{
  "ticket": "U30 #67",
  "label": "acceptance-reviewed-final",
  "startedAt": "2026-10-26T17:48:14.678561+08:00",
  "rawLogs": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr",
  "input": [
    "python3",
    "/Users/gaochao/Documents/面试/software-engineering-study/labs/oauth2-authorization/run.py",
    "--label",
    "acceptance-reviewed-final"
  ],
  "results": [
    {
      "name": "jdk",
      "exitCode": 0,
      "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr/jdk.log",
      "logSha256": "392524ee4bfbd5e1de98c543683d7fcaed057f7d69ef44a0d0a182de17816feb"
    },
    {
      "name": "maven",
      "exitCode": 0,
      "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr/maven.log",
      "logSha256": "7df1d445c9ffb402337aefccb8c27c6109cd49aa2f7c1b992e9d462a2c08bf38"
    },
    {
      "name": "package",
      "exitCode": 0,
      "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr/package.log",
      "logSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    },
    {
      "name": "dependency-tree",
      "exitCode": 0,
      "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr/dependency-tree.log",
      "logSha256": "8b3eff480e386fc34c3aa440332ea45792140b5606bef01d52c4f8f4d25664a2"
    },
    {
      "name": "real reference-format access grant",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "grant_type",
        "scope"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.274052+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "reference token introspected through actual AS",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.430493+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "reference token cannot be locally JWT-decoded",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:21.439122+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "reference token revoked at AS",
      "method": "POST",
      "path": "/oauth2/revoke",
      "queryKeys": [],
      "formFields": [
        "token"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.495716+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "revoked reference token denied",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:21.554216+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "reference",
      "status": "PASS",
      "finishedAt": "2026-10-26T17:48:21.554248+08:00"
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.574545+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.684424+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "authorization request missing PKCE",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.686825+08:00",
      "locationPath": "/callback",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.688293+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.743631+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "authorization request S256",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.745029+08:00",
      "locationPath": "/callback",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.746413+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.801334+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "authorization request S256",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.804759+08:00",
      "locationPath": "/callback",
      "challengeScheme": ""
    },
    {
      "name": "authorization code exchange",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "code",
        "code_verifier",
        "grant_type",
        "redirect_uri"
      ],
      "bearer": "absent",
      "status": 400,
      "expectedStatus": 400,
      "observedAt": "2026-10-26T17:48:21.860941+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.862473+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.916941+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "authorization request S256",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:21.918391+08:00",
      "locationPath": "/callback",
      "challengeScheme": ""
    },
    {
      "name": "authorization code exchange",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "code",
        "code_verifier",
        "grant_type",
        "redirect_uri"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:21.994518+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "authorization code exchange",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "code",
        "code_verifier",
        "grant_type",
        "redirect_uri"
      ],
      "bearer": "absent",
      "status": 400,
      "expectedStatus": 400,
      "observedAt": "2026-10-26T17:48:22.049981+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.051384+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:22.105981+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "authorization request S256",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:22.107553+08:00",
      "locationPath": "/callback",
      "challengeScheme": ""
    },
    {
      "name": "authorization code exchange",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "code",
        "code_verifier",
        "grant_type",
        "redirect_uri"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.164010+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "AS-issued access token at JWT RS",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.188649+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "ID token cannot replace access token",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.190793+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "ID token active and wrong resource audience confirmed at AS",
      "method": "POST",
      "path": "/oauth2/introspect",
      "queryKeys": [],
      "formFields": [
        "token"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.247913+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "opaque audience negative precondition",
      "activeAtAS": true,
      "audienceMatchesResource": false
    },
    {
      "name": "active ID token audience rejected by opaque resource policy",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.306554+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "AS-issued token via real introspection",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.365355+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "roles",
      "status": "PASS",
      "finishedAt": "2026-10-26T17:48:22.365381+08:00"
    },
    {
      "name": "missing bearer",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.366775+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "malformed bearer",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.367590+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic algorithm",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.373841+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "algorithm denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.375262+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.377292+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "algorithm corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.379029+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic signature",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.381350+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "signature denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.382694+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.384659+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "signature corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.386371+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic issuer",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.388227+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "issuer denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.390195+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.392135+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "issuer corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.393730+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic audience",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.395579+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "audience denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.396808+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.398678+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "audience corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.400200+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic expired",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.402043+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "expired denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.403254+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.405183+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "expired corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.407234+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic no-exp",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.409445+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "no-exp denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.410777+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.412639+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "no-exp corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.414071+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic future",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.416016+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "future denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.417234+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.419147+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "future corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.420743+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic unknown-kid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.423082+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "unknown-kid denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.425605+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.427567+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "unknown-kid corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.429204+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic no-tenant",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.431371+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "no-tenant denied",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.432564+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.434529+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "no-tenant corrected token recovers",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.435955+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "identity not inherited by next request",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.436612+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "claims",
      "status": "PASS",
      "finishedAt": "2026-10-26T17:48:22.436629+08:00"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.438796+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic scope",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.441324+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "valid signature but missing scope",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.443655+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "request permission denies reader",
      "method": "GET",
      "path": "/jwt/admin",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.444896+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "mint synthetic scope",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.447045+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "method proxy denies missing write scope",
      "method": "GET",
      "path": "/jwt/method",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.460385+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "method proxy permits write scope",
      "method": "GET",
      "path": "/jwt/method",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.462430+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "object/tenant boundary /jwt/orders/other?tenant=t1",
      "method": "GET",
      "path": "/jwt/orders/other",
      "queryKeys": [
        "tenant"
      ],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.470679+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "object/tenant boundary /jwt/orders/foreign?tenant=t1",
      "method": "GET",
      "path": "/jwt/orders/foreign",
      "queryKeys": [
        "tenant"
      ],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.472681+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "object/tenant boundary /jwt/orders/foreign?tenant=t2",
      "method": "GET",
      "path": "/jwt/orders/foreign",
      "queryKeys": [
        "tenant"
      ],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.474111+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "object/tenant boundary /jwt/orders/own?tenant=t2",
      "method": "GET",
      "path": "/jwt/orders/own",
      "queryKeys": [
        "tenant"
      ],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.475336+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "trusted tenant and owner succeed",
      "method": "GET",
      "path": "/jwt/orders/own",
      "queryKeys": [
        "tenant"
      ],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.476825+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic tenant",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.479189+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "trusted t2 token recovers legitimate t2 access",
      "method": "GET",
      "path": "/jwt/orders/foreign",
      "queryKeys": [
        "tenant"
      ],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.480690+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic tenant",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.482586+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "t2 identity denied t1 record",
      "method": "GET",
      "path": "/jwt/orders/own",
      "queryKeys": [
        "tenant"
      ],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 403,
      "expectedStatus": 403,
      "observedAt": "2026-10-26T17:48:22.483936+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "authorization",
      "status": "PASS",
      "finishedAt": "2026-10-26T17:48:22.483953+08:00"
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.485269+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:22.540256+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "authorization request S256",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:22.541677+08:00",
      "locationPath": "/callback",
      "challengeScheme": ""
    },
    {
      "name": "authorization code exchange",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "code",
        "code_verifier",
        "grant_type",
        "redirect_uri"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.598084+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "active before revocation",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.656120+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "introspectionDown"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.658199+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "direct introspection proves fault injection",
      "method": "POST",
      "path": "/oauth2/introspect",
      "queryKeys": [],
      "formFields": [
        "token"
      ],
      "bearer": "absent",
      "status": 503,
      "expectedStatus": 503,
      "observedAt": "2026-10-26T17:48:22.658833+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "introspection outage never grants identity",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 503,
      "expectedStatus": 503,
      "observedAt": "2026-10-26T17:48:22.663535+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "introspectionDown"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.664697+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "direct introspection proves recovery",
      "method": "POST",
      "path": "/oauth2/introspect",
      "queryKeys": [],
      "formFields": [
        "token"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.719598+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "introspection recovery",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.776134+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "actual AS access revocation",
      "method": "POST",
      "path": "/oauth2/revoke",
      "queryKeys": [],
      "formFields": [
        "token",
        "token_type_hint"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.830731+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "introspection rejects revoked token",
      "method": "GET",
      "path": "/opaque/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:22.888259+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "local JWT remains valid until local policy expiry",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.890259+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "unknown token revocation also returns success",
      "method": "POST",
      "path": "/oauth2/revoke",
      "queryKeys": [],
      "formFields": [
        "token"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.945375+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:22.946859+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.001184+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "authorization request S256",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.002573+08:00",
      "locationPath": "/callback",
      "challengeScheme": ""
    },
    {
      "name": "authorization code exchange",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "code",
        "code_verifier",
        "grant_type",
        "redirect_uri"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.059098+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "refresh rotates credentials",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "grant_type",
        "refresh_token"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.115356+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "old refresh credential denied",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "grant_type",
        "refresh_token"
      ],
      "bearer": "absent",
      "status": 400,
      "expectedStatus": 400,
      "observedAt": "2026-10-26T17:48:23.169996+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "actual AS refresh revocation",
      "method": "POST",
      "path": "/oauth2/revoke",
      "queryKeys": [],
      "formFields": [
        "token",
        "token_type_hint"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.224555+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "revoked refresh cannot mint",
      "method": "POST",
      "path": "/oauth2/token",
      "queryKeys": [],
      "formFields": [
        "grant_type",
        "refresh_token"
      ],
      "bearer": "absent",
      "status": 400,
      "expectedStatus": 400,
      "observedAt": "2026-10-26T17:48:23.279376+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "lifecycle",
      "status": "PASS",
      "finishedAt": "2026-10-26T17:48:23.279406+08:00"
    },
    {
      "name": "real Spring OAuth2 client initiation",
      "method": "GET",
      "path": "/oauth2/authorization/lab",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.311087+08:00",
      "locationPath": "/oauth2/authorize",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.312822+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.368200+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "OIDC AS authorization",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.371108+08:00",
      "locationPath": "/login/oauth2/code/lab",
      "challengeScheme": ""
    },
    {
      "name": "real client code exchange and ID-token verification",
      "method": "GET",
      "path": "/login/oauth2/code/lab",
      "queryKeys": [
        "code",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.483250+08:00",
      "locationPath": "/client/me",
      "challengeScheme": ""
    },
    {
      "name": "OIDC identity saved across HTTP requests",
      "method": "GET",
      "path": "/client/me",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.499090+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "OAuth2 RestClient sends access token to RS",
      "method": "GET",
      "path": "/client/resource",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.505157+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "state negative initiation",
      "method": "GET",
      "path": "/oauth2/authorization/lab",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.506873+08:00",
      "locationPath": "/oauth2/authorize",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.508308+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.562908+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "state negative authorization",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.564184+08:00",
      "locationPath": "/login/oauth2/code/lab",
      "challengeScheme": ""
    },
    {
      "name": "mismatched state rejected",
      "method": "GET",
      "path": "/login/oauth2/code/lab",
      "queryKeys": [
        "code",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:23.565983+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "state failure does not save identity",
      "method": "GET",
      "path": "/client/me",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.569583+08:00",
      "locationPath": "/oauth2/authorization/lab",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "badNonce"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.570874+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "nonce negative initiation",
      "method": "GET",
      "path": "/oauth2/authorization/lab",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.572327+08:00",
      "locationPath": "/oauth2/authorize",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.573683+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.628139+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "nonce negative authorization",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.629389+08:00",
      "locationPath": "/login/oauth2/code/lab",
      "challengeScheme": ""
    },
    {
      "name": "signed ID token with wrong nonce rejected",
      "method": "GET",
      "path": "/login/oauth2/code/lab",
      "queryKeys": [
        "code",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:23.690268+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "nonce failure does not save identity",
      "method": "GET",
      "path": "/client/me",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.691880+08:00",
      "locationPath": "/oauth2/authorization/lab",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "badNonce"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.693234+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "OIDC recovery initiation",
      "method": "GET",
      "path": "/oauth2/authorization/lab",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.694594+08:00",
      "locationPath": "/oauth2/authorize",
      "challengeScheme": ""
    },
    {
      "name": "fetch AS login CSRF",
      "method": "GET",
      "path": "/lab/csrf",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.695665+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "real AS form authentication",
      "method": "POST",
      "path": "/login",
      "queryKeys": [],
      "formFields": [
        "_csrf",
        "password",
        "username"
      ],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.750078+08:00",
      "locationPath": "/",
      "challengeScheme": ""
    },
    {
      "name": "OIDC recovery authorization",
      "method": "GET",
      "path": "/oauth2/authorize",
      "queryKeys": [
        "client_id",
        "code_challenge",
        "code_challenge_method",
        "nonce",
        "redirect_uri",
        "response_type",
        "scope",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.751362+08:00",
      "locationPath": "/login/oauth2/code/lab",
      "challengeScheme": ""
    },
    {
      "name": "OIDC recovery callback",
      "method": "GET",
      "path": "/login/oauth2/code/lab",
      "queryKeys": [
        "code",
        "state"
      ],
      "formFields": [],
      "bearer": "absent",
      "status": 302,
      "expectedStatus": 302,
      "observedAt": "2026-10-26T17:48:23.812923+08:00",
      "locationPath": "/client/me",
      "challengeScheme": ""
    },
    {
      "name": "OIDC recovery identity",
      "method": "GET",
      "path": "/client/me",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.814262+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "oidc",
      "status": "PASS",
      "finishedAt": "2026-10-26T17:48:23.814282+08:00"
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.816477+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "A key initially cached",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.818523+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "active",
        "publish"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.819721+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic valid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.821562+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "unknown B kid refreshes JWKS during overlap",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.824087+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "A token remains valid in overlap",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.825611+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "jwksDown"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.826886+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "direct JWKS proves fault injection reached endpoint",
      "method": "GET",
      "path": "/oauth2/jwks",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 503,
      "expectedStatus": 503,
      "observedAt": "2026-10-26T17:48:23.827334+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "known cached B works during JWKS outage",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.828477+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic unknown-kid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.830248+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "unknown kid needs remote JWKS and fails closed during outage",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 503,
      "expectedStatus": 503,
      "observedAt": "2026-10-26T17:48:23.831857+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "jwksDown"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.832858+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "direct JWKS proves endpoint recovery",
      "method": "GET",
      "path": "/oauth2/jwks",
      "queryKeys": [],
      "formFields": [],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.833443+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "JWKS recovery for valid B",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.834728+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "set synthetic fault/rotation control",
      "method": "POST",
      "path": "/lab/control",
      "queryKeys": [],
      "formFields": [
        "publish"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.835695+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "A still accepted from warm cache immediately after publication retirement",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.836751+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "mint synthetic unknown-kid",
      "method": "POST",
      "path": "/lab/mint",
      "queryKeys": [],
      "formFields": [
        "kind"
      ],
      "bearer": "absent",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.838352+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "unknown kid forces refresh after A retirement",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:23.840259+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "A rejected after observed cache refresh",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 401,
      "expectedStatus": 401,
      "observedAt": "2026-10-26T17:48:23.841746+08:00",
      "locationPath": "",
      "challengeScheme": "Bearer"
    },
    {
      "name": "B remains accepted after retirement",
      "method": "GET",
      "path": "/jwt/read",
      "queryKeys": [],
      "formFields": [],
      "bearer": "present-redacted",
      "status": 200,
      "expectedStatus": 200,
      "observedAt": "2026-10-26T17:48:23.842866+08:00",
      "locationPath": "",
      "challengeScheme": ""
    },
    {
      "name": "rotation",
      "status": "PASS",
      "finishedAt": "2026-10-26T17:48:23.842883+08:00"
    }
  ],
  "processes": [
    {
      "name": "client",
      "pid": 84616,
      "exitCode": 143,
      "reaped": true,
      "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr/client.log",
      "logSha256": "00b39c64c5023f15a657a1c024368b070a95ebe4bc4e942a1810cf05cf5a048a"
    },
    {
      "name": "rs",
      "pid": 84606,
      "exitCode": 143,
      "reaped": true,
      "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr/rs.log",
      "logSha256": "0ee9c09f0f9d9d3f0967525a88219a3a518a6b839809bca30d959fa44d7a15ab"
    },
    {
      "name": "as",
      "pid": 84587,
      "exitCode": 143,
      "reaped": true,
      "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u30/run-v5k52slr/as.log",
      "logSha256": "59bcf0f0fe5538f3dc2c16d667f90b78b6b386cee3d2d071db3cd4889325e209"
    }
  ],
  "environment": {
    "os": "macOS-27.0.1-arm64-arm-64bit",
    "arch": "arm64",
    "jdk": "openjdk version \"21.0.11\" 2026-04-21 LTS\nOpenJDK Runtime Environment (build 21.0.11+11-LTS)\nOpenJDK 64-Bit Server VM (build 21.0.11+11-LTS, mixed mode, sharing)",
    "python": "3.9.6",
    "boot": "4.0.9",
    "security": "7.0.8",
    "framework": "7.0.10"
  },
  "jarSha256": "737d8493a1bd52448d377691a269398eafaf201cc99506813dfb3751acbce8f0",
  "packagedLibraries": [
    "accessors-smart-2.6.0.jar",
    "asm-9.7.1.jar",
    "commons-logging-1.3.6.jar",
    "content-type-2.3.jar",
    "jackson-annotations-2.21.jar",
    "jackson-core-3.1.7.jar",
    "jackson-databind-3.1.7.jar",
    "jakarta.annotation-api-3.0.0.jar",
    "jcip-annotations-1.0-1.jar",
    "json-smart-2.6.0.jar",
    "jspecify-1.0.1.jar",
    "jul-to-slf4j-2.0.20.jar",
    "lang-tag-1.7.jar",
    "log4j-api-2.25.5.jar",
    "log4j-to-slf4j-2.25.5.jar",
    "logback-classic-1.5.38.jar",
    "logback-core-1.5.38.jar",
    "micrometer-commons-1.16.8.jar",
    "micrometer-observation-1.16.8.jar",
    "nimbus-jose-jwt-10.4.jar",
    "oauth2-oidc-sdk-11.26.1.jar",
    "slf4j-api-2.0.20.jar",
    "snakeyaml-2.5.jar",
    "spring-aop-7.0.10.jar",
    "spring-beans-7.0.10.jar",
    "spring-boot-4.0.9.jar",
    "spring-boot-autoconfigure-4.0.9.jar",
    "spring-boot-http-converter-4.0.9.jar",
    "spring-boot-jackson-4.0.9.jar",
    "spring-boot-jarmode-tools-4.0.9.jar",
    "spring-boot-security-4.0.9.jar",
    "spring-boot-security-oauth2-authorization-server-4.0.9.jar",
    "spring-boot-security-oauth2-client-4.0.9.jar",
    "spring-boot-security-oauth2-resource-server-4.0.9.jar",
    "spring-boot-servlet-4.0.9.jar",
    "spring-boot-tomcat-4.0.9.jar",
    "spring-boot-web-server-4.0.9.jar",
    "spring-boot-webmvc-4.0.9.jar",
    "spring-context-7.0.10.jar",
    "spring-core-7.0.10.jar",
    "spring-expression-7.0.10.jar",
    "spring-security-config-7.0.8.jar",
    "spring-security-core-7.0.8.jar",
    "spring-security-crypto-7.0.8.jar",
    "spring-security-oauth2-authorization-server-7.0.8.jar",
    "spring-security-oauth2-client-7.0.8.jar",
    "spring-security-oauth2-core-7.0.8.jar",
    "spring-security-oauth2-jose-7.0.8.jar",
    "spring-security-oauth2-resource-server-7.0.8.jar",
    "spring-security-web-7.0.8.jar",
    "spring-web-7.0.10.jar",
    "spring-webmvc-7.0.10.jar",
    "tomcat-embed-core-11.0.27.jar",
    "tomcat-embed-el-11.0.27.jar",
    "tomcat-embed-websocket-11.0.27.jar"
  ],
  "sourceSha256": {
    "README.md": "4112f6b102672521368a650680211af0b931f74c7c43d6ee6647bec7bde3c6c9",
    "pom.xml": "338895e44c99726731722f90815e2534755f12670fc716828f15c666b9daf395",
    "run.py": "d9ca72662df812a65715315e88108a30e3053abbfe4b75dbe498e2e4d67a952b",
    "src/main/java/study/oauthlab/AuthorizationServer.java": "38254bb8c4d23613703ded520e7c5a9c87716799a65d9b1f37dc479b7468ffbf",
    "src/main/java/study/oauthlab/OAuthLab.java": "1db6593fb8136e8e751fc9b64ed4d183f5e12a5ff4e03fd97a4c2b34cb03afe8",
    "src/main/java/study/oauthlab/OidcClient.java": "95086bba70762fd0df3b15fcf2e0aacdc37558253d6ab5192be8ff04fbb34783",
    "src/main/java/study/oauthlab/ResourceServer.java": "f8ff49ff5f2095f9f188bc7c8eb19a630e77d54330b21c761d3a8ea46e6af979",
    "src/main/resources/application.properties": "6d70e1bfe39154655808231730a9aae6005c179ed4fafa5ab1a7e4bba7cf625b"
  },
  "roles": {
    "authorizationServer": "http://127.0.0.1:60816",
    "resourceServer": "http://127.0.0.1:60817",
    "oidcClient": "http://127.0.0.1:60818"
  },
  "exitCode": 0,
  "finishedAt": "2026-10-26T17:48:24.400922+08:00",
  "httpRequests": 154,
  "allProcessesReaped": true,
  "limits": [
    "loopback HTTP synthetic lab; no production TLS/IdP/database/cluster",
    "real OAuth2/OIDC, actual reference-format access token and JWT access token both remotely introspected; reference client uses machine identity",
    "expiry/nbf inputs signed with real temporary RSA; clocks not mocked",
    "JWKS refresh observed after explicit unknown-kid trigger; retirement alone does not invalidate every cache"
  ]
}