{"usingRealCookie":false,"summary":{"total":10,"passed":10,"failed":0,"skipped":0,"credentialLeaks":0},"verdict":"FAIL-CLOSED HOLDS","checks":[{"name":"baseline","expectation":"null (synthetic id is not a live session)","outcome":"null","pass":true,"ms":37},{"name":"wrong-token","expectation":"null — rejected credential","outcome":"null","pass":true,"ms":12},{"name":"wrong-path","expectation":"null — non-2xx","outcome":"null","pass":true,"ms":9},{"name":"unreachable-host","expectation":"null — connection refused","outcome":"null","pass":true,"ms":0,"notes":"onError: TypeError: fetch failed"},{"name":"tiny-timeout","expectation":"null — abort at 1ms","outcome":"null","pass":true,"ms":1,"notes":"onError: AbortError: This operation was aborted"},{"name":"missing-url","expectation":"throws at construction — never degrades to a stub","outcome":"threw: Error: session-validation-client: validatorUrl is required.","pass":true,"ms":null},{"name":"missing-token","expectation":"throws at construction — never degrades to a stub","outcome":"threw: Error: session-validation-client: authToken is required.","pass":true,"ms":null},{"name":"stub in production, flag set","expectation":"null — production always fails closed, flag ignored","outcome":"null","pass":true,"ms":null},{"name":"stub in development, no flag","expectation":"null — opt-in required","outcome":"null","pass":true,"ms":null},{"name":"stub in development, flag set","expectation":"session — documented insecure dev behavior","outcome":"session","pass":true,"ms":null}],"leaks":[]}