{
  "format": "verdock.team-trial.1",
  "version": "0.1.9",
  "cases": [
    {
      "case": "viewer_cannot_execute",
      "status": "REFUSED",
      "record_changes": 0
    },
    {
      "case": "pause_before_effects",
      "status": "PAUSED",
      "record_changes": 0
    },
    {
      "case": "handoff_resume_verified",
      "status": "PASS",
      "record_changes": 4,
      "checks": {
        "login_disabled": true,
        "tokens_revoked": true,
        "collaborations_removed": true,
        "control_unchanged": true,
        "scope_valid": true
      }
    },
    {
      "case": "duplicate_delivery",
      "status": "PASS",
      "record_changes": 0
    },
    {
      "case": "post_incident_recovery",
      "status": "PASS",
      "record_changes": 1,
      "checks": {
        "login_disabled": true,
        "tokens_revoked": true,
        "collaborations_removed": true,
        "control_unchanged": true,
        "scope_valid": true
      }
    },
    {
      "case": "revoked_browser_identity",
      "status": "REFUSED",
      "record_changes": 0
    }
  ],
  "role_provider": "Separate pinned Docker roles with network disabled",
  "boundary": "Actual shipped HTTP service, signed permissions, Docker roles and SQLite reference connector. Synthetic records; no customer production or savings claim. A test driver synchronized one pause without changing role output."
}