[
  {
    "test_id": "OWASP-A01-/api/admin/users",
    "name": "A01 access control: anonymous GET to admin endpoint",
    "severity": "INFO",
    "passed": true,
    "detail": "expected 401/403/404, got 401",
    "evidence": {
      "path": "/api/admin/users",
      "status": 401
    }
  },
  {
    "test_id": "OWASP-A01-/api/admin/agents",
    "name": "A01 access control: anonymous GET to admin endpoint",
    "severity": "INFO",
    "passed": true,
    "detail": "expected 401/403/404, got 401",
    "evidence": {
      "path": "/api/admin/agents",
      "status": 401
    }
  },
  {
    "test_id": "OWASP-A01-/api/admin/kill-switch/status",
    "name": "A01 access control: anonymous GET to kill-switch admin",
    "severity": "INFO",
    "passed": true,
    "detail": "expected 401/403/404, got 401",
    "evidence": {
      "path": "/api/admin/kill-switch/status",
      "status": 401
    }
  },
  {
    "test_id": "OWASP-A01-/api/internal/debug",
    "name": "A01 access control: anonymous GET to internal debug",
    "severity": "INFO",
    "passed": true,
    "detail": "expected 401/403/404, got 401",
    "evidence": {
      "path": "/api/internal/debug",
      "status": 401
    }
  },
  {
    "test_id": "OWASP-A01-path-traversal",
    "name": "A01 path traversal probe",
    "severity": "INFO",
    "passed": true,
    "detail": "status 403; body must not include root: line",
    "evidence": {
      "body_has_root": false
    }
  },
  {
    "test_id": "OWASP-A02-HSTS",
    "name": "A02 HSTS header present",
    "severity": "INFO",
    "passed": true,
    "detail": "strict-transport-security: max-age=31536000; includeSubDomains; preload",
    "evidence": {
      "hsts": "max-age=31536000; includeSubDomains; preload"
    }
  },
  {
    "test_id": "OWASP-A02-CSP",
    "name": "A02 Content-Security-Policy present",
    "severity": "INFO",
    "passed": true,
    "detail": "CSP length 22",
    "evidence": {
      "has_csp": true
    }
  },
  {
    "test_id": "OWASP-A03-SQLi-error-leak",
    "name": "A03 SQL injection probe must not surface SQL errors",
    "severity": "INFO",
    "passed": true,
    "detail": "signatures matched: []",
    "evidence": {
      "signatures": [],
      "status": 200
    }
  },
  {
    "test_id": "OWASP-A03-XSS-reflection",
    "name": "A03 XSS payload must not reflect un-escaped",
    "severity": "INFO",
    "passed": true,
    "detail": "reflected: False",
    "evidence": {
      "reflected": false
    }
  },
  {
    "test_id": "OWASP-A05-no-x-powered-by",
    "name": "A05 no X-Powered-By header (no tech stack disclosure)",
    "severity": "INFO",
    "passed": true,
    "detail": "X-Powered-By: absent",
    "evidence": {
      "x_powered_by": null
    }
  },
  {
    "test_id": "OWASP-A05-server-version",
    "name": "A05 server header does not leak version",
    "severity": "INFO",
    "passed": true,
    "detail": "server: cloudflare",
    "evidence": {
      "server": "cloudflare"
    }
  },
  {
    "test_id": "OWASP-A05-frame-protection",
    "name": "A05 clickjacking protection in place",
    "severity": "INFO",
    "passed": true,
    "detail": "frame-ancestors/X-Frame-Options ok=True",
    "evidence": {
      "x_frame_options": "DENY"
    }
  },
  {
    "test_id": "OWASP-A07-magic-fake-token",
    "name": "A07 magic-link fake token must reject",
    "severity": "INFO",
    "passed": true,
    "detail": "fake token verify status 400",
    "evidence": {
      "status": 400
    }
  },
  {
    "test_id": "OWASP-A09-asr-chain-gate",
    "name": "A09 ASR chain verify endpoint behind auth",
    "severity": "INFO",
    "passed": true,
    "detail": "status 401",
    "evidence": {
      "status": 401
    }
  },
  {
    "test_id": "OWASP-A10-ssrf-loopback",
    "name": "A10 SSRF probe (loopback)",
    "severity": "INFO",
    "passed": true,
    "detail": "status 403, suspicious body=False",
    "evidence": {
      "status": 403,
      "suspicious": false
    }
  },
  {
    "test_id": "OWASP-A10-ssrf-aws-metadata",
    "name": "A10 SSRF probe (aws-metadata)",
    "severity": "INFO",
    "passed": true,
    "detail": "status 403, suspicious body=False",
    "evidence": {
      "status": 403,
      "suspicious": false
    }
  },
  {
    "test_id": "OWASP-A10-ssrf-file-scheme",
    "name": "A10 SSRF probe (file-scheme)",
    "severity": "INFO",
    "passed": true,
    "detail": "status 403, suspicious body=False",
    "evidence": {
      "status": 403,
      "suspicious": false
    }
  },
  {
    "test_id": "KURAL-18-ksl-mutation-no-sig",
    "name": "KURAL 18: KSL mutation without signature must reject",
    "severity": "INFO",
    "passed": true,
    "detail": "status 401 (expected 401/403)",
    "evidence": {
      "status": 401
    }
  },
  {
    "test_id": "KURAL-18-ksl-forged-sig",
    "name": "KURAL 18: forged KSL signature must reject",
    "severity": "INFO",
    "passed": true,
    "detail": "status 401 (expected 401/403)",
    "evidence": {
      "status": 401
    }
  },
  {
    "test_id": "KURAL-19-chain-delete",
    "name": "KURAL 19: DELETE on audit chain must reject",
    "severity": "INFO",
    "passed": true,
    "detail": "status 401",
    "evidence": {
      "status": 401,
      "method": "DELETE"
    }
  },
  {
    "test_id": "KURAL-19-chain-put",
    "name": "KURAL 19: PUT on audit chain must reject",
    "severity": "INFO",
    "passed": true,
    "detail": "status 401",
    "evidence": {
      "status": 401,
      "method": "PUT"
    }
  },
  {
    "test_id": "KURAL-19-chain-patch",
    "name": "KURAL 19: PATCH on audit chain must reject",
    "severity": "INFO",
    "passed": true,
    "detail": "status 401",
    "evidence": {
      "status": 401,
      "method": "PATCH"
    }
  },
  {
    "test_id": "KURAL-22-lsia-mode-observable",
    "name": "KURAL 22: LSIA mode endpoint returns a valid mode",
    "severity": "INFO",
    "passed": true,
    "detail": "body excerpt: {\"mode\":\"OPERATIONAL\",\"transitioned_at\":\"2026-05-10T09:02:30.651945+00:00\",\"reason\":null}",
    "evidence": {
      "status": 200,
      "body_excerpt": "{\"mode\":\"OPERATIONAL\",\"transitioned_at\":\"2026-05-10T09:02:30.651945+00:00\",\"reason\":null}"
    }
  },
  {
    "test_id": "KURAL-23-federation-gated",
    "name": "KURAL 23: federation sample endpoint properly auth-gated",
    "severity": "INFO",
    "passed": true,
    "detail": "status 401 \u2014 endpoint not anonymously readable",
    "evidence": {
      "status": 401
    }
  }
]