{
  "text": "{\n  \"cases\": [\n    {\n      \"case\": \"pre-rig unreadable perch\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-13T05:45:32.8201734Z\"\n          }\n        ],\n        \"created_utc\": \"2026-09-13T05:45:32.8201734Z\",\n        \"disposition\": \"PREDATES_RIG\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": true\n      },\n      \"expected_allowed\": true,\n      \"pass\": true\n    },\n    {\n      \"case\": \"native resolves unrelated image\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"live\": true,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n            \"pid\": 41000,\n            \"image\": \"C:\\\\fleet\\\\spt.exe\",\n            \"source\": \"NATIVE\",\n            \"replaces_cim_identity\": false\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"OTHER_IMAGE\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": true\n      },\n      \"expected_allowed\": true,\n      \"pass\": true\n    },\n    {\n      \"case\": \"known rig image\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": \"C:\\\\rig\\\\bin\\\\spt.exe\",\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"RIG_DAEMON_ALREADY_PRESENT\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"native resolves rig image\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"live\": true,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n            \"pid\": 41000,\n            \"image\": \"C:\\\\rig\\\\bin\\\\spt.exe\",\n            \"source\": \"NATIVE\",\n            \"replaces_cim_identity\": false\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"RIG_DAEMON_ALREADY_PRESENT\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"successful reread confirms disappearance\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"state\": \"UNRESOLVED\",\n            \"source\": \"NATIVE\",\n            \"error_type\": \"System.ComponentModel.Win32Exception\",\n            \"native_error\": 5\n          },\n          {\n            \"positive_control_pid\": 53952,\n            \"state\": \"ORIGINAL_PAIR_ABSENT\",\n            \"source\": \"CIM_REREAD\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"ORIGINAL_GONE\",\n        \"pid\": 41000,\n        \"original_gone\": true,\n        \"allowed\": true\n      },\n      \"expected_allowed\": true,\n      \"pass\": true\n    },\n    {\n      \"case\": \"persistent denied identity\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"state\": \"UNRESOLVED\",\n            \"source\": \"NATIVE\",\n            \"error_type\": \"System.ComponentModel.Win32Exception\",\n            \"native_error\": 5\n          },\n          {\n            \"same_identity\": true,\n            \"source\": \"CIM_REREAD\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"SPT_PROCESS_IDENTITY_UNRESOLVED\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"failed reread is not gone\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"state\": \"UNRESOLVED\",\n            \"source\": \"NATIVE\",\n            \"error_type\": \"System.ComponentModel.Win32Exception\",\n            \"native_error\": 5\n          },\n          {\n            \"source\": \"CIM_REREAD\",\n            \"state\": \"QUERY_FAILED\"\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"SPT_CENSUS_QUERY_FAILED\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"empty provider is not gone\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"state\": \"UNRESOLVED\",\n            \"source\": \"NATIVE\",\n            \"error_type\": \"System.ComponentModel.Win32Exception\",\n            \"native_error\": 5\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"SPT_CENSUS_CONTROL_FAILED\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"unknown birth fails closed\",\n      \"actual\": {\n        \"observations\": [],\n        \"created_utc\": null,\n        \"disposition\": \"SPT_PROCESS_BIRTH_UNREADABLE\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"precision overlap is not pre-rig\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:32.8201729Z\"\n          },\n          {\n            \"state\": \"UNRESOLVED\",\n            \"source\": \"NATIVE\",\n            \"error_type\": \"System.ComponentModel.Win32Exception\",\n            \"native_error\": 5\n          },\n          {\n            \"same_identity\": true,\n            \"source\": \"CIM_REREAD\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:32.8201729Z\"\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:32.8201729Z\",\n        \"disposition\": \"SPT_PROCESS_IDENTITY_UNRESOLVED\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"equal birth is not pre-rig\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:32.8201734Z\"\n          },\n          {\n            \"state\": \"UNRESOLVED\",\n            \"source\": \"NATIVE\",\n            \"error_type\": \"System.ComponentModel.Win32Exception\",\n            \"native_error\": 5\n          },\n          {\n            \"same_identity\": true,\n            \"source\": \"CIM_REREAD\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:32.8201734Z\"\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:32.8201734Z\",\n        \"disposition\": \"SPT_PROCESS_IDENTITY_UNRESOLVED\",\n        \"pid\": 41000,\n        \"original_gone\": false,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"native PID reuse into rig image\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"live\": true,\n            \"created_utc\": \"2026-09-14T05:45:34.8201734Z\",\n            \"pid\": 41000,\n            \"image\": \"C:\\\\rig\\\\bin\\\\spt.exe\",\n            \"source\": \"NATIVE\",\n            \"replaces_cim_identity\": true\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"RIG_DAEMON_ALREADY_PRESENT\",\n        \"pid\": 41000,\n        \"original_gone\": true,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"CIM PID reuse into rig image\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"state\": \"UNRESOLVED\",\n            \"source\": \"NATIVE\",\n            \"error_type\": \"System.ComponentModel.Win32Exception\",\n            \"native_error\": 5\n          },\n          {\n            \"same_identity\": false,\n            \"source\": \"CIM_REREAD\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:34.8201734Z\"\n          },\n          {\n            \"image\": \"C:\\\\rig\\\\bin\\\\spt.exe\",\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:34.8201734Z\"\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"RIG_DAEMON_ALREADY_PRESENT\",\n        \"pid\": 41000,\n        \"original_gone\": true,\n        \"allowed\": false\n      },\n      \"expected_allowed\": false,\n      \"pass\": true\n    },\n    {\n      \"case\": \"native retained handle signals exit\",\n      \"actual\": {\n        \"observations\": [\n          {\n            \"image\": null,\n            \"source\": \"CIM\",\n            \"pid\": 41000,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\"\n          },\n          {\n            \"live\": false,\n            \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n            \"pid\": 41000,\n            \"image\": \"\",\n            \"source\": \"NATIVE\",\n            \"replaces_cim_identity\": false\n          }\n        ],\n        \"created_utc\": \"2026-09-14T05:45:33.8201734Z\",\n        \"disposition\": \"ORIGINAL_GONE\",\n        \"pid\": 41000,\n        \"original_gone\": true,\n        \"allowed\": true\n      },\n      \"expected_allowed\": true,\n      \"pass\": true\n    }\n  ],\n  \"failed\": 0\n}\n\n\nWall time: 1.50 seconds",
  "details": {
    "timeoutSeconds": 20,
    "wallTimeMs": 1499.2136999964714
  }
}