Fixtures, expected readings and sample declarations

Every fixture committed under tests/ and docs/ in a layout serve/dev_fixture.py reads (a directory holding raw/, or a repository directory holding declaration.json) is either tabled below or named, with the reason, under Fixtures not tabled. One table per profile gives each tabled fixture's path in this repository, the first line a development check of it writes, the refused machines it counts by status with the exit code, and a sample verdict under docs/customer/samples/ where one is kept. Each row is one command run from the repository root:

python3.14 -B -m serve.check --dev --profile <profile> --fixture <fixture path> --out dev-verdict.json

--dev checks the working tree as it stands; its stdout begins DEVELOPMENT CHECK (unpinned working tree), and its verdict is marked build.kind: development and is never a served verdict. serve/dev_fixture.py names how each profile's fixture directory is laid out as the files a served check reads. The first line in each table is the verdict line of the job summary (serve.render.verdict_line), word for word; a served summary adds the engine that answered ([engine <12 hex>]) after it. A refused run writes no verdict line: its stderr line is assure: <outcome>: <reason>, the file --out names holds the refusal (schema assure.serve.failure/v1, with its outcome, reason and action) rather than a verdict; every refusal tabled below exits 3 (an option fault or an oversize bundle exits 2, and none is tabled). FIRST-LINE-SAMPLES.md explains the words of each line and VERDICTS.md the verdict's fields. A test (tests/serving/test_issue_1388_accept.py) checks that every fixture path below exists, every sample link resolves, that a development check of every tabled fixture still reads its tabled first line (for a refusal, refused: <outcome>), refused machines and exit, that each EXPECTED-READINGS.json below equals what a development check of its fixture reads, and that every fixture committed in one of those layouts is tabled or named as not tabled.

The sample verdicts are development verdicts of these fixtures on the tree that wrote them, kept verbatim: check_id, tree_sha256 and the build block change with every tree. The one with refused machines is postgresql-declared-run-37121027064.verdict.json: 3 of 8 machines read, 5 refused (machines.refused lists them, machines_refused.by_status counts them).

python-auth-declared-model

A fixture is a repository directory holding declaration.json; the check reads every file under it as raw/repository/<path>. Fixtures flask-session-f, flask-session-g and flask-session-n carry EXPECTED-READINGS.json (schema symbolia.runner-lane.expected-readings/v1, the format of tests/checkers/identity/fixtures/adapter-1-flask/EXPECTED-READINGS.json): the served colour, outcome and policy exit, and each AUTH row's state, result type, reason class and witnesses. tests/checkers/python_auth/fixtures/* are the checker's own unit fixtures; config-reads, library-guard and metadata-reads carry a stack key the served declaration schema does not admit, so a served check refuses them (profile_refused, declaration_invalid). tests/serving/fixtures/issue-2567 declares no guards entry for its admin_required decorator, so every obligation reads not established naming guards and the check reads yellow; issue-2567-confirmed is the same repository with that guard declared. tests/serving/fixtures/issue-3145 is assure-launch-demo PR #6's first commit (issue #3145): session.permanent = True (remember me) beside an identity write before the second factor. tests/serving/fixtures/guarded-signout is reduced from cookiecutter-demo (MIT, issue #3928): its declared sign-out view sits behind the sign-in guard.

Run: python3.14 -B -m serve.check --dev --profile python-auth-declared-model --fixture tests/checkers/fixtures/python-auth/flask-session-a --out dev-verdict.json

Sample declaration: python-auth-declaration.json (the declaration of flask-session-a). DECLARATIONS.md gives its fields.

mysql-declared-model

A fixture holds raw/submission.json as the MySQL collector writes it. tests/checkers/fixtures/mysql-stock/* are stock servers' submissions (MySQL 8.0, 8.4 and 9.7) as the collector wrote them. tests/serving/fixtures/ground-truth/mysql-declared-model/cases/* are the ground-truth cases (d* should be disproven, h* should hold); their GROUND-TRUTH.json scores them. The table gives what the check reads today, not the ground truth: d04-locked-account-unlocked and d05-usable-account-locked read green. other-material (a submission for another material) and refused-flags (flags.release_allowed not false) are refused before any machine runs.

Run: python3.14 -B -m serve.check --dev --profile mysql-declared-model --fixture tests/serving/fixtures/mysql-declared/positive --out dev-verdict.json

Sample declaration: mysql-declaration.json (schema symbolia.mysql-declaration.v0, the file collect_mysql.py --declaration reads): the version, collection and declared_policy sections the positive fixture's submission carries, with collection.role set to assure_collector; the collector refuses a declaration whose collection.role is not its --role.

postgresql-declared-model

A fixture holds raw/ as the collector wrote it, with declared/declaration.json and declared/clients.json placed as raw/declaration.json and raw/clients.json, and the run's REDACTION-MANIFEST.json beside raw/. A COLLECTION-SIDECAR.json or TIMING.json kept beside raw/ (where collect_pg.py writes them; collector-rf32/*, pg-declaration-proposal/*) is placed as raw/COLLECTION-SIDECAR.json or raw/TIMING.json when raw/ holds no file of that name, the step FIRST-RUN-API.md section 3 takes before sending (issue #3788); unlike the served check, the development check does not compare a copy inside raw/ with the one beside it. tests/serving/fixtures/run-37121027064 carries its manifest; tests/checkers/fixtures/observed/* do not, so their withheld lines cannot be matched to the run and the development check refuses them before any machine runs (bad_input: withheld lines under raw/ and no REDACTION-MANIFEST.json beside raw/). A fixture with no raw/declaration.json or declared/declaration.json (pg-declaration-proposal/D-a, pg-declaration-proposal/D-g, collector-rf32/*) is refused by postgresql-declared-model (bad_input); one with no COLLECTION-SIDECAR.json under or beside raw/ to observe the major version from (supabase-tenant/*, envelope-refused-row-source) is refused by postgresql-observed-baseline (profile_refused, major_not_observed); tests/serving/fixtures/rf28 holds only the collector's configuration files, with no raw/catalog_snapshot.json, and both profiles refuse it (bad_input).

The three tests/checkers/fixtures/supabase-tenant/* rows are also the declared M5 ground-truth cases of tests/serving/fixtures/ground-truth/postgresql-declared-m5/CASES.json, which tools/ci/corpus_reading.py reads (set pg-declared-m5). restricted should hold. rls-off should be disproven at RLS-1, and using-true at RLS-2. Each disproven row's M5 actionability projection reads verified. The table gives each first line; the projections are pinned in tests/serving/fixtures/corpus-reading/PINNED-READING.json.

Run: python3.14 -B -m serve.check --dev --profile postgresql-declared-model --fixture tests/serving/fixtures/run-37121027064 --out dev-verdict.json

Sample declaration: postgresql-declaration.json with postgresql-clients.json (the declared/ files of run-37121027064). DECLARATIONS.md gives their fields.

postgresql-observed-baseline

The same fixtures as postgresql-declared-model; this profile needs no declaration.

Run: python3.14 -B -m serve.check --dev --profile postgresql-observed-baseline --fixture tests/serving/fixtures/run-37121027064 --out dev-verdict.json

http-observed-baseline

A fixture is an endpoint manifest directory: manifest.json (schema_version http-fixture-001) and the response heads it names. The tests write theirs at test time with tests/serving/http_support.write_fixture; docs/customer/samples/http-endpoints is one written by it (two endpoints, each answering HTTP/1.1 200 OK with Content-Length: 0), kept so there is a directory to send. tests/serving/fixtures/ground-truth/http-observed-baseline/cases/* are the ground-truth cases (d* should be disproven, h* should hold); their GROUND-TRUTH.json scores them and READINGS.json gives each case's row status. The identity producer and the HTTP collector run over it as the Action's local mode does.

Run: python3.14 -B -m serve.check --dev --profile http-observed-baseline --fixture docs/customer/samples/http-endpoints --out dev-verdict.json

Fixtures not tabled

Committed directories in one of the layouts above that no table names, each with the reason:

• tests/serving/fixtures/issue-4161/ — Flask-bones' public URL helper with a reduced five-route guard fixture. tests/serving/test_issue_4161_accept.py pins the complete route census, the missing-guard witness and refusal boundaries; role and elevation domains are outside this fixture.
• tests/checkers/identity/fixtures/ — the identity adapters' inputs (one tree per framework adapter, fault, variant and shape: Flask, FastAPI, Django, Express, Next.js, net/http, Gin), laid out for the tests under tests/checkers/identity and the issue tests that edit them. Their readings are pinned there (adapter-1-flask's in its EXPECTED-READINGS.json), not as development checks of a served profile.
• tests/checkers/fixtures/observed-rls5/ — graphile/starter's catalog on PostgreSQL 16, 17 and 18 (corpus row O-a, issue #3992), collected by the product's collector. tests/serving/test_issue_3989_accept.py reads one obligation from each, RLS-5-OB, rather than a first line.
• tests/serving/fixtures/ground-truth/http-observed-baseline/cases/ — the http-observed-baseline ground-truth cases (issue #2646): sixteen endpoint manifests, each scored on one obligation's row status rather than a first line. Their readings are pinned in the corpus's READINGS.json and scored in its GROUND-TRUTH.json, both re-derived through serve.check --dev by tests/serving/test_issue_2646_accept.py.
• tests/serving/fixtures/ground-truth/nextjs-pages-catch/cases/ — the Next.js Pages API catch-chain ground-truth cases (C3 slice, D070), built by that directory's build.py. h01-last-setter-denies should hold; its catch returns res.status(200).status(401). d01-last-setter-allows should be disproven at IDENT-1 on ANY /api/feed; its catch returns res.status(401).status(200). No served profile reads Next.js, so there is no development check to table. tools/ci/corpus_reading.py reads them with the typescript/nextjs adapter's free run (set nextjs). Their readings are pinned in tests/serving/fixtures/corpus-reading/PINNED-READING.json.
• tests/serving/fixtures/issue-3147/ — the sign-in code of the two demo repositories (assure-free-demo PR #1, assure-launch-demo PR #6) where POST /login sets the signed-in user in a trusted-device or remember-me branch (issue #3147). Their AUTH-3 witnesses and PR comment line are pinned by tests/serving/test_issue_3147_accept.py, which reads them through the served check.