{
  "ended_at": "2026-08-21T22:43:03.740339Z",
  "evidence_class": "fixture",
  "expected": {
    "known_bad": "finding",
    "known_good": "pass"
  },
  "known_bad": [
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "2804e68bca6d4652529b13014b55efa296eb81101726ff8d6634dff4b97c5f32",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "6095953dfd3d463aa844f1c51d20745bb5c0c5a79ce223c7445e57b6c323cd31",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "6095953dfd3d463aa844f1c51d20745bb5c0c5a79ce223c7445e57b6c323cd31",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "finding",
      "probe_id": "read-by-id",
      "reasons": [
        "attacker response contains a tenant-B fixture marker",
        "attacker response differs from the absent-object reference"
      ]
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 0,
          "fixture_match_count": 0,
          "run_digest": "4a8cefe3ea0fa3fb888d8c578dd227c6a12216868da197f82b1e4de23aedd0f0",
          "schema": [
            "$",
            "$.items[]"
          ],
          "status": 200
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "29e86fd84a1c6aa038d8d1278d52c4470135bcc81db39b800940132e2761bc7b",
          "schema": [
            "$",
            "$.items[]",
            "$.items[]",
            "$.items[].id:str",
            "$.items[].label:str",
            "$.items[].tenant:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "29e86fd84a1c6aa038d8d1278d52c4470135bcc81db39b800940132e2761bc7b",
          "schema": [
            "$",
            "$.items[]",
            "$.items[]",
            "$.items[].id:str",
            "$.items[].label:str",
            "$.items[].tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "finding",
      "probe_id": "list-filter",
      "reasons": [
        "attacker response contains a tenant-B fixture marker"
      ]
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "4a2f56562162e6bb6745ca18b8e7325c9565235506d3870bb907ba588ac4fadc",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 403
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 2,
          "run_digest": "5e5ea8b63082ebc7bcce23fd5b66098a2e4ee092dba8a1c4c2a562e70e7c9550",
          "schema": [
            "$",
            "$.id:str",
            "$.tenant:str"
          ],
          "status": 201
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "3a686f08bad5214b56d3e0aa05c141998519809e5cb16499c3f3784a0becbe4a",
          "schema": [
            "$",
            "$.id:str"
          ],
          "status": 201
        }
      },
      "operation": "create",
      "outcome": "finding",
      "probe_id": "create-attributed-to-b",
      "reasons": [
        "attacker response contains a tenant-B fixture marker",
        "tenant-B fixture state changed"
      ]
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "44a1c9a896f575f82c40a744d41519a1f84469cfe22fc889f6f68756da57d77f",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "f48030bb08aa0d07380f0cec2ff0f919c5312fa780e3388984e8d4873440189f",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "5baf8016840cabb74202e381f5f163a463c1279382d8f74332f3b602f1c9704e",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "update",
      "outcome": "finding",
      "probe_id": "update-b",
      "reasons": [
        "attacker response contains a tenant-B fixture marker",
        "tenant-B fixture state changed",
        "attacker response differs from the absent-object reference"
      ]
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "6d9c1f7d5d5c20afb8d8337ba4214e04be05e1b2336edc6263720c2f349a04cc",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 1,
          "run_digest": "32d054c129bb639b1beb7b8ca83a9556b88558facc84132e9fec63950cb4e66d",
          "schema": [
            "$",
            "$.deleted:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "3853f8bf9f473716ce4fced2d44f3a58b411c078afc6f131b4a47eda4929f798",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "delete",
      "outcome": "finding",
      "probe_id": "delete-b",
      "reasons": [
        "attacker response contains a tenant-B fixture marker",
        "tenant-B fixture state changed",
        "attacker response differs from the absent-object reference"
      ]
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "b6638dcf2a3cf24a99ea503a0661f8ec3011b22689bdd6777c98693e4d49f80c",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "099b50b271a61251f76de35b36f832e9d52711cdd3d2e086464e52f8ab075ec7",
          "schema": [
            "$",
            "$.correlation_id:str",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "099b50b271a61251f76de35b36f832e9d52711cdd3d2e086464e52f8ab075ec7",
          "schema": [
            "$",
            "$.correlation_id:str",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "finding",
      "probe_id": "audit-event-by-id",
      "reasons": [
        "attacker response contains a tenant-B fixture marker",
        "attacker response differs from the absent-object reference"
      ]
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 0,
          "fixture_match_count": 0,
          "run_digest": "738fa714a179543df7c4cdf663dcd27d2c636e73a5c6aa006c07b083d513dd0d",
          "schema": [
            "$",
            "$.events[]"
          ],
          "status": 200
        },
        "attacker": {
          "content_type": "application/json",
          "count": 2,
          "fixture_match_count": 3,
          "run_digest": "02a06a47c2f9de17df2d857b945d5629196e74d40314e0a1842e1f728a440c8d",
          "schema": [
            "$",
            "$.events[]",
            "$.events[]",
            "$.events[].correlation_id:str",
            "$.events[].id:str",
            "$.events[].label:str",
            "$.events[].tenant:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 2,
          "fixture_match_count": 3,
          "run_digest": "02a06a47c2f9de17df2d857b945d5629196e74d40314e0a1842e1f728a440c8d",
          "schema": [
            "$",
            "$.events[]",
            "$.events[]",
            "$.events[].correlation_id:str",
            "$.events[].id:str",
            "$.events[].label:str",
            "$.events[].tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "finding",
      "probe_id": "audit-correlation-slice",
      "reasons": [
        "attacker response contains a tenant-B fixture marker"
      ]
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "a8ee76d5c9e51366ae25603241b71d3377f08f3aaded0ff1537b8f1f9640b851",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 403
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 2,
          "run_digest": "f57a7a61abe2d3e7b3af734900863d295a4b6eed8579729b86ad75d73dcb85bb",
          "schema": [
            "$",
            "$.id:str",
            "$.tenant:str"
          ],
          "status": 202
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "2801a3c1b5f46865ac24d24a748dc7124ac3982b85dd20bdb596c033c008708f",
          "schema": [
            "$",
            "$.id:str"
          ],
          "status": 202
        }
      },
      "operation": "create",
      "outcome": "finding",
      "probe_id": "audit-append-as-b",
      "reasons": [
        "attacker response contains a tenant-B fixture marker",
        "tenant-B fixture state changed"
      ]
    }
  ],
  "known_good": [
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "056e35eda0bacdda3e2a862a5e325f5fe090b8090f83037b5172200ff7b0e6dc",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "056e35eda0bacdda3e2a862a5e325f5fe090b8090f83037b5172200ff7b0e6dc",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "49ea6432de7c9a88d2b32a4601d4fa811436909127084edaed522c28bc627235",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "pass",
      "probe_id": "read-by-id",
      "reasons": []
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 0,
          "fixture_match_count": 0,
          "run_digest": "61f8492a8388851bdfe14592a200635255cbe24d068f524ae6de9d6b68260c3d",
          "schema": [
            "$",
            "$.items[]"
          ],
          "status": 200
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "3add37393c96826ead72b129dbf8ac0efd07c254231a7a5a40640d953e82320e",
          "schema": [
            "$",
            "$.items[]",
            "$.items[]",
            "$.items[].id:str",
            "$.items[].label:str",
            "$.items[].tenant:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "479d2a3ab215dd0a629ca719163e1454439b782193e5202bf34e65c0c3a7ccf9",
          "schema": [
            "$",
            "$.items[]",
            "$.items[]",
            "$.items[].id:str",
            "$.items[].label:str",
            "$.items[].tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "pass",
      "probe_id": "list-filter",
      "reasons": []
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "e33ae1117bfbf3ea0f2beee3ada7a4b2e7105e3f8ff9ea0f32e1a458e97c8277",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 403
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "e33ae1117bfbf3ea0f2beee3ada7a4b2e7105e3f8ff9ea0f32e1a458e97c8277",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 403
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "11a2bc634aa1f2cda1bb7f137339bc47f69c21f025b47fa6fd5795c0840b4adf",
          "schema": [
            "$",
            "$.id:str"
          ],
          "status": 201
        }
      },
      "operation": "create",
      "outcome": "pass",
      "probe_id": "create-attributed-to-b",
      "reasons": []
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "31c30991423c8f2d3dd4757e0fdd188b37f6470a6babad1d9700aef0f451da32",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "31c30991423c8f2d3dd4757e0fdd188b37f6470a6babad1d9700aef0f451da32",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "fb069aca7ea87059083bee9517d11d411a68e8b1ba88a1bf59394f11c6ab83c2",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "update",
      "outcome": "pass",
      "probe_id": "update-b",
      "reasons": []
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "9205aee8ba243fc42f8ccf89fad98523c85c39adaa2311e9263512b2cc6faa9e",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "9205aee8ba243fc42f8ccf89fad98523c85c39adaa2311e9263512b2cc6faa9e",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "681e463a7d41ce5ff05da5bc75241a0a176e8a6c1fdb19e1e88cc8f9490e023b",
          "schema": [
            "$",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "delete",
      "outcome": "pass",
      "probe_id": "delete-b",
      "reasons": []
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "e41d24b31b123d4a33e4d94a1015005694eeb0d00cf243b6238ac76ce28020e7",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "e41d24b31b123d4a33e4d94a1015005694eeb0d00cf243b6238ac76ce28020e7",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 404
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "4308d43196348f1b1e55796f2e27b89c90371261e7d0472706778ad60562ab70",
          "schema": [
            "$",
            "$.correlation_id:str",
            "$.id:str",
            "$.label:str",
            "$.tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "pass",
      "probe_id": "audit-event-by-id",
      "reasons": []
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 0,
          "fixture_match_count": 0,
          "run_digest": "014cf19c288b1c2a1411f08523dac6664bd2f62418148b9ff7f6875ab3f30d53",
          "schema": [
            "$",
            "$.events[]"
          ],
          "status": 200
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "603bc2c5c8f8f643d2bc9c1822e5a8c3414b181aab311410c6ae753ec50d56c3",
          "schema": [
            "$",
            "$.events[]",
            "$.events[]",
            "$.events[].correlation_id:str",
            "$.events[].id:str",
            "$.events[].label:str",
            "$.events[].tenant:str"
          ],
          "status": 200
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 3,
          "run_digest": "e2715b7b38e5f4141f6017e362301cd27219f0e591bab2250679815eb6a3b937",
          "schema": [
            "$",
            "$.events[]",
            "$.events[]",
            "$.events[].correlation_id:str",
            "$.events[].id:str",
            "$.events[].label:str",
            "$.events[].tenant:str"
          ],
          "status": 200
        }
      },
      "operation": "read",
      "outcome": "pass",
      "probe_id": "audit-correlation-slice",
      "reasons": []
    },
    {
      "observations": {
        "absent": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "ead0052d3e827ac7333f98a802459109362838131fd81e6a14c74809b320195d",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 403
        },
        "attacker": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "ead0052d3e827ac7333f98a802459109362838131fd81e6a14c74809b320195d",
          "schema": [
            "$",
            "$.error:str"
          ],
          "status": 403
        },
        "owner": {
          "content_type": "application/json",
          "count": 1,
          "fixture_match_count": 0,
          "run_digest": "f84797611f1a1c39fbfd93d06e7007352ea47fa87250613c56df52a64a6322c4",
          "schema": [
            "$",
            "$.id:str"
          ],
          "status": 202
        }
      },
      "operation": "create",
      "outcome": "pass",
      "probe_id": "audit-append-as-b",
      "reasons": []
    }
  ],
  "limitations": [
    "Offline fixture evidence calibrates the harness; it is not target assurance.",
    "No network request, database connection, or live credential was used."
  ],
  "outcome": "pass",
  "run_id": "fixture-calibration-2026-08-21T22:43:03.737244Z",
  "schema_version": "whitehat-calibration/v1",
  "started_at": "2026-08-21T22:43:03.737244Z"
}