{
  "schema": "MAKNOW_FLR008_LAB_FIXTURES_v1",
  "note": "Synthetic local identity/session state only. No production account, real credential, phishing workflow, customer data, or external target is used.",
  "cases": [
    {
      "id": "safe_baseline",
      "authenticator": "HEALTHY",
      "session": "HEALTHY",
      "token": "HEALTHY",
      "recovery": "AUTHORIZED",
      "signal": "NONE",
      "evidence_complete": true,
      "post_authenticator": "HEALTHY",
      "post_session": "HEALTHY",
      "post_token": "HEALTHY",
      "post_recovery": "AUTHORIZED",
      "post_evidence_complete": true
    },
    {
      "id": "authenticator_compromised",
      "authenticator": "COMPROMISED",
      "session": "UNKNOWN",
      "token": "UNKNOWN",
      "recovery": "AUTHORIZED",
      "signal": "LEAKED_PASSWORD_CORROBORATED",
      "evidence_complete": true,
      "post_authenticator": "INVALIDATED",
      "post_session": "TERMINATED",
      "post_token": "REVOKED",
      "post_recovery": "AUTHORIZED",
      "post_evidence_complete": true
    },
    {
      "id": "session_survives_password_rotation",
      "authenticator": "ROTATED_HEALTHY",
      "session": "COMPROMISED_ACTIVE",
      "token": "HEALTHY",
      "recovery": "AUTHORIZED",
      "signal": "OLD_SESSION_POST_ROTATION",
      "evidence_complete": true,
      "post_authenticator": "ROTATED_HEALTHY",
      "post_session": "TERMINATED",
      "post_token": "HEALTHY",
      "post_recovery": "AUTHORIZED",
      "post_evidence_complete": true
    },
    {
      "id": "delegated_token_residual",
      "authenticator": "INVALIDATED",
      "session": "TERMINATED",
      "token": "COMPROMISED_ACTIVE",
      "recovery": "AUTHORIZED",
      "signal": "TOKEN_USE_AFTER_AUTH_INVALIDATION",
      "evidence_complete": true,
      "post_authenticator": "INVALIDATED",
      "post_session": "TERMINATED",
      "post_token": "REVOKED",
      "post_recovery": "AUTHORIZED",
      "post_evidence_complete": true
    },
    {
      "id": "recovery_path_compromised",
      "authenticator": "HEALTHY",
      "session": "HEALTHY",
      "token": "HEALTHY",
      "recovery": "UNAUTHORIZED_CHANGED",
      "signal": "RECOVERY_CHANGE_CORROBORATED",
      "evidence_complete": true,
      "post_authenticator": "HEALTHY",
      "post_session": "TERMINATED",
      "post_token": "REVOKED",
      "post_recovery": "RESTORED_AUTHORIZED",
      "post_evidence_complete": true
    },
    {
      "id": "suspicious_recovery_legitimate",
      "authenticator": "HEALTHY",
      "session": "HEALTHY",
      "token": "HEALTHY",
      "recovery": "AUTHORIZED_CHANGED",
      "signal": "RECOVERY_CHANGE_SUSPICIOUS",
      "evidence_complete": true,
      "post_authenticator": "HEALTHY",
      "post_session": "HEALTHY",
      "post_token": "HEALTHY",
      "post_recovery": "AUTHORIZED_CHANGED",
      "post_evidence_complete": true
    },
    {
      "id": "boundary_unresolved",
      "authenticator": "UNKNOWN",
      "session": "UNKNOWN",
      "token": "UNKNOWN",
      "recovery": "UNKNOWN",
      "signal": "NEW_DEVICE_ONLY",
      "evidence_complete": false,
      "post_authenticator": "UNKNOWN",
      "post_session": "UNKNOWN",
      "post_token": "UNKNOWN",
      "post_recovery": "UNKNOWN",
      "post_evidence_complete": false
    },
    {
      "id": "transfer_stolen_session_clean_auth",
      "authenticator": "HEALTHY",
      "session": "COMPROMISED_ACTIVE",
      "token": "HEALTHY",
      "recovery": "AUTHORIZED",
      "signal": "STOLEN_SESSION_CORROBORATED",
      "evidence_complete": true,
      "post_authenticator": "HEALTHY",
      "post_session": "TERMINATED",
      "post_token": "HEALTHY",
      "post_recovery": "AUTHORIZED",
      "post_evidence_complete": true
    }
  ]
}