{
 "use_case": "evidence-runner",
 "title": "Rehearsal: a quarterly evidence run on a made-up identity admin console",
 "about": "Keystone Admin is a made-up identity admin console served inside the runner's own browser (nothing leaves it). The approved baseline was made by a setup run on last quarter's settings; this quarter four named settings changed and one setting next to a named one flipped. The run opens every screen from its saved route with no model calls, re-reads each setting, captures every screen, and signs a certificate. It must report exactly the planted changes, reach every screen, let no write through, and the certificate must verify while a copy with one check flipped must not.",
 "licence": "Synthetic: the console, its company and its settings were written for Decosa (decosa-api, AGPL-3.0-or-later). No real product, tenant or person.",
 "inputs": [],
 "steps": [
  {"id": "info", "method": "GET", "path": "/evidence/info", "auth": false},
  {"id": "run", "method": "POST", "path": "/evidence/runs", "stream": "sse", "timeout": 120,
   "body": {"sample": "keystone", "mode": "certify", "quarter": "q3"}},
  {"id": "verify", "method": "POST", "path": "/testruns/verify", "auth": false,
   "body": {"certificate": {"$ref": "run.events[type=certificate][0].certificate"}}},
  {"id": "tampered", "method": "POST", "path": "/testruns/verify", "auth": false,
   "body": {"certificate": {"$ref": "run.events[type=certificate][0].certificate"}},
   "tamper": {"at": "certificate.entries[kind=check].pass", "set": false}}
 ],
 "checks": [
  {"says": "the hosted service offers the made-up consoles only", "path": "info.surfaces.hosted", "contains": "made-up"},
  {"says": "nine screens are captured", "path": "run.events[type=capture]", "count": 9},
  {"says": "exactly the four planted screens changed", "path": "run.events[type=capture,pass=false].id", "equals": ["pw", "session", "roles", "alerts"]},
  {"says": "the minimum password length change is found (12 to 14)", "path": "run.events[type=capture,id=pw][0].now.Minimum length", "equals": "14"},
  {"says": "the setting that flipped next to a named one is reported", "path": "run.events[type=capture,id=2sv][0].other_changes.setting", "any_equals": "Allow user to trust the device"},
  {"says": "every saved route reached its screen", "path": "run.events[type=capture].broke", "all_in": [false]},
  {"says": "the quarterly run makes no model calls", "path": "run.done.usage.calls", "equals": 0},
  {"says": "no write reached the console", "path": "run.done.gate.writes_reached_site", "equals": 0},
  {"says": "the certificate verifies", "path": "verify.ok", "equals": true},
  {"says": "a certificate with one check flipped no longer verifies", "path": "tampered.ok", "equals": false}
 ]
}