# Fixtures, expected readings and sample declarations

Every fixture committed under `tests/` and `docs/` in a layout `serve/dev_fixture.py` reads (a directory holding `raw/`, or a repository directory holding `declaration.json`) is either tabled below or named, with the reason, under [Fixtures not tabled](#fixtures-not-tabled). One table per profile gives each tabled fixture's path in this repository, the first line a development check of it writes, the refused machines it counts by status with the exit code, and a sample verdict under `docs/customer/samples/` where one is kept. Each row is one command run from the repository root:

```sh
python3.14 -B -m serve.check --dev --profile <profile> --fixture <fixture path> --out dev-verdict.json
```

`--dev` checks the working tree as it stands; its stdout begins `DEVELOPMENT CHECK (unpinned working tree)`, and its verdict is marked `build.kind: development` and is never a served verdict. `serve/dev_fixture.py` names how each profile's fixture directory is laid out as the files a served check reads. The first line in each table is the verdict line of the job summary (`serve.render.verdict_line`), word for word; a served summary adds the engine that answered (`[engine <12 hex>]`) after it. A refused run writes no verdict line: its stderr line is `assure: <outcome>: <reason>`, the file `--out` names holds the refusal (`schema` `assure.serve.failure/v1`, with its `outcome`, `reason` and `action`) rather than a verdict; every refusal tabled below exits 3 (an option fault or an oversize bundle exits 2, and none is tabled). [FIRST-LINE-SAMPLES.md](/docs/first-line-samples) explains the words of each line and [VERDICTS.md](/docs/verdicts) the verdict's fields. A test (`tests/serving/test_issue_1388_accept.py`) checks that every fixture path below exists, every sample link resolves, that a development check of every tabled fixture still reads its tabled first line (for a refusal, `refused: <outcome>`), refused machines and exit, that each `EXPECTED-READINGS.json` below equals what a development check of its fixture reads, and that every fixture committed in one of those layouts is tabled or named as not tabled.

The sample verdicts are development verdicts of these fixtures on the tree that wrote them, kept verbatim: `check_id`, `tree_sha256` and the `build` block change with every tree. The one with refused machines is [postgresql-declared-run-37121027064.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/postgresql-declared-run-37121027064.verdict.json): 3 of 8 machines read, 5 refused (`machines.refused` lists them, `machines_refused.by_status` counts them).

## python-auth-declared-model

A fixture is a repository directory holding `declaration.json`; the check reads every file under it as `raw/repository/<path>`. Fixtures `flask-session-f`, `flask-session-g` and `flask-session-n` carry `EXPECTED-READINGS.json` (schema `symbolia.runner-lane.expected-readings/v1`, the format of `tests/checkers/identity/fixtures/adapter-1-flask/EXPECTED-READINGS.json`): the served colour, outcome and policy exit, and each AUTH row's state, result type, reason class and witnesses. `tests/checkers/python_auth/fixtures/*` are the checker's own unit fixtures; `config-reads`, `library-guard` and `metadata-reads` carry a `stack` key the served declaration schema does not admit, so a served check refuses them (`profile_refused`, `declaration_invalid`). `tests/serving/fixtures/issue-2567` declares no `guards` entry for its `admin_required` decorator, so every obligation reads not established naming `guards` and the check reads yellow; `issue-2567-confirmed` is the same repository with that guard declared. `tests/serving/fixtures/issue-3145` is assure-launch-demo PR #6's first commit (issue #3145): `session.permanent = True` (remember me) beside an identity write before the second factor. `tests/serving/fixtures/guarded-signout` is reduced from cookiecutter-demo (MIT, issue #3928): its declared sign-out view sits behind the sign-in guard.

Run: `python3.14 -B -m serve.check --dev --profile python-auth-declared-model --fixture tests/checkers/fixtures/python-auth/flask-session-a --out dev-verdict.json`

| Fixture | Expected first line | Refused machines (`machines_refused.by_status`); exit | Sample verdict |
|---|---|---|---|
| `tests/checkers/fixtures/python-auth/flask-session-a` | `red: 1 of 1 machines read; declared premises: 7; version pins: none; disproven: 2, first AUTH-1 — app/__init__.py:49` | none; exit 1 | [python-auth-flask-session-a.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/python-auth-flask-session-a.verdict.json) |
| `tests/checkers/fixtures/python-auth/flask-session-b` | `green: 1 of 1 machines read; declared premises: 7; version pins: none; nothing disproven; established: 5 of 6; not established: 1 — top action: a method is a later profile version` | none; exit 0 | [python-auth-flask-session-b.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/python-auth-flask-session-b.verdict.json) |
| `tests/checkers/fixtures/python-auth/flask-session-c` | `yellow: could not look: the input could not be represented; dynamic_registration at app/__init__.py:76; rewrite the registration the reason names as a static route registration, or move it outside app_roots, and resubmit the repository and declaration: incomplete reading: dynamic_registration (app, 76, loop)` | `not_evaluated`: 1; exit 3 | [python-auth-flask-session-c.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/python-auth-flask-session-c.verdict.json) |
| `tests/checkers/fixtures/python-auth/flask-session-d` | `yellow: could not look: the input could not be represented; unknown_registration_form at app/__init__.py:75; review the repository or declaration input the reason names and resubmit: incomplete reading: unknown_registration_form (app, 75, get)` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-e` | `yellow: could not look: the input could not be represented; unrecognised_session_op at app/__init__.py:78; review the repository or declaration input the reason names and resubmit: incomplete reading: unrecognised_session_op (app, 78, session.update({'user_id': request.form['uid']}))` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-f` | `red: 1 of 1 machines read; declared premises: 6; version pins: none; disproven: AUTH-4 — reachable (state, actor) pairs with no reset to ANON: elevated+user_id/admin, pending_user_id/admin, pending_user_id/none, user_id/admin, user_id/none` | none; exit 1 | — |
| `tests/checkers/fixtures/python-auth/flask-session-g` | `red: 1 of 1 machines read; declared premises: 7; version pins: none; disproven: 2, first AUTH-1 — app/__init__.py:82` | none; exit 1 | — |
| `tests/checkers/fixtures/python-auth/flask-session-h` | `yellow: could not look: the input could not be represented; app_object_escape at app/__init__.py:77; review the repository or declaration input the reason names and resubmit: incomplete reading: app_object_escape (app, 77, call_argument Api); unrecognised_import (app, 75, flask_restful)` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-i` | `yellow: could not look: the input could not be represented; app_object_escape at app/__init__.py:78; review the repository or declaration input the reason names and resubmit: incomplete reading: app_object_escape (app, 78, call_argument Security); unrecognised_import (app, 75, flask_security)` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-j` | `yellow: could not look: the input could not be represented; unrecognised_import at app/__init__.py:75; review the repository or declaration input the reason names and resubmit: incomplete reading: unrecognised_import (app, 75, fastapi)` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-k` | `yellow: could not look: the input could not be represented; app_object_escape at app/__init__.py:77; review the repository or declaration input the reason names and resubmit: incomplete reading: app_object_escape (app, 77, passed to init_app, which uses it outside the allow-list)` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-l` | `yellow: could not look: the input could not be represented; ambiguous_definition at app/__init__.py:2; review the repository or declaration input the reason names and resubmit: incomplete reading: ambiguous_definition (app, 2, login_required); ambiguous_definition (app, 8, login_required)` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-m` | `yellow: could not look: the input could not be represented; shadowed_name at app/guards.py:5; review the repository or declaration input the reason names and resubmit: incomplete reading: shadowed_name (app.guards, 5, abort)` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-n` | `red: 1 of 1 machines read; declared premises: 7; version pins: none; disproven: AUTH-1 — app/__init__.py:78` | none; exit 1 | — |
| `tests/checkers/fixtures/python-auth/flask-session-o` | `green: 1 of 1 machines read; declared premises: 8; version pins: none; nothing disproven; established: 5 of 6; not established: 1 — top action: a method is a later profile version` | none; exit 0 | — |
| `tests/checkers/python_auth/fixtures/config-reads` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/checkers/python_auth/fixtures/factory` | `red: 1 of 1 machines read; declared premises: 2; version pins: none; disproven: AUTH-4 — reachable (state, actor) pairs with no reset to ANON: user_id/none` | none; exit 1 | — |
| `tests/checkers/python_auth/fixtures/factory-loop` | `yellow: could not look: the input could not be represented; unregistered_blueprint at conduit/user/views.py:5; review the repository or declaration input the reason names and resubmit: incomplete reading: unregistered_blueprint (conduit.user.views, 5, blueprint); dynamic_registration (conduit.app, 20, register_blueprint in a loop); undeclared_app_object (conduit.app, 20, register_bl` | `not_evaluated`: 1; exit 3 | — |
| `tests/checkers/python_auth/fixtures/library-guard` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/checkers/python_auth/fixtures/metadata-reads` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/python-auth/flask-session-p` | `red: 1 of 1 machines read; declared premises: 2; version pins: none; disproven: 2, first AUTH-1 — app/main/views.py:18` | none; exit 1 | — |
| `tests/checkers/fixtures/python-auth/issue-3061-before-hook` | `green: 1 of 1 machines read; declared premises: 8; version pins: none; nothing disproven; established: 5 of 6; not established: 1 — top action: a method is a later profile version` | none; exit 0 | — |
| `tests/serving/fixtures/issue-2567` | `yellow: could not look: the input could not be represented; review the repository or declaration input the reason names and resubmit: the declaration leaves out guards (declaration.json#/guards), which AUTH-1 reads` | `not_evaluated`: 1; exit 3 | — |
| `tests/serving/fixtures/issue-2567-confirmed` | `green: 1 of 1 machines read; declared premises: 1; version pins: none; nothing could be established (0 of 6 obligations hold); not established: 6 — top action: a method is a later profile version` | none; exit 0 | — |
| `tests/serving/fixtures/issue-3145` | `red: 1 of 1 machines read; declared premises: 7; version pins: none; disproven: AUTH-3 — app/auth.py:28` | none; exit 1 | — |
| `tests/serving/fixtures/guarded-signout` | `red: 1 of 1 machines read; declared premises: 3; version pins: none; disproven: AUTH-1 — app/__init__.py:37` | none; exit 1 | — |

Sample declaration: [python-auth-declaration.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/python-auth-declaration.json) (the declaration of `flask-session-a`). [DECLARATIONS.md](/docs/declarations) gives its fields.

## mysql-declared-model

A fixture holds `raw/submission.json` as the MySQL collector writes it. `tests/checkers/fixtures/mysql-stock/*` are stock servers' submissions (MySQL 8.0, 8.4 and 9.7) as the collector wrote them. `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/*` are the ground-truth cases (`d*` should be disproven, `h*` should hold); their `GROUND-TRUTH.json` scores them. The table gives what the check reads today, not the ground truth: `d04-locked-account-unlocked` and `d05-usable-account-locked` read green. `other-material` (a submission for another material) and `refused-flags` (`flags.release_allowed` not false) are refused before any machine runs.

Run: `python3.14 -B -m serve.check --dev --profile mysql-declared-model --fixture tests/serving/fixtures/mysql-declared/positive --out dev-verdict.json`

| Fixture | Expected first line | Refused machines (`machines_refused.by_status`); exit | Sample verdict |
|---|---|---|---|
| `tests/serving/fixtures/mysql-declared/positive` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | [mysql-positive.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/mysql-positive.verdict.json) |
| `tests/serving/fixtures/mysql-declared/m8-fails` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: 2, first LR-3 — declared row-format-only channel without REQUIRE_ROW_FORMAT set (clause c)` | none; exit 1 | [mysql-m8-fails.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/mysql-m8-fails.verdict.json) |
| `tests/serving/fixtures/mysql-declared/other-material` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/serving/fixtures/mysql-declared/refused-flags` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/mysql-stock/8.0` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: CONN-4 — 2 of 2 item(s) fails; first: Host value uses the % or _ wildcard characters and the deployment does not allow them (clause b); restrict the account to the hosts that connect, or state that any host is intended by listing the account in declared_policy.wildcard_host_accounts` | none; exit 1 | — |
| `tests/checkers/fixtures/mysql-stock/8.4` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: CONN-4 — 2 of 2 item(s) fails; first: Host value uses the % or _ wildcard characters and the deployment does not allow them (clause b); restrict the account to the hosts that connect, or state that any host is intended by listing the account in declared_policy.wildcard_host_accounts` | none; exit 1 | — |
| `tests/checkers/fixtures/mysql-stock/9.7` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: CONN-4 — 2 of 2 item(s) fails; first: Host value uses the % or _ wildcard characters and the deployment does not allow them (clause b); restrict the account to the hosts that connect, or state that any host is intended by listing the account in declared_policy.wildcard_host_accounts` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d01-applier-lacks-delete` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: LR-5 — a declared operation needs a privilege the channel's PRIVILEGE_CHECKS_USER account lacks in the snapshot (clauses a, b, d, e)` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d02-row-format-off` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: LR-3 — declared row-format-only channel without REQUIRE_ROW_FORMAT set (clause c)` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d03-applier-lacks-update-delete` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: LR-5 — a declared operation needs a privilege the channel's PRIVILEGE_CHECKS_USER account lacks in the snapshot (clauses a, b, d, e)` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d04-locked-account-unlocked` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d05-usable-account-locked` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d06-anonymous-account` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: CONN-2 — 1 of 1 item(s) fails; first: blank user name (an anonymous user, clause a) and the deployment declares no anonymous access (clause c)` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d07-wildcard-host` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: CONN-4 — 1 of 1 item(s) fails; first: Host value uses the % or _ wildcard characters and the deployment does not allow them (clause b); restrict the account to the hosts that connect, or state that any host is intended by listing the account in declared_policy.wildcard_host_accounts` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d08-no-failed-login-tracking` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: CONN-9 — 1 of 1 item(s) fails; first: an option is zero; both must be nonzero for failed-login tracking and temporary locking to occur (clause a); the other option's value does not change this` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/d09-require-current-off` | `red: 7 of 7 machines read; declared premises: 0; version pins: none; disproven: CONN-8 — under OFF it is not required that account password changes specify the current password (clause a) and the deployment requires it (clause b)` | none; exit 1 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/h01-positive` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/h02-applier-extra-select` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/h03-second-locked-account` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/h04-more-failed-login-attempts` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/h05-longer-password-lifetime` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |
| `tests/serving/fixtures/ground-truth/mysql-declared-model/cases/h06-admin-extra-privilege` | `green: 7 of 7 machines read; declared premises: 0; version pins: none; nothing disproven; established: 10 of 50; vacuous: 1; not established: 39 — top action: collect the facts CONN-3 reads` | none; exit 0 | — |

Sample declaration: [mysql-declaration.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/mysql-declaration.json) (schema `symbolia.mysql-declaration.v0`, the file `collect_mysql.py --declaration` reads): the `version`, `collection` and `declared_policy` sections the `positive` fixture's submission carries, with `collection.role` set to `assure_collector`; the collector refuses a declaration whose `collection.role` is not its `--role`.

## postgresql-declared-model

A fixture holds `raw/` as the collector wrote it, with `declared/declaration.json` and `declared/clients.json` placed as `raw/declaration.json` and `raw/clients.json`, and the run's `REDACTION-MANIFEST.json` beside `raw/`. A `COLLECTION-SIDECAR.json` or `TIMING.json` kept beside `raw/` (where `collect_pg.py` writes them; `collector-rf32/*`, `pg-declaration-proposal/*`) is placed as `raw/COLLECTION-SIDECAR.json` or `raw/TIMING.json` when `raw/` holds no file of that name, the step [FIRST-RUN-API.md](/docs/first-run-api) section 3 takes before sending (issue #3788); unlike the served check, the development check does not compare a copy inside `raw/` with the one beside it. `tests/serving/fixtures/run-37121027064` carries its manifest; `tests/checkers/fixtures/observed/*` do not, so their withheld lines cannot be matched to the run and the development check refuses them before any machine runs (`bad_input`: withheld lines under `raw/` and no `REDACTION-MANIFEST.json` beside `raw/`). A fixture with no `raw/declaration.json` or `declared/declaration.json` (`pg-declaration-proposal/D-a`, `pg-declaration-proposal/D-g`, `collector-rf32/*`) is refused by `postgresql-declared-model` (`bad_input`); one with no `COLLECTION-SIDECAR.json` under or beside `raw/` to observe the major version from (`supabase-tenant/*`, `envelope-refused-row-source`) is refused by `postgresql-observed-baseline` (`profile_refused`, `major_not_observed`); `tests/serving/fixtures/rf28` holds only the collector's configuration files, with no `raw/catalog_snapshot.json`, and both profiles refuse it (`bad_input`).

The three `tests/checkers/fixtures/supabase-tenant/*` rows are also the declared M5 ground-truth cases of `tests/serving/fixtures/ground-truth/postgresql-declared-m5/CASES.json`, which `tools/ci/corpus_reading.py` reads (set `pg-declared-m5`). `restricted` should hold. `rls-off` should be disproven at RLS-1, and `using-true` at RLS-2. Each disproven row's M5 actionability projection reads `verified`. The table gives each first line; the projections are pinned in `tests/serving/fixtures/corpus-reading/PINNED-READING.json`.

Run: `python3.14 -B -m serve.check --dev --profile postgresql-declared-model --fixture tests/serving/fixtures/run-37121027064 --out dev-verdict.json`

| Fixture | Expected first line | Refused machines (`machines_refused.by_status`); exit | Sample verdict |
|---|---|---|---|
| `tests/serving/fixtures/run-37121027064` | `green: 3 of 8 machines read, 5 refused; declared premises: 0; version pins: none; nothing could be established (0 of 15 obligations hold); not established: 15 — top action: collect the facts REP-1 reads` | `missing_premise`: 2, `not_evaluated`: 3; exit 0 | [postgresql-declared-run-37121027064.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/postgresql-declared-run-37121027064.verdict.json) |
| `tests/checkers/fixtures/observed/pg16-null-acl-001` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/observed/pg17-null-acl-001` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/observed/run-37121027064` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/pg-declaration-proposal/D-a` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/pg-declaration-proposal/D-g` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/pg-declaration-proposal/D-i-synthetic` | `green: 5 of 8 machines read, 3 refused; declared premises: 0; version pins: none; nothing disproven; established: 4 of 26; vacuous: 6; not established: 16 — top action: collect the facts REP-1 reads` | `missing_premise`: 2, `not_evaluated`: 1; exit 0 | — |
| `tests/checkers/fixtures/supabase-tenant/restricted` | `green: 6 of 8 machines read, 2 refused; declared premises: 0; version pins: none; nothing disproven; established: 8 of 30; vacuous: 7; not established: 15 — top action: collect the facts REP-1 reads` | `missing_premise`: 1, `not_evaluated`: 1; exit 0 | — |
| `tests/checkers/fixtures/supabase-tenant/rls-off` | `red: 6 of 8 machines read, 2 refused; declared premises: 0; version pins: none; disproven: RLS-1 — cpd_records, user_a:direct, raw/catalog_snapshot.json#/objects/0/relrowsecurity` | `missing_premise`: 1, `not_evaluated`: 1; exit 1 | — |
| `tests/checkers/fixtures/supabase-tenant/using-true` | `red: 6 of 8 machines read, 2 refused; declared premises: 0; version pins: none; disproven: RLS-2 — cpd_records, user_a:direct, raw/catalog_snapshot.json#/policies/0/polqual` | `missing_premise`: 1, `not_evaluated`: 1; exit 1 | — |
| `tests/serving/fixtures/collector-rf32/out-14` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/serving/fixtures/collector-rf32/out-16` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/serving/fixtures/collector-rf32/out-18` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/serving/fixtures/envelope-refused-row-source` | `green: 7 of 8 machines read, 1 refused; declared premises: 0; version pins: none; nothing disproven; established: 8 of 36; vacuous: 7; not established: 21 — top action: collect the facts REP-1 reads` | `missing_premise`: 1; exit 0 | — |
| `tests/serving/fixtures/rf28` | `refused: bad_input` | no verdict; exit 3 | — |

Sample declaration: [postgresql-declaration.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/postgresql-declaration.json) with [postgresql-clients.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/postgresql-clients.json) (the `declared/` files of `run-37121027064`). [DECLARATIONS.md](/docs/declarations) gives their fields.

## postgresql-observed-baseline

The same fixtures as `postgresql-declared-model`; this profile needs no declaration.

Run: `python3.14 -B -m serve.check --dev --profile postgresql-observed-baseline --fixture tests/serving/fixtures/run-37121027064 --out dev-verdict.json`

| Fixture | Expected first line | Refused machines (`machines_refused.by_status`); exit | Sample verdict |
|---|---|---|---|
| `tests/serving/fixtures/run-37121027064` | `green: 8 of 8 machines read; declared premises: none (observed profile); version pins: major 18; nothing disproven; established: 18 of 55; deviations: 2; vacuous: 14; not established: 21 — top action: state it in requirements.md` | none; exit 0 | [postgresql-observed-run-37121027064.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/postgresql-observed-run-37121027064.verdict.json) |
| `tests/checkers/fixtures/observed/pg16-null-acl-001` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/observed/pg17-null-acl-001` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/observed/run-37121027064` | `refused: bad_input` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/pg-declaration-proposal/D-a` | `green: 7 of 8 machines read, 1 refused; declared premises: none (observed profile); version pins: major 17; nothing disproven; established: 15 of 55; vacuous: 15; not established: 25 — top action: state it in requirements.md` | `not_observed`: 1; exit 0 | — |
| `tests/checkers/fixtures/pg-declaration-proposal/D-g` | `green: 7 of 8 machines read, 1 refused; declared premises: none (observed profile); version pins: major 17; nothing disproven; established: 18 of 55; deviations: 1; vacuous: 13; not established: 23 — top action: state it in requirements.md` | `not_observed`: 1; exit 0 | — |
| `tests/checkers/fixtures/pg-declaration-proposal/D-i-synthetic` | `green: 7 of 8 machines read, 1 refused; declared premises: none (observed profile); version pins: major 17; nothing disproven; established: 18 of 55; deviations: 1; vacuous: 11; not established: 25 — top action: state it in requirements.md` | `not_observed`: 1; exit 0 | — |
| `tests/checkers/fixtures/supabase-tenant/restricted` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/supabase-tenant/rls-off` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/checkers/fixtures/supabase-tenant/using-true` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/serving/fixtures/collector-rf32/out-14` | `green: 5 of 8 machines read, 3 refused; declared premises: none (observed profile); version pins: major 14; nothing disproven; established: 14 of 55; vacuous: 11; not established: 30 — top action: state it in requirements.md` | `missing_method`: 1, `representation`: 2; exit 0 | — |
| `tests/serving/fixtures/collector-rf32/out-16` | `green: 7 of 8 machines read, 1 refused; declared premises: none (observed profile); version pins: major 16; nothing disproven; established: 15 of 55; vacuous: 13; not established: 27 — top action: state it in requirements.md` | `missing_method`: 1; exit 0 | — |
| `tests/serving/fixtures/collector-rf32/out-18` | `green: 7 of 8 machines read, 1 refused; declared premises: none (observed profile); version pins: major 18; nothing disproven; established: 15 of 55; vacuous: 14; not established: 26 — top action: state it in requirements.md` | `missing_method`: 1; exit 0 | — |
| `tests/serving/fixtures/envelope-refused-row-source` | `refused: profile_refused` | no verdict; exit 3 | — |
| `tests/serving/fixtures/rf28` | `refused: bad_input` | no verdict; exit 3 | — |

## http-observed-baseline

A fixture is an endpoint manifest directory: `manifest.json` (schema_version `http-fixture-001`) and the response heads it names. The tests write theirs at test time with `tests/serving/http_support.write_fixture`; `docs/customer/samples/http-endpoints` is one written by it (two endpoints, each answering `HTTP/1.1 200 OK` with `Content-Length: 0`), kept so there is a directory to send. `tests/serving/fixtures/ground-truth/http-observed-baseline/cases/*` are the ground-truth cases (`d*` should be disproven, `h*` should hold); their `GROUND-TRUTH.json` scores them and `READINGS.json` gives each case's row status. The identity producer and the HTTP collector run over it as the Action's local mode does.

Run: `python3.14 -B -m serve.check --dev --profile http-observed-baseline --fixture docs/customer/samples/http-endpoints --out dev-verdict.json`

| Fixture | Expected first line | Refused machines (`machines_refused.by_status`); exit | Sample verdict |
|---|---|---|---|
| `docs/customer/samples/http-endpoints` | `green: 2 of 2 endpoints observed; 5 of 5 machines read; declared premises: 12; version pins: none; nothing disproven; established: 3 of 12; vacuous: 6; not established: 3 — top action: declare redirects in raw/HTTP-INTENT.json beside the collected files (docs/customer/VERDICTS.md); requirements.md cannot state an HTTP requirement in this release` | none; exit 0 | [http-endpoints.verdict.json](https://github.com/Symbolia-Assurance/assure-action/blob/v0/docs/samples/http-endpoints.verdict.json) |

## Fixtures not tabled

Committed directories in one of the layouts above that no table names, each with the reason:

- `tests/serving/fixtures/issue-4161/` — Flask-bones' public URL helper with a reduced five-route guard fixture. `tests/serving/test_issue_4161_accept.py` pins the complete route census, the missing-guard witness and refusal boundaries; role and elevation domains are outside this fixture.
- `tests/checkers/identity/fixtures/` — the identity adapters' inputs (one tree per framework adapter, fault, variant and shape: Flask, FastAPI, Django, Express, Next.js, net/http, Gin), laid out for the tests under `tests/checkers/identity` and the issue tests that edit them. Their readings are pinned there (adapter-1-flask's in its `EXPECTED-READINGS.json`), not as development checks of a served profile.
- `tests/checkers/fixtures/observed-rls5/` — graphile/starter's catalog on PostgreSQL 16, 17 and 18 (corpus row O-a, issue #3992), collected by the product's collector. `tests/serving/test_issue_3989_accept.py` reads one obligation from each, RLS-5-OB, rather than a first line.
- `tests/serving/fixtures/ground-truth/http-observed-baseline/cases/` — the http-observed-baseline ground-truth cases (issue #2646): sixteen endpoint manifests, each scored on one obligation's row status rather than a first line. Their readings are pinned in the corpus's `READINGS.json` and scored in its `GROUND-TRUTH.json`, both re-derived through `serve.check --dev` by `tests/serving/test_issue_2646_accept.py`.
- `tests/serving/fixtures/ground-truth/nextjs-pages-catch/cases/` — the Next.js Pages API catch-chain ground-truth cases (C3 slice, D070), built by that directory's `build.py`. `h01-last-setter-denies` should hold; its catch returns `res.status(200).status(401)`. `d01-last-setter-allows` should be disproven at IDENT-1 on `ANY /api/feed`; its catch returns `res.status(401).status(200)`. No served profile reads Next.js, so there is no development check to table. `tools/ci/corpus_reading.py` reads them with the typescript/nextjs adapter's free run (set `nextjs`). Their readings are pinned in `tests/serving/fixtures/corpus-reading/PINNED-READING.json`.
- `tests/serving/fixtures/issue-3147/` — the sign-in code of the two demo repositories (assure-free-demo PR #1, assure-launch-demo PR #6) where POST /login sets the signed-in user in a trusted-device or remember-me branch (issue #3147). Their AUTH-3 witnesses and PR comment line are pinned by `tests/serving/test_issue_3147_accept.py`, which reads them through the served check.