{
  "cases": [
    {
      "input": "https://blocked.example/",
      "label": "DNS feed baseline",
      "result": {
        "verdict": {
          "action": "block",
          "categories": [
            "unclassified"
          ],
          "reason": "DNS baseline: Synthetic threat feed",
          "revision": 0,
          "rule_id": null,
          "url": "https://blocked.example/"
        }
      }
    },
    {
      "input": "https://safe.blocked.example/",
      "label": "Explicit DNS exception",
      "result": {
        "verdict": {
          "action": "allow",
          "categories": [
            "unclassified"
          ],
          "reason": "Organization default",
          "revision": 0,
          "rule_id": null,
          "url": "https://safe.blocked.example/"
        }
      }
    },
    {
      "input": "https://restricted.example/",
      "label": "Browser domain rule",
      "result": {
        "verdict": {
          "action": "block",
          "categories": [
            "unclassified"
          ],
          "reason": "global rule restricted (domain)",
          "revision": 0,
          "rule_id": "restricted",
          "url": "https://restricted.example/"
        }
      }
    },
    {
      "input": "https://restricted.example./",
      "label": "Root-dot bypass regression",
      "result": {
        "verdict": {
          "action": "block",
          "categories": [
            "unclassified"
          ],
          "reason": "global rule restricted (domain)",
          "revision": 0,
          "rule_id": "restricted",
          "url": "https://restricted.example/"
        }
      }
    },
    {
      "input": "https://restricted.example.evil.test/",
      "label": "Suffix boundary",
      "result": {
        "verdict": {
          "action": "allow",
          "categories": [
            "unclassified"
          ],
          "reason": "Organization default",
          "revision": 0,
          "rule_id": null,
          "url": "https://restricted.example.evil.test/"
        }
      }
    },
    {
      "input": "https://public.example/",
      "label": "Unmatched destination",
      "result": {
        "verdict": {
          "action": "allow",
          "categories": [
            "unclassified"
          ],
          "reason": "Organization default",
          "revision": 0,
          "rule_id": null,
          "url": "https://public.example/"
        }
      }
    },
    {
      "input": "https://user:secret@public.example/",
      "label": "Credential URL rejected",
      "result": {
        "error": "URLs containing credentials are rejected"
      }
    },
    {
      "input": "https://restricted.example../",
      "label": "Ambiguous host rejected",
      "result": {
        "error": "Invalid empty host label"
      }
    },
    {
      "input": "https://public.example/",
      "label": "Missing identity denied",
      "result": {
        "verdict": {
          "action": "block",
          "categories": [
            "unclassified"
          ],
          "reason": "Desktop identity is missing or does not match the enrolled OS account",
          "revision": 0,
          "rule_id": null,
          "url": "https://public.example/"
        }
      }
    },
    {
      "input": "https://public.example/",
      "label": "Matching identity",
      "result": {
        "verdict": {
          "action": "allow",
          "categories": [
            "unclassified"
          ],
          "reason": "Organization default",
          "revision": 0,
          "rule_id": null,
          "url": "https://public.example/"
        }
      }
    }
  ],
  "mode": "deterministic Rust application replay",
  "network_access": false,
  "schema_version": 1,
  "synthetic": true
}