initialize: 200 session: True
tools via /mcp: ['pilot1-get_document', 'pilot1-write_classification']
PASS C3 read passes (no approval needed) :: {'jsonrpc': '2.0', 'id': 10, 'result': {'content': [{'text': '{\n  "doc_id": "doc-001",\n  "text": "Vendor Quote Q-1001 from Example Vendor Inc. 10 units widget. (SYNTHETIC, no pricing)",\n  "classification": "internal-n
PASS C1a write WITHOUT approval_id is blocked (HOLD) :: {'jsonrpc': '2.0', 'id': 11, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: HOLD: write requires human approval', 'type': 'text'}], 'isError': True}}
PASS C1b write with FORGED approval_id is blocked :: {'jsonrpc': '2.0', 'id': 12, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: approval record not found (forged?)', 'type': 'text'}], 'isError': True}}
PASS C1c write with args changed after approval is blocked (request hash) :: {'jsonrpc': '2.0', 'id': 13, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: request differs from what the human approved', 'type': 'text'}], 'isError': True}}
PASS C1d write with EXPIRED approval is blocked :: {'jsonrpc': '2.0', 'id': 14, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: approval expired', 'type': 'text'}], 'isError': True}}
PASS C1e self-approval (approver == requester) is blocked :: {'jsonrpc': '2.0', 'id': 15, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: approver not authorized (separation of duties)', 'type': 'text'}], 'isError': True}}
PASS C2 write WITH valid approval bound to request hash is allowed :: {'jsonrpc': '2.0', 'id': 16, 'result': {'content': [{'text': '{\n  "written": true\n}', 'type': 'text'}], 'isError': False}}
PASS C1f replay of used approval is blocked :: {'jsonrpc': '2.0', 'id': 17, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: approval already used', 'type': 'text'}], 'isError': True}}
PASS C5 non-allowlisted tool is refused :: {'jsonrpc': '2.0', 'id': 18, 'result': {'content': [{'text': "Error: Tool 'delete_all_documents' not found", 'type': 'text'}], 'isError': True}}
PASS C8a call with NO tenant_id is refused (read) :: {'jsonrpc': '2.0', 'id': 30, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: missing or unknown tenant_id None', 'type': 'text'}], 'isError': True}}
PASS C8b UNKNOWN tenant_id is refused (write) :: {'jsonrpc': '2.0', 'id': 31, 'result': {'content': [{'text': "Error: AI*Right step-4 gate: missing or unknown tenant_id 'acme-unknown'", 'type': 'text'}], 'isError': True}}
PASS C8c scale-internal approval reused under tenant northwind is refused :: {'jsonrpc': '2.0', 'id': 32, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: approval belongs to another tenant', 'type': 'text'}], 'isError': True}}
PASS C8d northwind-approved write via gateway is refused by the scale-internal sink instance (tenant-scoped sink) :: {'jsonrpc': '2.0', 'id': 33, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C9a approvals store unreadable (internal exception) -> write DENIED, not passed through :: {'jsonrpc': '2.0', 'id': 40, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: guardrail internal error (JSONDecodeError): fail closed', 'type': 'text'}], 'isError': True}}
PASS C9b injected exception inside the hook -> DENIED (fail-closed wrapper) :: {'jsonrpc': '2.0', 'id': 41, 'result': {'content': [{'text': 'Error: AI*Right step-4 gate: guardrail internal error (ValueError): fail closed', 'type': 'text'}], 'isError': True}}
PASS C9c [native LiteLLM behaviour] exception that escapes the wrapper -> request NOT served :: {'jsonrpc': '2.0', 'id': 42, 'result': {'content': [{'text': 'Error: spike fault injection (raw, outside fail-closed wrapper)', 'type': 'text'}], 'isError': True}}
PASS C9d after the faults, the same approved write succeeds once (no state corrupted) :: {'jsonrpc': '2.0', 'id': 43, 'result': {'content': [{'text': '{\n  "written": true\n}', 'type': 'text'}], 'isError': False}}
PASS C6 /mcp-rest path also blocks unapproved write :: (403, '{"detail":{"error":"AI*Right step-4 gate: missing or unknown tenant_id None","guardrail_name":"airight-approval-hold","guardrail_mode":"pre_mcp_call"}}')
PASS C7a [re-run of Day-1 negative control] direct call, no approval, no gateway credential -> blocked :: {'jsonrpc': '2.0', 'id': 101, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7b direct call WITH a valid approval but NO gateway credential -> blocked :: {'jsonrpc': '2.0', 'id': 102, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7c direct call with FORGED gateway credential (wrong key) -> blocked :: {'jsonrpc': '2.0', 'id': 103, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7d direct call with TAMPERED gateway credential -> blocked :: {'jsonrpc': '2.0', 'id': 104, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7e VALID gateway credential but no approval record -> blocked by sink re-check :: {'jsonrpc': '2.0', 'id': 105, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7f VALID credential, approval for a DIFFERENT request -> blocked :: {'jsonrpc': '2.0', 'id': 106, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7g legitimate path at sink (valid credential + valid approval) -> written :: {'jsonrpc': '2.0', 'id': 107, 'result': {'content': [{'text': '{\n  "written": true\n}', 'type': 'text'}], 'isError': False}}
PASS C7h replay after consumption with a fresh VALID credential -> blocked :: {'jsonrpc': '2.0', 'id': 108, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7i replay of the approval consumed via the GATEWAY path (C2), direct with valid credential -> blocked :: {'jsonrpc': '2.0', 'id': 109, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C8e direct call with a valid NORTHWIND gateway credential against the scale-internal sink -> blocked :: {'jsonrpc': '2.0', 'id': 110, 'result': {'content': [{'text': 'Error executing tool write_classification', 'type': 'text'}], 'isError': True}}
PASS C7j sink logged every refused direct write :: ['gateway_credential_invalid', 'gateway_credential_invalid', 'gateway_credential_invalid', 'gateway_credential_invalid', 'gateway_credential_invalid', 'gateway_credential_invalid', 'request_hash_mismatch', 'replay_attemp
PASS C4 every gateway decision logged in audit-log-schema v0.4.0 (all valid) :: {'events': 16, 'invalid': [], 'decisions': [('get_document', 'success', 'read tool in allowlist; no approval needed'), ('write_classification', 'blocked_awaiting_approval', 'HOLD: write requires human approval'), ('write
PASS C4b audit trace_id propagated from caller header :: aa5e9cc566f942448aaabe134bb02dce

SUMMARY: 31 / 31 passed; sink rows: 3
