{
 "engine": "ARB/1.1",
 "description": "Adversarial conformance vectors for the new ARB/1.1 checks: three-state verdicts, independence classification, off-site corroboration, and transport/security surface. Each vector names a fixture URL (served by fixtures/tiny_server.py once started), a check id, and the verdict a correct implementation MUST produce.",
 "network_exceptions": [
  "offsite.wikidata's VERIFIED vector depends on the real, public, unauthenticated Wikidata API (www.wikidata.org). This cannot be faked locally without defeating the point of the check.",
  "sec.cert_valid's VERIFIED vector depends on one real HTTPS site with a CA-issued certificate (https://apexclawai.com/), because chain-of-trust validity is inherently rooted in real, publicly-trusted certificate authorities -- a self-signed local cert can only ever demonstrate the UNVERIFIED path correctly."
 ],
 "vectors": [
  {"fixture": "http://127.0.0.1:8897/", "label": "offsite_clean", "check": "offsite.sameas_resolve", "expect_verdict": "VERIFIED", "expect_independence": "independent"},
  {"fixture": "http://127.0.0.1:8896/", "label": "offsite_dirty", "check": "offsite.sameas_resolve", "expect_verdict": "UNVERIFIED", "expect_independence": "correlated"},
  {"fixture": "http://127.0.0.1:8897/", "label": "offsite_clean", "check": "offsite.citations_resolve", "expect_verdict": "VERIFIED", "expect_independence": "independent"},
  {"fixture": "http://127.0.0.1:8896/", "label": "offsite_dirty", "check": "offsite.citations_resolve", "expect_verdict": "UNVERIFIED"},
  {"fixture": "http://127.0.0.1:8897/", "label": "offsite_clean", "check": "offsite.security_contact", "expect_verdict": "VERIFIED"},
  {"fixture": "http://127.0.0.1:8896/", "label": "offsite_dirty", "check": "offsite.security_contact", "expect_verdict": "UNVERIFIED"},
  {"fixture": "http://127.0.0.1:8897/", "label": "offsite_clean", "check": "offsite.wikidata", "expect_verdict": "VERIFIED", "note": "network exception -- real Wikidata API"},
  {"fixture": "http://127.0.0.1:8896/", "label": "offsite_dirty", "check": "offsite.wikidata", "expect_verdict": "UNVERIFIED", "note": "network exception -- real Wikidata API"},
  {"fixture": "http://127.0.0.1:8898/", "label": "v1.0 weak fixture, reused", "check": "offsite.sameas_resolve", "expect_verdict": "UNOBSERVABLE"},
  {"fixture": "http://127.0.0.1:8898/", "label": "v1.0 weak fixture, reused", "check": "offsite.citations_resolve", "expect_verdict": "UNOBSERVABLE"},

  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean", "check": "sec.hsts", "expect_verdict": "VERIFIED"},
  {"fixture": "http://127.0.0.1:8890/", "label": "security_dirty", "check": "sec.hsts", "expect_verdict": "UNVERIFIED"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean", "check": "sec.csp", "expect_verdict": "VERIFIED"},
  {"fixture": "http://127.0.0.1:8890/", "label": "security_dirty", "check": "sec.csp", "expect_verdict": "UNVERIFIED"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean", "check": "sec.xcto", "expect_verdict": "VERIFIED"},
  {"fixture": "http://127.0.0.1:8890/", "label": "security_dirty", "check": "sec.xcto", "expect_verdict": "UNVERIFIED"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean", "check": "sec.referrer_policy", "expect_verdict": "VERIFIED"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean", "check": "sec.permissions_policy", "expect_verdict": "VERIFIED"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean", "check": "sec.server_banner", "expect_verdict": "VERIFIED"},
  {"fixture": "http://127.0.0.1:8890/", "label": "security_dirty", "check": "sec.server_banner", "expect_verdict": "UNVERIFIED"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean (plain http)", "check": "sec.tls_version", "expect_verdict": "UNOBSERVABLE"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean (plain http)", "check": "sec.cert_valid", "expect_verdict": "UNOBSERVABLE"},
  {"fixture": "http://127.0.0.1:8891/", "label": "security_clean (plain http)", "check": "sec.mixed_content", "expect_verdict": "UNOBSERVABLE"},
  {"fixture": "https://127.0.0.1:8889/", "label": "tls_dirty_cert (self-signed)", "check": "sec.tls_version", "expect_verdict": "VERIFIED"},
  {"fixture": "https://127.0.0.1:8889/", "label": "tls_dirty_cert (self-signed)", "check": "sec.cert_valid", "expect_verdict": "UNVERIFIED"},
  {"fixture": "https://127.0.0.1:8889/", "label": "tls_dirty_cert (self-signed, mixed content)", "check": "sec.mixed_content", "expect_verdict": "UNVERIFIED"},
  {"fixture": "https://127.0.0.1:8888/", "label": "tls_no_mixed (self-signed, no mixed content)", "check": "sec.mixed_content", "expect_verdict": "VERIFIED"},
  {"fixture": "https://apexclawai.com/", "label": "live apexclawai.com", "check": "sec.cert_valid", "expect_verdict": "VERIFIED", "note": "network exception -- real CA-issued certificate"}
 ]
}