT = false
+;; Either "tcp", "unix" or "udp", default is "tcp"
+;PROTOCOL = tcp
+;; Host address
+;ADDR =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[git]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; The path of git executable. If empty, Gitea searches through the PATH environment.
+;PATH =
+;;
+;; The HOME directory for Git
+;HOME_PATH = %(APP_DATA_PATH)s/home
+;;
+;; Disables highlight of added and removed changes
+;DISABLE_DIFF_HIGHLIGHT = false
+;;
+;; Max number of lines allowed in a single file in diff view
+;MAX_GIT_DIFF_LINES = 1000
+;;
+;; Max number of allowed characters in a line in diff view
+;MAX_GIT_DIFF_LINE_CHARACTERS = 5000
+;;
+;; Max number of files shown in diff view
+;MAX_GIT_DIFF_FILES = 100
+;;
+;; Set the default commits range size
+;COMMITS_RANGE_SIZE = 50
+;;
+;; Set the default branches range size
+;BRANCHES_RANGE_SIZE = 20
+;;
+;; Print out verbose infos on push to stdout
+;VERBOSE_PUSH = true
+;;
+;; Delay before verbose push infos are printed to stdout
+;VERBOSE_PUSH_DELAY = 5s
+;;
+;; Arguments for command 'git gc', e.g. "--aggressive --auto"
+;; see more on http://git-scm.com/docs/git-gc/
+;GC_ARGS =
+;;
+;; If use git wire protocol version 2 when git version >= 2.18, default is true, set to false when you always want git wire protocol version 1
+;; To enable this for Git over SSH when using a OpenSSH server, add `AcceptEnv GIT_PROTOCOL` to your sshd_config file.
+;ENABLE_AUTO_GIT_WIRE_PROTOCOL = true
+;;
+;; Respond to pushes to a non-default branch with a URL for creating a Pull Request (if the repository has them enabled)
+;PULL_REQUEST_PUSH_MESSAGE = true
+;;
+;; (Go-Git only) Don't cache objects greater than this in memory. (Set to 0 to disable.)
+;LARGE_OBJECT_THRESHOLD = 1048576
+;; Set to true to forcibly set core.protectNTFS=false
+;DISABLE_CORE_PROTECT_NTFS=false
+;; Disable the usage of using partial clones for git.
+;DISABLE_PARTIAL_CLONE = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Git Operation timeout in seconds
+;[git.timeout]
+;DEFAULT = 360
+;MIGRATE = 600
+;MIRROR = 300
+;CLONE = 300
+;PULL = 300
+;GC = 60
+;GREP = 2
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Git config options
+;; This section only does "set" config, a removed config key from this section won't be removed from git config automatically. The format is `some.configKey = value`.
+;[git.config]
+;diff.algorithm = histogram
+;core.logAllRefUpdates = true
+;gc.reflogExpire = 90
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+[service]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Time limit to confirm account/email registration
+;ACTIVE_CODE_LIVE_MINUTES = 180
+;;
+;; Time limit to perform the reset of a forgotten password
+;RESET_PASSWD_CODE_LIVE_MINUTES = 180
+;;
+;; Whether a new user needs to confirm their email when registering.
+;REGISTER_EMAIL_CONFIRM = false
+;;
+;; Whether a new user needs to be confirmed manually after registration. (Requires `REGISTER_EMAIL_CONFIRM` to be disabled.)
+;REGISTER_MANUAL_CONFIRM = false
+;;
+;; List of domain names that are allowed to be used to register on a Gitea instance, wildcard is supported
+;; eg: gitea.io,example.com,*.mydomain.com
+;EMAIL_DOMAIN_ALLOWLIST =
+;;
+;; Comma-separated list of domain names that are not allowed to be used to register on a Gitea instance, wildcard is supported
+;EMAIL_DOMAIN_BLOCKLIST =
+;;
+;; Disallow registration, only allow admins to create accounts.
+;DISABLE_REGISTRATION = false
+;;
+;; Allow registration only using gitea itself, it works only when DISABLE_REGISTRATION is false
+;ALLOW_ONLY_INTERNAL_REGISTRATION = false
+;;
+;; Allow registration only using third-party services, it works only when DISABLE_REGISTRATION is false
+;ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+;;
+;; User must sign in to view anything.
+;REQUIRE_SIGNIN_VIEW = false
+;;
+;; Mail notification
+;ENABLE_NOTIFY_MAIL = false
+;;
+;; This setting enables gitea to be signed in with HTTP BASIC Authentication using the user's password
+;; If you set this to false you will not be able to access the tokens endpoints on the API with your password
+;; Please note that setting this to false will not disable OAuth Basic or Basic authentication using a token
+;ENABLE_BASIC_AUTHENTICATION = true
+;;
+;; More detail: https://github.com/gogits/gogs/issues/165
+;ENABLE_REVERSE_PROXY_AUTHENTICATION = false
+; Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.
+;ENABLE_REVERSE_PROXY_AUTHENTICATION_API = false
+;ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
+;ENABLE_REVERSE_PROXY_EMAIL = false
+;ENABLE_REVERSE_PROXY_FULL_NAME = false
+;;
+;; Enable captcha validation for registration
+;ENABLE_CAPTCHA = false
+;;
+;; Enable this to require captcha validation for login
+;REQUIRE_CAPTCHA_FOR_LOGIN = false
+;;
+;; Requires captcha for external registrations
+;REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA = false
+;; Requires a password for external registrations
+;REQUIRE_EXTERNAL_REGISTRATION_PASSWORD = false
+;;
+;; Type of captcha you want to use. Options: image, recaptcha, hcaptcha, mcaptcha, cfturnstile.
+;CAPTCHA_TYPE = image
+;;
+;; Change this to use recaptcha.net or other recaptcha service
+;RECAPTCHA_URL = https://www.google.com/recaptcha/
+;; Enable recaptcha to use Google's recaptcha service
+;; Go to https://www.google.com/recaptcha/admin to sign up for a key
+;RECAPTCHA_SECRET =
+;RECAPTCHA_SITEKEY =
+;;
+;; For hCaptcha, create an account at https://accounts.hcaptcha.com/login to get your keys
+;HCAPTCHA_SECRET =
+;HCAPTCHA_SITEKEY =
+;;
+;; Change this to use demo.mcaptcha.org or your self-hosted mcaptcha.org instance.
+;MCAPTCHA_URL = https://demo.mcaptcha.org
+;;
+;; Go to your configured mCaptcha instance and register a sitekey
+;; and use your account's secret.
+;MCAPTCHA_SECRET =
+;MCAPTCHA_SITEKEY =
+;;
+;; Go to https://dash.cloudflare.com/?to=/:account/turnstile to sign up for a key
+;CF_TURNSTILE_SITEKEY =
+;CF_TURNSTILE_SECRET =
+;;
+;; Default value for KeepEmailPrivate
+;; Each new user will get the value of this setting copied into their profile
+;DEFAULT_KEEP_EMAIL_PRIVATE = false
+;;
+;; Default value for AllowCreateOrganization
+;; Every new user will have rights set to create organizations depending on this setting
+;DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+;; Default value for IsRestricted
+;; Every new user will have restricted permissions depending on this setting
+;DEFAULT_USER_IS_RESTRICTED = false
+;;
+;; Users will be able to use dots when choosing their username. Disabling this is
+;; helpful if your usersare having issues with e.g. RSS feeds or advanced third-party
+;; extensions that use strange regex patterns.
+; ALLOW_DOTS_IN_USERNAMES = true
+;;
+;; Either "public", "limited" or "private", default is "public"
+;; Limited is for users visible only to signed users
+;; Private is for users visible only to members of their organizations
+;; Public is for users visible for everyone
+;DEFAULT_USER_VISIBILITY = public
+;;
+;; Set which visibility modes a user can have
+;ALLOWED_USER_VISIBILITY_MODES = public,limited,private
+;;
+;; Either "public", "limited" or "private", default is "public"
+;; Limited is for organizations visible only to signed users
+;; Private is for organizations visible only to members of the organization
+;; Public is for organizations visible to everyone
+;DEFAULT_ORG_VISIBILITY = public
+;;
+;; Default value for DefaultOrgMemberVisible
+;; True will make the membership of the users visible when added to the organisation
+;DEFAULT_ORG_MEMBER_VISIBLE = false
+;;
+;; Default value for EnableDependencies
+;; Repositories will use dependencies by default depending on this setting
+;DEFAULT_ENABLE_DEPENDENCIES = true
+;;
+;; Dependencies can be added from any repository where the user is granted access or only from the current repository depending on this setting.
+;ALLOW_CROSS_REPOSITORY_DEPENDENCIES = true
+;;
+;; Default map service. No external API support has been included. A service has to allow
+;; searching using URL parameters, the location will be appended to the URL as escaped query parameter.
+;; Some example values are:
+;; - OpenStreetMap: https://www.openstreetmap.org/search?query=
+;; - Google Maps: https://www.google.com/maps/place/
+;; - MapQuest: https://www.mapquest.com/search/
+;; - Bing Maps: https://www.bing.com/maps?where1=
+; USER_LOCATION_MAP_URL = https://www.openstreetmap.org/search?query=
+;;
+;; Enable heatmap on users profiles.
+;ENABLE_USER_HEATMAP = true
+;;
+;; Enable Timetracking
+;ENABLE_TIMETRACKING = true
+;;
+;; Default value for EnableTimetracking
+;; Repositories will use timetracking by default depending on this setting
+;DEFAULT_ENABLE_TIMETRACKING = true
+;;
+;; Default value for AllowOnlyContributorsToTrackTime
+;; Only users with write permissions can track time if this is true
+;DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME = true
+;;
+;; Value for the domain part of the user's email address in the git log if user
+;; has set KeepEmailPrivate to true. The user's email will be replaced with a
+;; concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS. Default
+;; value is "noreply." + DOMAIN, where DOMAIN resolves to the value from server.DOMAIN
+;; Note: do not use the notation below
+;NO_REPLY_ADDRESS = ; noreply.
+;;
+;; Show Registration button
+;SHOW_REGISTRATION_BUTTON = true
+;;
+;; Whether to allow internal signin
+; ENABLE_INTERNAL_SIGNIN = true
+;;
+;; Show milestones dashboard page - a view of all the user's milestones
+;SHOW_MILESTONES_DASHBOARD_PAGE = true
+;;
+;; Default value for AutoWatchNewRepos
+;; When adding a repo to a team or creating a new repo all team members will watch the
+;; repo automatically if enabled
+;AUTO_WATCH_NEW_REPOS = true
+;;
+;; Default value for AutoWatchOnChanges
+;; Make the user watch a repository When they commit for the first time
+;AUTO_WATCH_ON_CHANGES = false
+;;
+;; Minimum amount of time a user must exist before comments are kept when the user is deleted.
+;USER_DELETE_WITH_COMMENTS_MAX_TIME = 0
+;; Valid site url schemes for user profiles
+;VALID_SITE_URL_SCHEMES=http,https
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[service.explore]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Only allow signed in users to view the explore pages.
+;REQUIRE_SIGNIN_VIEW = false
+;;
+;; Disable the users explore page.
+;DISABLE_USERS_PAGE = false
+;;
+;; Disable the organizations explore page.
+;DISABLE_ORGANIZATIONS_PAGE = false
+;;
+;; Disable the code explore page.
+;DISABLE_CODE_PAGE = false
+;;
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Other Settings
+;;
+;; Uncomment the [section.header] if you wish to
+;; set the below settings.
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[badges]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Enable repository badges (via shields.io or a similar generator)
+;ENABLED = true
+;; Template for the badge generator.
+;GENERATOR_URL_TEMPLATE = https://img.shields.io/badge/{{.label}}-{{.text}}-{{.color}}
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Root path for storing all repository data. By default, it is set to %(APP_DATA_PATH)s/gitea-repositories.
+;; A relative path is interpreted as _`AppWorkPath`_/%(ROOT)s
+;ROOT =
+;;
+;; The script type this server supports. Usually this is `bash`, but some users report that only `sh` is available.
+;SCRIPT_TYPE = bash
+;;
+;; DETECTED_CHARSETS_ORDER tie-break order for detected charsets.
+;; If the charsets have equal confidence, tie-breaking will be done by order in this list
+;; with charsets earlier in the list chosen in preference to those later.
+;; Adding "defaults" will place the unused charsets at that position.
+;DETECTED_CHARSETS_ORDER = UTF-8, UTF-16BE, UTF-16LE, UTF-32BE, UTF-32LE, ISO-8859, windows-1252, ISO-8859, windows-1250, ISO-8859, ISO-8859, ISO-8859, windows-1253, ISO-8859, windows-1255, ISO-8859, windows-1251, windows-1256, KOI8-R, ISO-8859, windows-1254, Shift_JIS, GB18030, EUC-JP, EUC-KR, Big5, ISO-2022, ISO-2022, ISO-2022, IBM424_rtl, IBM424_ltr, IBM420_rtl, IBM420_ltr
+;;
+;; Default ANSI charset to override non-UTF-8 charsets to
+;ANSI_CHARSET =
+;;
+;; Force every new repository to be private
+;FORCE_PRIVATE = false
+;;
+;; Default privacy setting when creating a new repository, allowed values: last, private, public. Default is last which means the last setting used.
+;DEFAULT_PRIVATE = last
+;;
+;; Default private when using push-to-create
+;DEFAULT_PUSH_CREATE_PRIVATE = true
+;;
+;; Global limit of repositories per user, applied at creation time. -1 means no limit
+;MAX_CREATION_LIMIT = -1
+;;
+;; Preferred Licenses to place at the top of the List
+;; The name here must match the filename in options/license or custom/options/license
+;PREFERRED_LICENSES = Apache-2.0,MIT
+;;
+;; Disable the ability to interact with repositories using the HTTP protocol
+;DISABLE_HTTP_GIT = false
+;;
+;; Value for Access-Control-Allow-Origin header, default is not to present
+;; WARNING: This may be harmful to your website if you do not give it a right value.
+;ACCESS_CONTROL_ALLOW_ORIGIN =
+;;
+;; Force ssh:// clone url instead of scp-style uri when default SSH port is used
+;USE_COMPAT_SSH_URI = true
+;;
+;; Value for the "go get" request returns the repository url as https or ssh, default is https
+;GO_GET_CLONE_URL_PROTOCOL = https
+;;
+;; Close issues as long as a commit on any branch marks it as fixed
+;DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH = false
+;;
+;; Allow users to push local repositories to Gitea and have them automatically created for a user or an org
+;ENABLE_PUSH_CREATE_USER = false
+;ENABLE_PUSH_CREATE_ORG = false
+;;
+;; Comma separated list of globally disabled repo units. Allowed values: repo.issues, repo.ext_issues, repo.pulls, repo.wiki, repo.ext_wiki, repo.projects, repo.packages, repo.actions.
+;DISABLED_REPO_UNITS =
+;;
+;; Comma separated list of default new repo units. Allowed values: repo.code, repo.releases, repo.issues, repo.pulls, repo.wiki, repo.projects, repo.packages, repo.actions.
+;; Note: Code and Releases can currently not be deactivated. If you specify default repo units you should still list them for future compatibility.
+;; External wiki and issue tracker can't be enabled by default as it requires additional settings.
+;; Disabled repo units will not be added to new repositories regardless if it is in the default list.
+;DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions
+;;
+;; Comma separated list of default forked repo units.
+;; The set of allowed values and rules are the same as DEFAULT_REPO_UNITS.
+;DEFAULT_FORK_REPO_UNITS = repo.code,repo.pulls
+;;
+;; Prefix archive files by placing them in a directory named after the repository
+;PREFIX_ARCHIVE_FILES = true
+;;
+;; Disable migrating feature.
+;DISABLE_MIGRATIONS = false
+;;
+;; Disable stars feature.
+;DISABLE_STARS = false
+;;
+;; Disable repository forking.
+;DISABLE_FORKS = false
+;;
+;; The default branch name of new repositories
+;DEFAULT_BRANCH = main
+;;
+;; Allow adoption of unadopted repositories
+;ALLOW_ADOPTION_OF_UNADOPTED_REPOSITORIES = false
+;;
+;; Allow deletion of unadopted repositories
+;ALLOW_DELETION_OF_UNADOPTED_REPOSITORIES = false
+
+;; Don't allow download source archive files from UI
+;DISABLE_DOWNLOAD_SOURCE_ARCHIVES = false
+
+;; Allow fork repositories without maximum number limit
+;ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT = true
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.editor]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; List of file extensions for which lines should be wrapped in the Monaco editor
+;; Separate extensions with a comma. To line wrap files without an extension, just put a comma
+;LINE_WRAP_EXTENSIONS = .txt,.md,.markdown,.mdown,.mkd,.livemd,
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.local]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Path for local repository copy. Defaults to `tmp/local-repo` (content gets deleted on gitea restart)
+;LOCAL_COPY_PATH = tmp/local-repo
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.upload]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Whether repository file uploads are enabled. Defaults to `true`
+;ENABLED = true
+;;
+;; Path for uploads. Defaults to `data/tmp/uploads` (content gets deleted on gitea restart)
+;TEMP_PATH = data/tmp/uploads
+;;
+;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
+;ALLOWED_TYPES =
+;;
+;; Max size of each file in megabytes. Defaults to 50MB
+;FILE_MAX_SIZE = 50
+;;
+;; Max number of files per upload. Defaults to 5
+;MAX_FILES = 5
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.pull-request]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; List of prefixes used in Pull Request title to mark them as Work In Progress (matched in a case-insensitive manner)
+;WORK_IN_PROGRESS_PREFIXES = WIP:,[WIP]
+;;
+;; List of keywords used in Pull Request comments to automatically close a related issue
+;CLOSE_KEYWORDS = close,closes,closed,fix,fixes,fixed,resolve,resolves,resolved
+;;
+;; List of keywords used in Pull Request comments to automatically reopen a related issue
+;REOPEN_KEYWORDS = reopen,reopens,reopened
+;;
+;; Set default merge style for repository creating, valid options: merge, rebase, rebase-merge, squash, fast-forward-only
+;DEFAULT_MERGE_STYLE = merge
+;;
+;; In the default merge message for squash commits include at most this many commits
+;DEFAULT_MERGE_MESSAGE_COMMITS_LIMIT = 50
+;;
+;; In the default merge message for squash commits limit the size of the commit messages to this
+;DEFAULT_MERGE_MESSAGE_SIZE = 5120
+;;
+;; In the default merge message for squash commits walk all commits to include all authors in the Co-authored-by otherwise just use those in the limited list
+;DEFAULT_MERGE_MESSAGE_ALL_AUTHORS = false
+;;
+;; In default merge messages limit the number of approvers listed as Reviewed-by: to this many
+;DEFAULT_MERGE_MESSAGE_MAX_APPROVERS = 10
+;;
+;; In default merge messages only include approvers who are official
+;DEFAULT_MERGE_MESSAGE_OFFICIAL_APPROVERS_ONLY = true
+;;
+;; If an squash commit's comment should be populated with the commit messages of the squashed commits
+;POPULATE_SQUASH_COMMENT_WITH_COMMIT_MESSAGES = false
+;;
+;; Add co-authored-by and co-committed-by trailers if committer does not match author
+;ADD_CO_COMMITTER_TRAILERS = true
+;;
+;; In addition to testing patches using the three-way merge method, re-test conflicting patches with git apply
+;TEST_CONFLICTING_PATCHES_WITH_GIT_APPLY = false
+;;
+;; Retarget child pull requests to the parent pull request branch target on merge of parent pull request. It only works on merged PRs where the head and base branch target the same repo.
+;RETARGET_CHILDREN_ON_MERGE = true
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.issue]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; List of reasons why a Pull Request or Issue can be locked
+;LOCK_REASONS = Too heated,Off-topic,Spam,Resolved
+;; Maximum number of pinned Issues per repo
+;; Set to 0 to disable pinning Issues
+;MAX_PINNED = 3
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.release]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
+;ALLOWED_TYPES =
+;DEFAULT_PAGING_NUM = 10
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.signing]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; GPG key to use to sign commits, Defaults to the default - that is the value of git config --get user.signingkey
+;; run in the context of the RUN_USER
+;; Switch to none to stop signing completely
+;SIGNING_KEY = default
+;;
+;; If a SIGNING_KEY ID is provided and is not set to default, use the provided Name and Email address as the signer.
+;; These should match a publicized name and email address for the key. (When SIGNING_KEY is default these are set to
+;; the results of git config --get user.name and git config --get user.email respectively and can only be overridden
+;; by setting the SIGNING_KEY ID to the correct ID.)
+;SIGNING_NAME =
+;SIGNING_EMAIL =
+;;
+;; Sets the default trust model for repositories. Options are: collaborator, committer, collaboratorcommitter
+;DEFAULT_TRUST_MODEL = collaborator
+;;
+;; Determines when gitea should sign the initial commit when creating a repository
+;; Either:
+;; - never
+;; - pubkey: only sign if the user has a pubkey
+;; - twofa: only sign if the user has logged in with twofa
+;; - always
+;; options other than none and always can be combined as comma separated list
+;INITIAL_COMMIT = always
+;;
+;; Determines when to sign for CRUD actions
+;; - as above
+;; - parentsigned: requires that the parent commit is signed.
+;CRUD_ACTIONS = pubkey, twofa, parentsigned
+;; Determines when to sign Wiki commits
+;; - as above
+;WIKI = never
+;;
+;; Determines when to sign on merges
+;; - basesigned: require that the parent of commit on the base repo is signed.
+;; - commitssigned: require that all the commits in the head branch are signed.
+;; - approved: only sign when merging an approved pr to a protected branch
+;MERGES = pubkey, twofa, basesigned, commitssigned
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[repository.mimetype_mapping]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Custom MIME type mapping for downloadable files
+;.apk=application/vnd.android.package-archive
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[project]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Default templates for project boards
+;PROJECT_BOARD_BASIC_KANBAN_TYPE = To Do, In Progress, Done
+;PROJECT_BOARD_BUG_TRIAGE_TYPE = Needs Triage, High Priority, Low Priority, Closed
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cors]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; More information about CORS can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#The_HTTP_response_headers
+;; enable cors headers (disabled by default)
+;ENABLED = false
+;;
+;; list of requesting origins that are allowed, eg: "https://*.example.com"
+;ALLOW_DOMAIN = *
+;;
+;; list of methods allowed to request
+;METHODS = GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
+;;
+;; max time to cache response
+;MAX_AGE = 10m
+;;
+;; allow request with credentials
+;ALLOW_CREDENTIALS = false
+;;
+;; headers to permit
+;HEADERS = Content-Type,User-Agent
+;;
+;; set X-FRAME-OPTIONS header
+;X_FRAME_OPTIONS = SAMEORIGIN
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ui]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Number of repositories that are displayed on one explore page
+;EXPLORE_PAGING_NUM = 20
+;;
+;; Number of issues that are displayed on one page
+;ISSUE_PAGING_NUM = 20
+;;
+;; Number of repositories that are displayed on one page when searching.
+;REPO_SEARCH_PAGING_NUM = 20
+;;
+;; Number of members that are displayed on one page
+;MEMBERS_PAGING_NUM = 20
+;;
+;; Number of maximum commits displayed in one activity feed
+;FEED_MAX_COMMIT_NUM = 5
+;;
+;; Number of items that are displayed in home feed
+;FEED_PAGING_NUM = 20
+;;
+;; Number of items that are displayed in a single subsitemap
+;SITEMAP_PAGING_NUM = 20
+;;
+;; Number of packages that are displayed on one page
+;PACKAGES_PAGING_NUM = 20
+;;
+;; Number of maximum commits displayed in commit graph.
+;GRAPH_MAX_COMMIT_NUM = 100
+;;
+;; Number of line of codes shown for a code comment
+;CODE_COMMENT_LINES = 4
+;;
+;; Max size of files to be displayed (default is 8MiB)
+;MAX_DISPLAY_FILE_SIZE = 8388608
+;;
+;; Detect ambiguous unicode characters in file contents and show warnings on the UI
+;AMBIGUOUS_UNICODE_DETECTION = true
+;;
+;; Whether the email of the user should be shown in the Explore Users page
+;SHOW_USER_EMAIL = true
+;;
+;; Set the default theme for the Gitea install
+;DEFAULT_THEME = forgejo-auto
+;;
+;; All available themes. Allow users select personalized themes regardless of the value of `DEFAULT_THEME`.
+;; By default available:
+;; - forgejo-auto, forgejo-light, forgejo-dark
+;; - gitea-auto, gitea-light, gitea-dark
+;; - forgejo-auto-deuteranopia-protanopia, forgejo-light-deuteranopia-protanopia, forgejo-dark-deuteranopia-protanopia
+;; - forgejo-auto-tritanopia, forgejo-light-tritanopia, forgejo-dark-tritanopia
+;THEMES = gitea-auto,gitea-light,gitea-dark
+;;
+;; All available reactions users can choose on issues/prs and comments.
+;; Values can be emoji alias (:smile:) or a unicode emoji.
+;; For custom reactions, add a tightly cropped square image to public/assets/img/emoji/reaction_name.png
+;REACTIONS = +1, -1, laugh, hooray, confused, heart, rocket, eyes
+;;
+;; Change the number of users that are displayed in reactions tooltip (triggered by mouse hover).
+;REACTION_MAX_USER_NUM = 10
+;;
+;; Additional Emojis not defined in the utf8 standard
+;; By default we support gitea (:gitea:), to add more copy them to public/assets/img/emoji/emoji_name.png and add it to this config.
+;; Dont mistake it for Reactions.
+;CUSTOM_EMOJIS = gitea, codeberg, gitlab, git, github, gogs, forgejo
+;;
+;; Whether the full name of the users should be shown where possible. If the full name isn't set, the username will be used.
+;DEFAULT_SHOW_FULL_NAME = false
+;;
+;; Whether to search within description at repository search on explore page.
+;SEARCH_REPO_DESCRIPTION = true
+;;
+;; Whether to only show relevant repos on the explore page when no keyword is specified and default sorting is used.
+;; A repo is considered irrelevant if it's a fork or if it has no metadata (no description, no icon, no topic).
+;ONLY_SHOW_RELEVANT_REPOS = false
+;;
+;; Change the sort type of the explore pages.
+;; Default is "recentupdate", but you also have "alphabetically", "reverselastlogin", "newest", "oldest".
+;EXPLORE_PAGING_DEFAULT_SORT = recentupdate
+;;
+;; The tense all timestamps should be rendered in. Possible values are `absolute` time (i.e. 1970-01-01, 11:59) and `mixed`.
+;; `mixed` means most timestamps are rendered in relative time (i.e. 2 days ago).
+;PREFERRED_TIMESTAMP_TENSE = mixed
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ui.admin]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Number of users that are displayed on one page
+;USER_PAGING_NUM = 50
+;;
+;; Number of repos that are displayed on one page
+;REPO_PAGING_NUM = 50
+;;
+;; Number of notices that are displayed on one page
+;NOTICE_PAGING_NUM = 25
+;;
+;; Number of organizations that are displayed on one page
+;ORG_PAGING_NUM = 50
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ui.user]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Number of repos that are displayed on one page
+;REPO_PAGING_NUM = 15
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ui.meta]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;AUTHOR = Forgejo – Beyond coding. We forge.
+;DESCRIPTION = Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.
+;KEYWORDS = git,forge,forgejo
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ui.notification]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Control how often the notification endpoint is polled to update the notification
+;; The timeout will increase to MAX_TIMEOUT in TIMEOUT_STEPs if the notification count is unchanged
+;; Set MIN_TIMEOUT to -1 to turn off
+;MIN_TIMEOUT = 10s
+;MAX_TIMEOUT = 60s
+;TIMEOUT_STEP = 10s
+;;
+;; This setting determines how often the db is queried to get the latest notification counts.
+;; If the browser client supports EventSource and SharedWorker, a SharedWorker will be used in preference to polling notification. Set to -1 to disable the EventSource
+;EVENT_SOURCE_UPDATE_TIME = 10s
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ui.svg]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Whether to render SVG files as images. If SVG rendering is disabled, SVG files are displayed as text and cannot be embedded in markdown files as images.
+;ENABLE_RENDER = true
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ui.csv]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Maximum allowed file size in bytes to render CSV files as table. (Set to 0 for no limit).
+;MAX_FILE_SIZE = 524288
+;;
+;; Maximum allowed rows to render CSV files. (Set to 0 for no limit)
+;MAX_ROWS = 2500
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[markdown]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Render soft line breaks as hard line breaks, which means a single newline character between
+;; paragraphs will cause a line break and adding trailing whitespace to paragraphs is not
+;; necessary to force a line break.
+;; Render soft line breaks as hard line breaks for comments
+;ENABLE_HARD_LINE_BREAK_IN_COMMENTS = true
+;;
+;; Render soft line breaks as hard line breaks for markdown documents
+;ENABLE_HARD_LINE_BREAK_IN_DOCUMENTS = false
+;;
+;; Comma separated list of custom URL-Schemes that are allowed as links when rendering Markdown
+;; for example git,magnet,ftp (more at https://en.wikipedia.org/wiki/List_of_URI_schemes)
+;; URLs starting with http and https are always displayed, whatever is put in this entry.
+;; If this entry is empty, all URL schemes are allowed.
+;CUSTOM_URL_SCHEMES =
+;;
+;; List of file extensions that should be rendered/edited as Markdown
+;; Separate the extensions with a comma. To render files without any extension as markdown, just put a comma
+;FILE_EXTENSIONS = .md,.markdown,.mdown,.mkd,.livemd
+;;
+;; Enables math inline and block detection
+;ENABLE_MATH = true
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[ssh.minimum_key_sizes]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Define allowed algorithms and their minimum key length (use -1 to disable a type)
+;ED25519 = 256
+;ECDSA = 256
+;RSA = 3071 ; we allow 3071 here because an otherwise valid 3072 bit RSA key can be reported as having 3071 bit length
+;DSA = -1 ; set to 1024 to switch on
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[indexer]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Issue Indexer settings
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Issue indexer type, currently support: bleve, db, elasticsearch or meilisearch default is bleve
+;ISSUE_INDEXER_TYPE = bleve
+;;
+;; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve
+;ISSUE_INDEXER_PATH = indexers/issues.bleve ; Relative paths will be made absolute against _`AppWorkPath`_.
+;;
+;; Issue indexer connection string, available when ISSUE_INDEXER_TYPE is elasticsearch (e.g. http://elastic:password@localhost:9200) or meilisearch (e.g. http://:apikey@localhost:7700)
+;ISSUE_INDEXER_CONN_STR =
+;;
+;; Issue indexer name, available when ISSUE_INDEXER_TYPE is elasticsearch or meilisearch.
+;ISSUE_INDEXER_NAME = gitea_issues
+;;
+;; Timeout the indexer if it takes longer than this to start.
+;; Set to -1 to disable timeout.
+;STARTUP_TIMEOUT = 30s
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Repository Indexer settings
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; repo indexer by default disabled, since it uses a lot of disk space
+;REPO_INDEXER_ENABLED = false
+;;
+;; repo indexer units, the items to index, could be `sources`, `forks`, `mirrors`, `templates` or any combination of them separated by a comma.
+;; If empty then it defaults to `sources` only, as if you'd like to disable fully please see REPO_INDEXER_ENABLED.
+;REPO_INDEXER_REPO_TYPES = sources,forks,mirrors,templates
+;;
+;; Code search engine type, could be `bleve` or `elasticsearch`.
+;REPO_INDEXER_TYPE = bleve
+;;
+;; Index file used for code search. available when `REPO_INDEXER_TYPE` is bleve
+;REPO_INDEXER_PATH = indexers/repos.bleve
+;;
+;; Code indexer connection string, available when `REPO_INDEXER_TYPE` is elasticsearch. i.e. http://elastic:changeme@localhost:9200
+;REPO_INDEXER_CONN_STR =
+;;
+;; Code indexer name, available when `REPO_INDEXER_TYPE` is elasticsearch
+;REPO_INDEXER_NAME = gitea_codes
+;;
+;; A comma separated list of glob patterns (see https://github.com/gobwas/glob) to include
+;; in the index; default is empty
+;REPO_INDEXER_INCLUDE =
+;;
+;; A comma separated list of glob patterns to exclude from the index; ; default is empty
+;REPO_INDEXER_EXCLUDE =
+;;
+;; If vendored files should be excluded.
+;; See https://github.com/go-enry/go-enry for more details which files are considered to be vendored.
+;REPO_INDEXER_EXCLUDE_VENDORED = true
+;;
+;; The maximum filesize to include for indexing
+;MAX_FILE_SIZE = 1048576
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[queue]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Specific queues can be individually configured with [queue.name]. [queue] provides defaults
+;; ([queue.issue_indexer] is special due to the old configuration described above)
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; General queue queue type, currently support: persistable-channel, channel, level, redis, dummy
+;; default to persistable-channel
+;TYPE = persistable-channel
+;;
+;; data-dir for storing persistable queues and level queues, individual queues will default to `queues/common` meaning the queue is shared.
+;DATADIR = queues/ ; Relative paths will be made absolute against `%(APP_DATA_PATH)s`.
+;;
+;; Default queue length before a channel queue will block
+;LENGTH = 100000
+;;
+;; Batch size to send for batched queues
+;BATCH_LENGTH = 20
+;;
+;; Connection string for redis queues this will store the redis (or Redis cluster) connection string.
+;; When `TYPE` is `persistable-channel`, this provides a directory for the underlying leveldb
+;; or additional options of the form `leveldb://path/to/db?option=value&....`, and will override `DATADIR`.
+;CONN_STR = "redis://127.0.0.1:6379/0"
+;;
+;; Provides the suffix of the default redis/disk queue name - specific queues can be overridden within in their [queue.name] sections.
+;QUEUE_NAME = "_queue"
+;;
+;; Provides the suffix of the default redis/disk unique queue set name - specific queues can be overridden within in their [queue.name] sections.
+;SET_NAME = "_unique"
+;;
+;; Maximum number of worker go-routines for the queue. Default value is "CpuNum/2" clipped to between 1 and 10.
+;MAX_WORKERS = ; (dynamic)
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[admin]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Disallow regular (non-admin) users from creating organizations.
+;DISABLE_REGULAR_ORG_CREATION = false
+;;
+;; Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disabled
+;DEFAULT_EMAIL_NOTIFICATIONS = enabled
+;; Send an email to all admins when a new user signs up to inform the admins about this act. Options: true, false
+;SEND_NOTIFICATION_EMAIL_ON_NEW_USER = false
+;; Disabled features for users, could be "deletion", "manage_ssh_keys","manage_gpg_keys" more features can be disabled in future
+;; - deletion: a user cannot delete their own account
+;; - manage_ssh_keys: a user cannot configure ssh keys
+;; - manage_gpg_keys: a user cannot configure gpg keys
+;USER_DISABLED_FEATURES =
+;; Comma separated list of disabled features ONLY if the user has an external login type (eg. LDAP, Oauth, etc.), could be `deletion`, `manage_ssh_keys`, `manage_gpg_keys`. This setting is independent from `USER_DISABLED_FEATURES` and supplements its behavior.
+;; - deletion: a user cannot delete their own account
+;; - manage_ssh_keys: a user cannot configure ssh keys
+;; - manage_gpg_keys: a user cannot configure gpg keys
+;;EXTERNAL_USER_DISABLE_FEATURES =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[openid]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; OpenID is an open, standard and decentralized authentication protocol.
+;; Your identity is the address of a webpage you provide, which describes
+;; how to prove you are in control of that page.
+;;
+;; For more info: https://en.wikipedia.org/wiki/OpenID
+;;
+;; Current implementation supports OpenID-2.0
+;;
+;; Tested to work providers at the time of writing:
+;; - Any GNUSocial node (your.hostname.tld/username)
+;; - Any SimpleID provider (http://simpleid.koinic.net)
+;; - http://openid.org.cn/
+;; - openid.stackexchange.com
+;; - login.launchpad.net
+;; - .livejournal.com
+;;
+;; Whether to allow signin in via OpenID
+;ENABLE_OPENID_SIGNIN = true
+;;
+;; Whether to allow registering via OpenID
+;; Do not include to rely on rhw DISABLE_REGISTRATION setting
+;ENABLE_OPENID_SIGNUP = true
+;;
+;; Allowed URI patterns (POSIX regexp).
+;; Space separated.
+;; Only these would be allowed if non-blank.
+;; Example value: trusted.domain.org trusted.domain.net
+;WHITELISTED_URIS =
+;;
+;; Forbidden URI patterns (POSIX regexp).
+;; Space separated.
+;; Only used if WHITELISTED_URIS is blank.
+;; Example value: loadaverage.org/badguy stackexchange.com/.*spammer
+;BLACKLISTED_URIS =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[oauth2_client]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Whether a new auto registered oauth2 user needs to confirm their email.
+;; Do not include to use the REGISTER_EMAIL_CONFIRM setting from the `[service]` section.
+;REGISTER_EMAIL_CONFIRM =
+;;
+;; Scopes for the openid connect oauth2 provider (separated by space, the openid scope is implicitly added).
+;; Typical values are profile and email.
+;; For more information about the possible values see https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
+;OPENID_CONNECT_SCOPES =
+;;
+;; Automatically create user accounts for new oauth2 users.
+;ENABLE_AUTO_REGISTRATION = false
+;;
+;; The source of the username for new oauth2 accounts:
+;; userid = use the userid / sub attribute
+;; nickname = use the nickname attribute
+;; email = use the username part of the email attribute
+;; Note: `nickname` and `email` options will normalize input strings using the following criteria:
+;; - diacritics are removed
+;; - the characters in the set `['´\x60]` are removed
+;; - the characters in the set `[\s~+]` are replaced with `-`
+;USERNAME = nickname
+;;
+;; Update avatar if available from oauth2 provider.
+;; Update will be performed on each login.
+;UPDATE_AVATAR = false
+;;
+;; How to handle if an account / email already exists:
+;; disabled = show an error
+;; login = show an account linking login
+;; auto = link directly with the account
+;ACCOUNT_LINKING = login
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[webhook]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Hook task queue length, increase if webhook shooting starts hanging
+;QUEUE_LENGTH = 1000
+;;
+;; Deliver timeout in seconds
+;DELIVER_TIMEOUT = 5
+;;
+;; Webhook can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
+;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
+;; CIDR list: 1.2.3.0/8, 2001:db8::/32
+;; Wildcard hosts: *.mydomain.com, 192.168.100.*
+;; Since 1.15.7. Default to * for 1.15.x, external for 1.16 and later
+;ALLOWED_HOST_LIST = external
+;;
+;; Allow insecure certification
+;SKIP_TLS_VERIFY = false
+;;
+;; Number of history information in each page
+;PAGING_NUM = 10
+;;
+;; Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy
+;PROXY_URL =
+;;
+;; Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts.
+;PROXY_HOSTS =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[mailer]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; NOTICE: this section is for Gitea 1.18 and later. If you are using Gitea 1.17 or older,
+;; please refer to
+;; https://github.com/go-gitea/gitea/blob/release/v1.17/custom/conf/app.example.ini
+;; https://github.com/go-gitea/gitea/blob/release/v1.17/docs/content/doc/advanced/config-cheat-sheet.en-us.md
+;;
+;ENABLED = false
+;;
+;; Buffer length of channel, keep it as it is if you don't know what it is.
+;SEND_BUFFER_LEN = 100
+;;
+;; Prefix displayed before subject in mail
+;SUBJECT_PREFIX =
+;;
+;; Mail server protocol. One of "smtp", "smtps", "smtp+starttls", "smtp+unix", "sendmail", "dummy".
+;; - sendmail: use the operating system's `sendmail` command instead of SMTP. This is common on Linux systems.
+;; - dummy: send email messages to the log as a testing phase.
+;; If your provider does not explicitly say which protocol it uses but does provide a port,
+;; you can set SMTP_PORT instead and this will be inferred.
+;; (Before 1.18, see the notice, this was controlled via MAILER_TYPE and IS_TLS_ENABLED.)
+;PROTOCOL =
+;;
+;; Mail server address, e.g. smtp.gmail.com.
+;; For smtp+unix, this should be a path to a unix socket instead.
+;; (Before 1.18, see the notice, this was combined with SMTP_PORT as HOST.)
+;SMTP_ADDR =
+;;
+;; Mail server port. Common ports are:
+;; 25: insecure SMTP
+;; 465: SMTP Secure
+;; 587: StartTLS
+;; If no protocol is specified, it will be inferred by this setting.
+;; (Before 1.18, this was combined with SMTP_ADDR as HOST.)
+;SMTP_PORT =
+;;
+;; Enable HELO operation. Defaults to true.
+;ENABLE_HELO = true
+;;
+;; Custom hostname for HELO operation.
+;; If no value is provided, one is retrieved from system.
+;HELO_HOSTNAME =
+;;
+;; If set to `true`, completely ignores server certificate validation errors.
+;; This option is unsafe. Consider adding the certificate to the system trust store instead.
+;FORCE_TRUST_SERVER_CERT = false
+;;
+;; Use client certificate in connection.
+;USE_CLIENT_CERT = false
+;CLIENT_CERT_FILE = custom/mailer/cert.pem
+;CLIENT_KEY_FILE = custom/mailer/key.pem
+;;
+;; Mail from address, RFC 5322. This can be just an email address, or the `"Name" ` format
+;FROM =
+;;
+;; Sometimes it is helpful to use a different address on the envelope. Set this to use ENVELOPE_FROM as the from on the envelope. Set to `<>` to send an empty address.
+;ENVELOPE_FROM =
+;;
+;; If gitea sends mails on behave of users, it will just use the name also displayed in the WebUI. If you want e.g. `Mister X (by CodeIt) `,
+;; set it to `{{ .DisplayName }} (by {{ .AppName }})`. Available Variables: `.DisplayName`, `.AppName` and `.Domain`.
+;FROM_DISPLAY_NAME_FORMAT = {{ .DisplayName }}
+;;
+;; Mailer user name and password, if required by provider.
+;USER =
+;;
+;; Use PASSWD = `your password` for quoting if you use special characters in the password.
+;PASSWD =
+;;
+;; Send mails only in plain text, without HTML alternative
+;SEND_AS_PLAIN_TEXT = false
+;;
+;; Specify an alternative sendmail binary
+;SENDMAIL_PATH = sendmail
+;;
+;; Specify any extra sendmail arguments
+;; WARNING: if your sendmail program interprets options you should set this to "--" or terminate these args with "--"
+;SENDMAIL_ARGS =
+;;
+;; Timeout for Sendmail
+;SENDMAIL_TIMEOUT = 5m
+;;
+;; convert \r\n to \n for Sendmail
+;SENDMAIL_CONVERT_CRLF = true
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[mailer.override_header]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; This is empty by default, use it only if you know what you need it for.
+;Reply-To = test@example.com, test2@example.com
+;Content-Type = text/html; charset=utf-8
+;In-Reply-To =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[email.incoming]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Enable handling of incoming emails.
+;ENABLED = false
+;;
+;; The email address including the %{token} placeholder that will be replaced per user/action.
+;; Example: incoming+%{token}@example.com
+;; The placeholder must appear in the user part of the address (before the @).
+;REPLY_TO_ADDRESS =
+;;
+;; IMAP server host
+;HOST =
+;;
+;; IMAP server port
+;PORT =
+;;
+;; Username of the receiving account
+;USERNAME =
+;;
+;; Password of the receiving account
+;PASSWORD =
+;;
+;; Whether the IMAP server uses TLS.
+;USE_TLS = false
+;;
+;; If set to true, completely ignores server certificate validation errors. This option is unsafe.
+;SKIP_TLS_VERIFY = true
+;;
+;; The mailbox name where incoming mail will end up.
+;MAILBOX = INBOX
+;;
+;; Whether handled messages should be deleted from the mailbox.
+;DELETE_HANDLED_MESSAGE = true
+;;
+;; Maximum size of a message to handle. Bigger messages are ignored. Set to 0 to allow every size.
+;MAXIMUM_MESSAGE_SIZE = 10485760
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cache]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Either "memory", "redis", "memcache", or "twoqueue". default is "memory"
+;ADAPTER = memory
+;;
+;; For "memory" only, GC interval in seconds, default is 60
+;INTERVAL = 60
+;;
+;; For "redis" and "memcache", connection host address
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
+;; memcache: `127.0.0.1:11211`
+;; twoqueue: `{"size":50000,"recent_ratio":0.25,"ghost_ratio":0.5}` or `50000`
+;HOST =
+;;
+;; Time to keep items in cache if not used, default is 16 hours.
+;; Setting it to -1 disables caching
+;ITEM_TTL = 16h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Last commit cache
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cache.last_commit]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Time to keep items in cache if not used, default is 8760 hours.
+;; Setting it to -1 disables caching
+;ITEM_TTL = 8760h
+;;
+;; Only enable the cache when repository's commits count great than
+;COMMITS_COUNT = 1000
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[session]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Either "memory", "file", "redis", "db", "mysql", "couchbase", "memcache" or "postgres"
+;; Default is "memory". "db" will reuse the configuration in [database]
+;PROVIDER = memory
+;;
+;; Provider config options
+;; memory: doesn't have any config yet
+;; file: session file path, e.g. `data/sessions`
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` (or `redis+cluster://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s` for a Redis cluster)
+;; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
+;PROVIDER_CONFIG = data/sessions ; Relative paths will be made absolute against _`AppWorkPath`_.
+;;
+;; Session cookie name
+;COOKIE_NAME = i_like_gitea
+;;
+;; If you use session in https only: true or false. If not set, it defaults to `true` if the ROOT_URL is an HTTPS URL.
+;COOKIE_SECURE =
+;;
+;; Session GC time interval in seconds, default is 86400 (1 day)
+;GC_INTERVAL_TIME = 86400
+;;
+;; Session life time in seconds, default is 86400 (1 day)
+;SESSION_LIFE_TIME = 86400
+;;
+;; Cookie domain name. Default is empty
+;DOMAIN =
+;;
+;; SameSite settings. Either "none", "lax", or "strict"
+;SAME_SITE=lax
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[picture]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; How Gitea deals with missing repository avatars
+;; none = no avatar will be displayed; random = random avatar will be displayed; image = default image will be used
+;REPOSITORY_AVATAR_FALLBACK = none
+;REPOSITORY_AVATAR_FALLBACK_IMAGE = /img/repo_default.png
+;;
+;; Max Width and Height of uploaded avatars.
+;; This is to limit the amount of RAM used when resizing the image.
+;AVATAR_MAX_WIDTH = 4096
+;AVATAR_MAX_HEIGHT = 4096
+;;
+;; The multiplication factor for rendered avatar images.
+;; Larger values result in finer rendering on HiDPI devices.
+;AVATAR_RENDERED_SIZE_FACTOR = 2
+;;
+;; Maximum allowed file size for uploaded avatars.
+;; This is to limit the amount of RAM used when resizing the image.
+;AVATAR_MAX_FILE_SIZE = 1048576
+;;
+;; If the uploaded file is not larger than this byte size, the image will be used as is, without resizing/converting.
+;AVATAR_MAX_ORIGIN_SIZE = 262144
+;;
+;; Chinese users can choose "duoshuo"
+;; or a custom avatar source, like: http://cn.gravatar.com/avatar/
+;GRAVATAR_SOURCE = gravatar
+;;
+;; This value will always be true in offline mode.
+;DISABLE_GRAVATAR = false
+;;
+;; Federated avatar lookup uses DNS to discover avatar associated
+;; with emails, see https://www.libravatar.org
+;; This value will always be false in offline mode or when Gravatar is disabled.
+;ENABLE_FEDERATED_AVATAR = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[attachment]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Whether issue and pull request attachments are enabled. Defaults to `true`
+;ENABLED = true
+;;
+;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
+;ALLOWED_TYPES = .avif,.cpuprofile,.csv,.dmp,.docx,.fodg,.fodp,.fods,.fodt,.gif,.gz,.jpeg,.jpg,.json,.jsonc,.log,.md,.mov,.mp4,.odf,.odg,.odp,.ods,.odt,.patch,.pdf,.png,.pptx,.svg,.tgz,.txt,.webm,.webp,.xls,.xlsx,.zip
+;;
+;; Max size of each file. Defaults to 2048MB
+;MAX_SIZE = 2048
+;;
+;; Max number of files per upload. Defaults to 5
+;MAX_FILES = 5
+;;
+;; Storage type for attachments, `local` for local disk or `minio` for s3 compatible
+;; object storage service, default is `local`.
+;STORAGE_TYPE = local
+;;
+;; Allows the storage driver to redirect to authenticated URLs to serve files directly
+;; Currently, only `minio` is supported.
+;SERVE_DIRECT = false
+;;
+;; Path for attachments. Defaults to `attachments`. Only available when STORAGE_TYPE is `local`
+;; Relative paths will be resolved to `${AppDataPath}/${attachment.PATH}`
+;PATH = attachments
+;;
+;; Minio endpoint to connect only available when STORAGE_TYPE is `minio`
+;MINIO_ENDPOINT = localhost:9000
+;;
+;; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`.
+;; If not provided and STORAGE_TYPE is `minio`, will search for credentials in known
+;; environment variables (MINIO_ACCESS_KEY_ID, AWS_ACCESS_KEY_ID), credentials files
+;; (~/.mc/config.json, ~/.aws/credentials), and EC2 instance metadata.
+;MINIO_ACCESS_KEY_ID =
+;;
+;; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
+;MINIO_SECRET_ACCESS_KEY =
+;;
+;; Minio bucket to store the attachments only available when STORAGE_TYPE is `minio`
+;MINIO_BUCKET = gitea
+;;
+;; Url lookup for the minio bucket only available when STORAGE_TYPE is `minio`
+;; Available values: auto, dns, path
+;; If empty, it behaves the same as "auto" was set
+;MINIO_BUCKET_LOOKUP =
+;;
+;; Minio location to create bucket only available when STORAGE_TYPE is `minio`
+;MINIO_LOCATION = us-east-1
+;;
+;; Minio base path on the bucket only available when STORAGE_TYPE is `minio`
+;MINIO_BASE_PATH = attachments/
+;;
+;; Minio enabled ssl only available when STORAGE_TYPE is `minio`
+;MINIO_USE_SSL = false
+;;
+;; Minio skip SSL verification available when STORAGE_TYPE is `minio`
+;MINIO_INSECURE_SKIP_VERIFY = false
+;;
+;; Minio checksum algorithm: default (for MinIO or AWS S3) or md5 (for Cloudflare or Backblaze)
+;MINIO_CHECKSUM_ALGORITHM = default
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[time]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Location the UI time display i.e. Asia/Shanghai
+;; Empty means server's location setting
+;DEFAULT_UI_LOCATION =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Common settings
+;;
+;; Setting this to true will enable all cron tasks periodically with default settings.
+;ENABLED = false
+;; Setting this to true will run all enabled cron tasks when Gitea starts.
+;RUN_AT_START = false
+;;
+;; Note: ``SCHEDULE`` accept formats
+;; - Full crontab specs, e.g. "* * * * * ?"
+;; - Descriptors, e.g. "@midnight", "@every 1h30m"
+;; See more: https://pkg.go.dev/github.com/gogs/cron@v0.0.0-20171120032916-9f6c956d3e14
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Basic cron tasks - enabled by default
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Clean up old repository archives
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.archive_cleanup]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Whether to enable the job
+;ENABLED = true
+;; Whether to always run at least once at start up time (if ENABLED)
+;RUN_AT_START = true
+;; Whether to emit notice on successful execution too
+;NOTICE_ON_SUCCESS = false
+;; Time interval for job to run
+;SCHEDULE = @midnight
+;; Archives created more than OLDER_THAN ago are subject to deletion
+;OLDER_THAN = 24h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Update mirrors
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.update_mirrors]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;SCHEDULE = @every 10m
+;; Enable running Update mirrors task periodically.
+;ENABLED = true
+;; Run Update mirrors task when Gitea starts.
+;RUN_AT_START = false
+;; Notice if not success
+;NOTICE_ON_SUCCESS = false
+;; Limit the number of mirrors added to the queue to this number
+;; (negative values mean no limit, 0 will result in no result in no mirrors being queued effectively disabling pull mirror updating.)
+;PULL_LIMIT=50
+;; Limit the number of mirrors added to the queue to this number
+;; (negative values mean no limit, 0 will result in no mirrors being queued effectively disabling push mirror updating)
+;PUSH_LIMIT=50
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Repository health check
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.repo_health_check]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;SCHEDULE = @midnight
+;; Enable running Repository health check task periodically.
+;ENABLED = true
+;; Run Repository health check task when Gitea starts.
+;RUN_AT_START = false
+;; Notice if not success
+;NOTICE_ON_SUCCESS = false
+;TIMEOUT = 60s
+;; Arguments for command 'git fsck', e.g. "--unreachable --tags"
+;; see more on http://git-scm.com/docs/git-fsck
+;ARGS =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Check repository statistics
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.check_repo_stats]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Enable running check repository statistics task periodically.
+;ENABLED = true
+;; Run check repository statistics task when Gitea starts.
+;RUN_AT_START = true
+;; Notice if not success
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @midnight
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.update_migration_poster_id]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+; Update migrated repositories' issues and comments' posterid, it will always attempt synchronization when the instance starts.
+;ENABLED = true
+;; Update migrated repositories' issues and comments' posterid when starting server (default true)
+;RUN_AT_START = true
+;; Notice if not success
+;NOTICE_ON_SUCCESS = false
+;; Interval as a duration between each synchronization. (default every 24h)
+;SCHEDULE = @midnight
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Synchronize external user data (only LDAP user synchronization is supported)
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.sync_external_users]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = true
+;; Synchronize external user data when starting server (default false)
+;RUN_AT_START = false
+;; Notice if not success
+;NOTICE_ON_SUCCESS = false
+;; Interval as a duration between each synchronization (default every 24h)
+;SCHEDULE = @midnight
+;; Create new users, update existing user data and disable users that are not in external source anymore (default)
+;; or only create new users if UPDATE_EXISTING is set to false
+;UPDATE_EXISTING = true
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Cleanup expired actions assets
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.cleanup_actions]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = true
+;RUN_AT_START = true
+;SCHEDULE = @midnight
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Clean-up deleted branches
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.deleted_branches_cleanup]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = true
+;; Clean-up deleted branches when starting server (default true)
+;RUN_AT_START = true
+;; Notice if not success
+;NOTICE_ON_SUCCESS = false
+;; Interval as a duration between each synchronization (default every 24h)
+;SCHEDULE = @midnight
+;; deleted branches than OLDER_THAN ago are subject to deletion
+;OLDER_THAN = 24h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Cleanup hook_task table
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.cleanup_hook_task_table]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Whether to enable the job
+;ENABLED = true
+;; Whether to always run at start up time (if ENABLED)
+;RUN_AT_START = false
+;; Time interval for job to run
+;SCHEDULE = @midnight
+;; OlderThan or PerWebhook. How the records are removed, either by age (i.e. how long ago hook_task record was delivered) or by the number to keep per webhook (i.e. keep most recent x deliveries per webhook).
+;CLEANUP_TYPE = OlderThan
+;; If CLEANUP_TYPE is set to OlderThan, then any delivered hook_task records older than this expression will be deleted.
+;OLDER_THAN = 168h
+;; If CLEANUP_TYPE is set to PerWebhook, this is number of hook_task records to keep for a webhook (i.e. keep the most recent x deliveries).
+;NUMBER_TO_KEEP = 10
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Cleanup expired packages
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.cleanup_packages]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Whether to enable the job
+;ENABLED = true
+;; Whether to always run at least once at start up time (if ENABLED)
+;RUN_AT_START = true
+;; Whether to emit notice on successful execution too
+;NOTICE_ON_SUCCESS = false
+;; Time interval for job to run
+;SCHEDULE = @midnight
+;; Unreferenced blobs created more than OLDER_THAN ago are subject to deletion
+;OLDER_THAN = 24h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+; Extended cron task - not enabled by default
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Delete all unactivated accounts
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.delete_inactive_accounts]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @annually
+;OLDER_THAN = 168h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Delete all repository archives
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.delete_repo_archives]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @annually;
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Garbage collect all repositories
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.git_gc_repos]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @every 72h
+;TIMEOUT = 60s
+;; Arguments for command 'git gc'
+;; The default value is same with [git] -> GC_ARGS
+;ARGS =
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Update the '.ssh/authorized_keys' file with Gitea SSH keys
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.resync_all_sshkeys]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @every 72h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Resynchronize pre-receive, update and post-receive hooks of all repositories.
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.resync_all_hooks]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @every 72h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Reinitialize all missing Git repositories for which records exist
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.reinit_missing_repos]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @every 72h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Delete all repositories missing their Git files
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.delete_missing_repos]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @every 72h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Delete generated repository avatars
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.delete_generated_repository_avatars]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @every 72h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Delete all old activities from database
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.delete_old_actions]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NOTICE_ON_SUCCESS = false
+;SCHEDULE = @every 168h
+;OLDER_THAN = 8760h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Check for new Gitea versions
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.update_checker]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = true
+;RUN_AT_START = false
+;ENABLE_SUCCESS_NOTICE = false
+;SCHEDULE = @every 168h
+;HTTP_ENDPOINT = https://dl.gitea.com/gitea/version.json
+;DOMAIN_ENDPOINT = release.forgejo.org
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Delete all old system notices from database
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.delete_old_system_notices]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;RUN_AT_START = false
+;NO_SUCCESS_NOTICE = false
+;SCHEDULE = @every 168h
+;OLDER_THAN = 8760h
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Garbage collect LFS pointers in repositories
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.gc_lfs]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = false
+;; Garbage collect LFS pointers in repositories (default false)
+;RUN_AT_START = false
+;; Interval as a duration between each gc run (default every 24h)
+;SCHEDULE = @every 24h
+;; Only attempt to garbage collect LFSMetaObjects older than this (default 7 days)
+;OLDER_THAN = 168h
+;; Only attempt to garbage collect LFSMetaObjects that have not been attempted to be garbage collected for this long (default 3 days)
+;LAST_UPDATED_MORE_THAN_AGO = 72h
+; Minimum number of stale LFSMetaObjects to check per repo. Set to `0` to always check all.
+;NUMBER_TO_CHECK_PER_REPO = 100
+;Check at least this proportion of LFSMetaObjects per repo. (This may cause all stale LFSMetaObjects to be checked.)
+;PROPORTION_TO_CHECK_PER_REPO = 0.6
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[mirror]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Enables the mirror functionality. Set to **false** to disable all mirrors. Pre-existing mirrors remain valid but won't be updated; may be converted to regular repo.
+;ENABLED = true
+;; Disable the creation of **new** pull mirrors. Pre-existing mirrors remain valid. Will be ignored if `mirror.ENABLED` is `false`.
+;DISABLE_NEW_PULL = false
+;; Disable the creation of **new** push mirrors. Pre-existing mirrors remain valid. Will be ignored if `mirror.ENABLED` is `false`.
+;DISABLE_NEW_PUSH = false
+;; Default interval as a duration between each check
+;DEFAULT_INTERVAL = 8h
+;; Min interval as a duration must be > 1m
+;MIN_INTERVAL = 10m
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[api]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Enables the API documentation endpoints (/api/swagger, /api/v1/swagger, …). True or false.
+;ENABLE_SWAGGER = true
+;; Max number of items in a page
+;MAX_RESPONSE_ITEMS = 50
+;; Default paging number of api
+;DEFAULT_PAGING_NUM = 30
+;; Default and maximum number of items per page for git trees api
+;DEFAULT_GIT_TREES_PER_PAGE = 1000
+;; Default max size of a blob returned by the blobs API (default is 10MiB)
+;DEFAULT_MAX_BLOB_SIZE = 10485760
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[i18n]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; The first locale will be used as the default if user browser's language doesn't match any locale in the list.
+;LANGS = en-US,zh-CN,zh-HK,zh-TW,da,de-DE,nds,fr-FR,nl-NL,lv-LV,ru-RU,uk-UA,ja-JP,es-ES,pt-BR,pt-PT,pl-PL,bg,it-IT,fi-FI,fil,eo,tr-TR,cs-CZ,sl,sv-SE,ko-KR,el-GR,fa-IR,hu-HU,id-ID
+;NAMES = English,简体中文,繁體中文（香港）,繁體中文（台灣）,Dansk,Deutsch,Plattdüütsch,Français,Nederlands,Latviešu,Русский,Українська,日本語,Español,Português do Brasil,Português de Portugal,Polski,Български,Italiano,Suomi,Filipino,Esperanto,Türkçe,Čeština,Slovenščina,Svenska,한국어,Ελληνικά,فارسی,Magyar nyelv,Bahasa Indonesia
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[highlight.mapping]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Extension mapping to highlight class
+;; e.g. .toml=ini
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[other]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Show version information about Gitea and Go in the footer
+;SHOW_FOOTER_VERSION = true
+;; Show template execution time in the footer
+;SHOW_FOOTER_TEMPLATE_LOAD_TIME = true
+;; Show the "powered by" text in the footer
+;SHOW_FOOTER_POWERED_BY = true
+;; Generate sitemap. Defaults to `true`.
+;ENABLE_SITEMAP = true
+;; Enable/Disable RSS/Atom feed
+;ENABLE_FEED = true
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[markup]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Set the maximum number of characters in a mermaid source. (Set to -1 to disable limits)
+;MERMAID_MAX_SOURCE_CHARACTERS = 5000
+;; Set the maximum number of lines allowed for a filepreview. (Set to -1 to disable limits; set to 0 to disable the feature)
+;FILEPREVIEW_MAX_LINES = 50
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[markup.sanitizer.1]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; The following keys can appear once to define a sanitation policy rule.
+;; This section can appear multiple times by adding a unique alphanumeric suffix to define multiple rules.
+;; e.g., [markup.sanitizer.1] -> [markup.sanitizer.2] -> [markup.sanitizer.TeX]
+;ELEMENT = span
+;ALLOW_ATTR = class
+;REGEXP = ^(info|warning|error)$
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Other markup formats e.g. asciidoc
+;;
+;; uncomment and enable the below section.
+;; (You can add other markup formats by copying the section and adjusting
+;; the section name suffix "asciidoc" to something else.)
+;[markup.asciidoc]
+;ENABLED = false
+;; List of file extensions that should be rendered by an external command
+;FILE_EXTENSIONS = .adoc,.asciidoc
+;; External command to render all matching extensions
+;RENDER_COMMAND = "asciidoc --out-file=- -"
+;; Don't pass the file on STDIN, pass the filename as argument instead.
+;IS_INPUT_FILE = false
+;; How the content will be rendered.
+;; * sanitized: Sanitize the content and render it inside current page, default to only allow a few HTML tags and attributes. Customized sanitizer rules can be defined in [markup.sanitizer.*] .
+;; * no-sanitizer: Disable the sanitizer and render the content inside current page. It's **insecure** and may lead to XSS attack if the content contains malicious code.
+;; * iframe: Render the content in a separate standalone page and embed it into current page by iframe. The iframe is in sandbox mode with same-origin disabled, and the JS code are safely isolated from parent page.
+;RENDER_CONTENT_MODE=sanitized
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[metrics]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Enables metrics endpoint. True or false; default is false.
+;ENABLED = false
+;; If you want to add authorization, specify a token here
+;TOKEN =
+;; Enable issue by label metrics; default is false
+;ENABLED_ISSUE_BY_LABEL = false
+;; Enable issue by repository metrics; default is false
+;ENABLED_ISSUE_BY_REPOSITORY = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[migrations]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Max attempts per http/https request on migrations.
+;MAX_ATTEMPTS = 3
+;;
+;; Backoff time per http/https request retry (seconds)
+;RETRY_BACKOFF = 3
+;;
+;; Allowed domains for migrating, default is blank. Blank means everything will be allowed.
+;; Multiple domains could be separated by commas.
+;; Wildcard is supported: "github.com, *.github.com"
+;ALLOWED_DOMAINS =
+;;
+;; Blocklist for migrating, default is blank. Multiple domains could be separated by commas.
+;; When ALLOWED_DOMAINS is not blank, this option has a higher priority to deny domains.
+;; Wildcard is supported.
+;BLOCKED_DOMAINS =
+;;
+;; Allow private addresses defined by RFC 1918, RFC 1122, RFC 4632 and RFC 4291 (false by default)
+;; If a domain is allowed by ALLOWED_DOMAINS, this option will be ignored.
+;ALLOW_LOCALNETWORKS = false
+;;
+;; If set to true, completely ignores server certificate validation errors. This option is unsafe.
+;SKIP_TLS_VERIFY = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[F3]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Enable/Disable Friendly Forge Format (F3)
+;ENABLED = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[federation]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Enable/Disable federation capabilities
+;ENABLED = false
+;;
+;; Enable/Disable user statistics for nodeinfo if federation is enabled
+;SHARE_USER_STATISTICS = true
+;;
+;; Maximum federation request and response size (MB)
+;MAX_SIZE = 4
+;;
+;; WARNING: Changing the settings below can break federation.
+;;
+;; HTTP signature algorithms
+;ALGORITHMS = rsa-sha256, rsa-sha512, ed25519
+;;
+;; HTTP signature digest algorithm
+;DIGEST_ALGORITHM = SHA-256
+;;
+;; GET headers for federation requests
+;GET_HEADERS = (request-target), Date
+;;
+;; POST headers for federation requests
+;POST_HEADERS = (request-target), Date, Digest
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[packages]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Enable/Disable package registry capabilities
+;ENABLED = true
+;;
+;STORAGE_TYPE = local
+;; override the minio base path if storage type is minio
+;MINIO_BASE_PATH = packages/
+;;
+;; Path for chunked uploads. Defaults to APP_DATA_PATH + `tmp/package-upload`
+;CHUNKED_UPLOAD_PATH = tmp/package-upload
+;;
+;; Maximum count of package versions a single owner can have (`-1` means no limits)
+;LIMIT_TOTAL_OWNER_COUNT = -1
+;; Maximum size of packages a single owner can use (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_TOTAL_OWNER_SIZE = -1
+;; Maximum size of an Alpine upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_ALPINE = -1
+;; Maximum size of a Cargo upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_CARGO = -1
+;; Maximum size of a Chef upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_CHEF = -1
+;; Maximum size of a Composer upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_COMPOSER = -1
+;; Maximum size of a Conan upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_CONAN = -1
+;; Maximum size of a Conda upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_CONDA = -1
+;; Maximum size of a Container upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_CONTAINER = -1
+;; Maximum size of a CRAN upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_CRAN = -1
+;; Maximum size of a Debian upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_DEBIAN = -1
+;; Maximum size of a Generic upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_GENERIC = -1
+;; Maximum size of a Go upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_GO = -1
+;; Maximum size of a Helm upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_HELM = -1
+;; Maximum size of a Maven upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_MAVEN = -1
+;; Maximum size of a npm upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_NPM = -1
+;; Maximum size of a NuGet upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_NUGET = -1
+;; Maximum size of a Pub upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_PUB = -1
+;; Maximum size of a PyPI upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_PYPI = -1
+;; Maximum size of a RPM upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_RPM = -1
+;; Maximum size of a RubyGems upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_RUBYGEMS = -1
+;; Maximum size of a Swift upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_SWIFT = -1
+;; Maximum size of a Vagrant upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
+;LIMIT_SIZE_VAGRANT = -1
+;; Enable RPM re-signing by default. (It will overwrite the old signature ,using v4 format, not compatible with CentOS 6 or older)
+;DEFAULT_RPM_SIGN_ENABLED = false
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; default storage for attachments, lfs and avatars
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[storage]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; storage type
+;STORAGE_TYPE = local
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; repo-archive storage will override storage
+;;
+;[repo-archive]
+;STORAGE_TYPE = local
+;;
+;; Where your lfs files reside, default is data/lfs.
+;PATH = data/repo-archive
+;;
+;; override the minio base path if storage type is minio
+;MINIO_BASE_PATH = repo-archive/
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; settings for repository archives, will override storage setting
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[storage.repo-archive]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; storage type
+;STORAGE_TYPE = local
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; lfs storage will override storage
+;;
+;[lfs]
+;STORAGE_TYPE = local
+;;
+;; Where your lfs files reside, default is data/lfs.
+;PATH = data/lfs
+;;
+;; override the minio base path if storage type is minio
+;MINIO_BASE_PATH = lfs/
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; settings for Gitea's LFS client (eg: mirroring an upstream lfs endpoint)
+;;
+;[lfs_client]
+;; Limit the number of pointers in each batch request to this number
+;BATCH_SIZE = 20
+;; Limit the number of concurrent upload/download operations within a batch
+;BATCH_OPERATION_CONCURRENCY = 8
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; settings for packages, will override storage setting
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[storage.packages]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; storage type
+;STORAGE_TYPE = local
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; customize storage
+;[storage.my_minio]
+;STORAGE_TYPE = minio
+;;
+;; Minio endpoint to connect only available when STORAGE_TYPE is `minio`
+;MINIO_ENDPOINT = localhost:9000
+;;
+;; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`.
+;; If not provided and STORAGE_TYPE is `minio`, will search for credentials in known
+;; environment variables (MINIO_ACCESS_KEY_ID, AWS_ACCESS_KEY_ID), credentials files
+;; (~/.mc/config.json, ~/.aws/credentials), and EC2 instance metadata.
+;MINIO_ACCESS_KEY_ID =
+;;
+;; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
+;MINIO_SECRET_ACCESS_KEY =
+;;
+;; Minio bucket to store the attachments only available when STORAGE_TYPE is `minio`
+;MINIO_BUCKET = gitea
+;;
+;; Url lookup for the minio bucket only available when STORAGE_TYPE is `minio`
+;; Available values: auto, dns, path
+;; If empty, it behaves the same as "auto" was set
+;MINIO_BUCKET_LOOKUP =
+;;
+;; Minio location to create bucket only available when STORAGE_TYPE is `minio`
+;MINIO_LOCATION = us-east-1
+;;
+;; Minio enabled ssl only available when STORAGE_TYPE is `minio`
+;MINIO_USE_SSL = false
+;;
+;; Minio skip SSL verification available when STORAGE_TYPE is `minio`
+;MINIO_INSECURE_SKIP_VERIFY = false
+
+;[proxy]
+;; Enable the proxy, all requests to external via HTTP will be affected
+;PROXY_ENABLED = false
+;; Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy/no_proxy
+;PROXY_URL =
+;; Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts.
+;PROXY_HOSTS =
+
+; [actions]
+;; Enable/Disable actions capabilities
+;ENABLED = true
+;; Default address to get action plugins, e.g. the default value means downloading from "https://code.forgejo.org/actions/checkout" for "uses: actions/checkout@v3"
+;DEFAULT_ACTIONS_URL = https://code.forgejo.org
+;; Logs retention time in days. Old logs will be deleted after this period.
+;LOG_RETENTION_DAYS = 365
+;; Log compression type, `none` for no compression, `zstd` for zstd compression.
+;; Other compression types like `gzip` are NOT supported, since seekable stream is required for log view.
+;; It's always recommended to use compression when using local disk as log storage if CPU or memory is not a bottleneck.
+;; And for object storage services like S3, which is billed for requests, it would cause extra 2 times of get requests for each log view.
+;; But it will save storage space and network bandwidth, so it's still recommended to use compression.
+;LOG_COMPRESSION = zstd
+;; Default artifact retention time in days. Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
+;ARTIFACT_RETENTION_DAYS = 90
+;; Timeout to stop the task which have running status, but haven't been updated for a long time
+;ZOMBIE_TASK_TIMEOUT = 10m
+;; Timeout to stop the tasks which have running status and continuous updates, but don't end for a long time
+;ENDLESS_TASK_TIMEOUT = 3h
+;; Timeout to cancel the jobs which have waiting status, but haven't been picked by a runner for a long time
+;ABANDONED_JOB_TIMEOUT = 24h
+;; Strings committers can place inside a commit message or PR title to skip executing the corresponding actions workflow
+;SKIP_WORKFLOW_STRINGS = [skip ci],[ci skip],[no ci],[skip actions],[actions skip]
+;; Limit on inputs for manual / workflow_dispatch triggers, default is 10
+;LIMIT_DISPATCH_INPUTS = 10
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; settings for action logs, will override storage setting
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[storage.actions_log]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; storage type
+;STORAGE_TYPE = local
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; settings for action artifacts, will override storage setting
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[storage.actions_artifacts]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; storage type
+;STORAGE_TYPE = local