{
  "format": "fidacy.assurance-run.v2",
  "run_id": "imda-mgf-2026-08-29-30cb4734",
  "executed_at": "2026-08-29",
  "repository": "lucaslubi/fidacy",
  "source_revision": "4fd4748",
  "acceptance_script": "apps/admin/scripts/imda-authority-production-e2e.ts",
  "acceptance_script_sha256": "8714b70dc683ad533682407d81fadcd70dd7adb055251e4a72d8e22cf72992d7",
  "purpose": "Reproducible evidence supporting the Fidacy-operated IMDA MGF for Agentic AI case study contribution",
  "environment": {
    "component_tests": "local clean-process execution against repository code",
    "production_acceptance": "isolated technical Enterprise tenant against the production authority service and Stripe test mode",
    "public_interfaces": "production public endpoints",
    "customer_data_used": false,
    "live_customer_funds_moved": false
  },
  "observations": [
    {
      "control": "Exact action, resource and context binding",
      "method": "packages/firewall/test/action-mandate.test.ts and action-grant-jws.test.ts",
      "result": "PASS",
      "evidence": "A valid Ed25519-signed grant verified for its intended request and was rejected after context, resource or issuer mismatch."
    },
    {
      "control": "Single-use release",
      "method": "HostedActionGrantEnforcingExecutor replay test",
      "result": "PASS",
      "evidence": "The first eligible execution invoked the side effect once. A second executor refused the same grant with grant_replayed; the side effect count remained one."
    },
    {
      "control": "Bounded action budget and constrained delegation",
      "method": "DevActionMandateCore policy tests",
      "result": "PASS",
      "evidence": "Budget exhaustion, resource mismatch and attempts to widen actions, action budget or delegation depth were rejected."
    },
    {
      "control": "Signed ALLOW and DENY evidence",
      "method": "Ed25519 receipt verification tests",
      "result": "PASS",
      "evidence": "Both ALLOW and DENY receipts verified under the generated public key; DENY issued no grant."
    },
    {
      "control": "Public service health",
      "method": "Unauthenticated HTTP GET",
      "result": "PASS",
      "evidence": "https://api.fidacy.com/health and https://api.fidacy.com/ready returned HTTP 200 during this run."
    },
    {
      "control": "Independent signature verification interface",
      "method": "Unauthenticated HTTP GET",
      "result": "PASS",
      "evidence": "https://api.fidacy.com/.well-known/jwks.json returned HTTP 200 with two EdDSA OKP public keys during this run."
    },
    {
      "control": "Out-of-scope action denial in production",
      "method": "Authenticated production Action Demo through an isolated Enterprise test tenant",
      "result": "PASS",
      "evidence": "An attempted export of all customer records returned DENY with signed evidence and no executable release."
    },
    {
      "control": "Tampered request refusal before the payment rail",
      "method": "Change the authorised refund from USD 24 to USD 240 while presenting the original signed grant",
      "result": "PASS",
      "evidence": "The executor returned REFUSED with context_mismatch and did not call Stripe for the altered request."
    },
    {
      "control": "Authorised downstream execution",
      "method": "Redeem the exact request-bound grant and execute the refund through Stripe test mode",
      "result": "PASS",
      "evidence": "The exact USD 24 refund returned EXECUTED against a succeeded Stripe test-mode payment."
    },
    {
      "control": "Durable replay refusal",
      "method": "Present the same redeemed grant to the executor a second time",
      "result": "PASS",
      "evidence": "The executor returned REFUSED with grant_replayed and did not issue a second refund."
    },
    {
      "control": "Reviewable incident evidence",
      "method": "Export the Incident Pack for the executed decision",
      "result": "PASS",
      "evidence": "The pack contained the ALLOW decision, signed receipt and SHA-256 evidence digest."
    },
    {
      "control": "Closed-tenant fail-closed behaviour",
      "method": "Close the isolated tenant and retry its API key",
      "result": "PASS",
      "evidence": "The tenant was closed, its keys were revoked and the production API rejected the former credential."
    }
  ],
  "test_summary": {
    "component_test_files_passed": 2,
    "component_tests_passed": 6,
    "production_acceptance_checks_passed": 9,
    "failed_checks": 0,
    "duration_ms_reported_by_vitest": 433
  },
  "production_evidence": {
    "technical_tenant_id": "c847694b-0ed5-4eea-9de8-1e6e7b305c31",
    "tenant_final_status": "closed",
    "authority_run_id": "f7cc9429-18da-42d0-8a94-db0606beb0ad",
    "incident_evidence_sha256": "487c78f826caf4507598d163a9014918a16f885ebc4a4d48eb8c8ea749433831",
    "stripe_mode": "test",
    "refund_amount_minor_units": 2400,
    "refund_currency": "usd"
  },
  "limits": [
    "No independent customer production deployment is claimed.",
    "No live customer funds or customer data were used.",
    "The evidence applies to the Fidacy-connected executor path and does not imply visibility into unconnected tools.",
    "IMDA certification, endorsement or regulatory approval is not claimed."
  ],
  "reproduction": [
    "pnpm --filter @fidacy/firewall test -- action-mandate.test.ts action-grant-jws.test.ts",
    "NODE_OPTIONS=--conditions=react-server FIDACY_ENGINE_URL=https://api.fidacy.com pnpm exec vercel env run -e production -- pnpm exec tsx scripts/imda-authority-production-e2e.ts",
    "GET https://api.fidacy.com/health",
    "GET https://api.fidacy.com/ready",
    "GET https://api.fidacy.com/.well-known/jwks.json"
  ]
}