{
  "schema_version": "whitehat-probe-pack/v1",
  "target": "audit-core",
  "posture_claim": "E2",
  "attacker_model": "docs/attacker-model.md#3-e2--authenticated-tenant-a-at-the-service-boundary",
  "notes": [
    "Use two read-enabled scoped sender identities, each restricted to its fixture tenant.",
    "A correlation id deliberately spans services; the expected result is the caller's readable tenant slice.",
    "Instance-wide stats, integrity, dead-letter and secret-finding routes are excluded because their contract is operator-only, not tenant-scoped."
  ],
  "probes": [
    {
      "id": "audit-event-by-id",
      "operation": "read",
      "route": "GET /v1/events/{tenant_b_event_id}",
      "owner": "tenant B sender reads tenant B fixture event",
      "attacker": "tenant A sender substitutes tenant B fixture event id",
      "absent": "tenant A sender reads a reserved absent event id",
      "finding": "tenant B fixture marker is returned or existence differs from absent"
    },
    {
      "id": "audit-correlation-slice",
      "operation": "read",
      "route": "GET /v1/events?correlation_id={shared_correlation_id}",
      "owner": "tenant B sender queries correlation shared by A and B fixture events",
      "attacker": "tenant A sender queries the same correlation",
      "absent": "tenant A sender queries a reserved correlation with no events",
      "finding": "tenant B fixture marker appears in tenant A's readable slice"
    },
    {
      "id": "audit-append-as-b",
      "operation": "create",
      "route": "POST /v1/events",
      "owner": "tenant B sender appends a tenant B control event",
      "attacker": "tenant A sender submits a new event claiming tenant B",
      "absent": "tenant A sender submits an otherwise equivalent disallowed-tenant control",
      "finding": "append succeeds or subsequent tenant B state contains the attacker event"
    }
  ]
}