[
 {
  "actual": {
   "outcome": "ALLOWED",
   "qc_verified": true,
   "stage": "allow"
  },
  "expected": "consensus allow, verified QC, outcome ALLOWED",
  "id": "GOV-BFT-01",
  "latency_ms": 158.1,
  "name": "BFT commit -> authorization -> permit",
  "passed": true
 },
 {
  "actual": {
   "detail": "not committed by a quorum: CONSENSUS_TIMEOUT (fail closed)",
   "outcome": "BLOCKED",
   "stage": "deny"
  },
  "expected": "consensus deny, outcome BLOCKED (fail closed)",
  "id": "GOV-BFT-02",
  "latency_ms": 3545.7,
  "name": "no quorum (2 of 4 down) -> no authorization",
  "passed": true
 },
 {
  "actual": {
   "fetched_from": [
    "n1",
    "n2",
    "n4"
   ],
   "stage": "allow"
  },
  "expected": "rejected for that replica; a genuine certificate from another replica authorizes",
  "id": "GOV-BFT-03",
  "latency_ms": null,
  "name": "one replica serves a tampered commit certificate",
  "passed": true
 },
 {
  "actual": {
   "detail": "not committed by a quorum: replica claimed COMMITTED but the certificate did not verify: commit certificate is for a different operation tha",
   "stage": "deny"
  },
  "expected": "deny",
  "id": "GOV-BFT-04",
  "latency_ms": null,
  "name": "replica lies 'COMMITTED' (certificate is for another operation)",
  "passed": true
 },
 {
  "actual": {
   "outcome": "BLOCKED",
   "stage": "deferred"
  },
  "expected": "reply does not wait; outcome stays BLOCKED",
  "id": "GOV-BFT-05",
  "latency_ms": null,
  "name": "non-permit decision: consensus deferred",
  "passed": true
 },
 {
  "actual": {
   "elapsed_ns": 118185,
   "fast_path": "AUTHORIZED",
   "reconcile": {
    "committed": 1,
    "failed": []
   }
  },
  "expected": "snapshot committed by the real engines (verified QC); fast path AUTHORIZED",
  "id": "GOV-BFT-06",
  "latency_ms": null,
  "name": "quorum-committed authorization snapshot -> local permit",
  "passed": true
 },
 {
  "actual": {
   "at_121s": "EXPIRED",
   "at_60s": "AUTHORIZED"
  },
  "expected": "AUTHORIZED at +60 s with no quorum reachable; EXPIRED at +121 s (TTL 120 s)",
  "finding": "consensus-independent permit window = snapshot TTL (default 120 s, auto 300 s, max 900 s)",
  "id": "GOV-BFT-07",
  "latency_ms": null,
  "name": "cluster outage: snapshot keeps authorizing until TTL, then stops",
  "passed": true
 },
 {
  "actual": {
   "fast_path": "STALE_IDENTITY"
  },
  "expected": "MISS(STALE_IDENTITY)",
  "id": "GOV-BFT-09",
  "latency_ms": null,
  "name": "identity change -> snapshot stale",
  "passed": true
 },
 {
  "actual": {
   "fallback_stage": "deny",
   "fast_path": "NO_SNAPSHOT",
   "outcome": "BLOCKED",
   "revocation_to_miss_ns": 176113
  },
  "expected": "next fast-path call is a MISS (snapshot revoked/dropped) with no consensus; fallback round fails closed",
  "finding": "revocation is a LOCAL durable epoch: immediate, needs no quorum, and is not itself quorum-ordered",
  "id": "GOV-BFT-08",
  "latency_ms": null,
  "name": "revocation during outage -> no authorization",
  "passed": true
 },
 {
  "actual": {
   "stage": "allow"
  },
  "expected": "a gateway-computed ALLOWED commitment is committed whatever the decision content",
  "finding": "BFT gives ordering + quorum-signed non-repudiation of the gateway's decision, NOT Byzantine tolerance of the decision logic: a compromised gateway can still commit a wrong ALLOWED",
  "id": "GOV-BFT-10",
  "latency_ms": null,
  "name": "replicas order commitments; they do not re-evaluate governance",
  "passed": true
 }
]