{
  "checker": {
    "claims": [
      {
        "claim": "A credential for ANTHROPIC_API_KEY can be created and read back from a vault",
        "command": "./agent-vault vault credential get --vault demo-vault ANTHROPIC_API_KEY",
        "evidence": "sk-test-12345",
        "expected": "credential get returns sk-test-12345",
        "input": "vault demo-vault, key ANTHROPIC_API_KEY=sk-test-12345 (set earlier)",
        "kind": "claim",
        "outcome": "Real input produced the expected result: sk-test-12345",
        "returncode": 0,
        "source": "For example, you can create a credential for `ANTHROPIC_API_KEY` and create a service rule for Agent Vault to substitute a dummy value `__anthropic_api_key__` for the real key.",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "Agent Vault attaches the stored credential to a request routed through the proxy",
        "command": "curl -s -m 10 -x http:<email>:14322 -H 'Authorization: <secret>' http://echo.upstream.test:18080/hello",
        "evidence": "Bearer secret-echo-789\"}",
        "expected": "upstream receives Bearer secret-echo-789",
        "input": "HTTP request via proxy 127.0.0.1:14322 to echo.upstream.test:18080 with dummy Bearer __echo_token__; service local-echo maps ECHO_TOKEN=secret-echo-789",
        "kind": "claim",
        "outcome": "Real input produced the expected result: Bearer secret-echo-789",
        "returncode": 0,
        "source": "Agent Vault intercepts every request and attaches credentials onto it before forwarding the request to the target outbound API.",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "No README-documented cron, scheduler, or --once mode. The only periodic loop is the external credential store poll interval (--poll-interval-seconds) for Infisical-backed stores, which is not configured in this guest.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "No README-documented cron, scheduler, or --once mode. The only periodic loop is the external credential store poll interval (--poll-interval-seconds) for Infisical-backed stores, which is not configured in this guest.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "./agent-vault",
        "vault",
        "credential",
        "get",
        "--vault",
        "demo-vault",
        "ANTHROPIC_API_KEY"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "sk-test-12345",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "Documented development test suite",
        "command": "make test",
        "deferred": false,
        "evidence": "cached)\nok  \tgithub.com/Infisical/agent-vault/internal/oauth\t(cached)\nok  \tgithub.com/Infisical/agent-vault/internal/pidfile\t(cached)\nok  \tgithub.com/Infisical/agent-vault/internal/proposal\t(cached)\nok  \tgithub.com/Infisical/agent-vault/internal/ratelimit\t(cached)\n?   \tgithub.com/Infisical/agent-vault/internal/requestlog\t[no test files]\nok  \tgithub.com/Infisical/agent-vault/internal/server\t(cached)\nok  \tgithub.com/Infisical/agent-vault/internal/session\t(cached)\nok  \tgithub.com/Infisical/agent-vault/internal/store\t(cached)\n?   \tgithub.com/Infisical/agent-vault/internal/telemetry\t[no test files]",
        "expected": "all Go packages pass",
        "input": "make test (HOME isolated from the running server's ~/.agent-vault pidfile)",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "nginx public UI proxy example",
        "command": "",
        "deferred": false,
        "evidence": "requires Docker, which is not installed in this guest",
        "expected": "documented command completes successfully",
        "input": "",
        "kind": "example",
        "outcome": "requires Docker, which is not installed in this guest",
        "source": "README.md",
        "verdict": "blocked"
      },
      {
        "claim": "Daytona OpenAI realtime example",
        "command": "",
        "deferred": false,
        "evidence": "requires Daytona and OpenAI credentials, which were not provided (needs_credentials)",
        "expected": "documented command completes successfully",
        "input": "",
        "kind": "example",
        "outcome": "requires Daytona and OpenAI credentials, which were not provided (needs_credentials)",
        "source": "README.md",
        "verdict": "blocked"
      },
      {
        "claim": "Slack agent template example",
        "command": "",
        "deferred": false,
        "evidence": "requires a configured Slack app and tokens, which were not provided (needs_credentials)",
        "expected": "documented command completes successfully",
        "input": "",
        "kind": "example",
        "outcome": "requires a configured Slack app and tokens, which were not provided (needs_credentials)",
        "source": "README.md",
        "verdict": "blocked"
      }
    ],
    "status": "PASS"
  },
  "deviations": [
    "AGENT_VAULT_DEV_MODE=true on the server: required to accept a localhost-style service host check in this guest; guest-only override.",
    "AGENT_VAULT_NETWORK_ALLOWLIST=127.0.0.1: netguard blocked the loopback upstream; narrow allowlist, private-range blocking otherwise on.",
    "/etc/hosts entry 127.0.0.1 echo.upstream.test: needed because service hosts must be dotted names, not IPs.",
    "Telemetry disabled (AGENT_VAULT_TELEMETRY=0).",
    "Probes use the source-built ./agent-vault, while the installer placed v0.40.2 in /usr/local/bin.",
    "make test example sets HOME to an isolated directory so the running server's pidfile is not seen by the test."
  ],
  "fault_owner": "none",
  "main_blocker": null,
  "operation": "Build Agent Vault from source (make build), run make test, start the server, create a vault and credential, add a service rule, and verify credential substitution through the MITM proxy.",
  "outcome": "working",
  "plain_failure": "Initial make test failed (exit 2) only because a manually started server was running; not a product defect.",
  "steps": [
    "Read README; pinned commit d5836ec3bb2315de38043d742ae5daca11a4944a.",
    "Installed prerequisites; ran make build (web npm ci + go build) to produce ./agent-vault.",
    "Ran README installer; agent-vault v0.40.2 installed to /usr/local/bin.",
    "Started server on 14321 (proxy 14322); registered owner; created demo-vault and ANTHROPIC_API_KEY credential; read back sk-test-12345.",
    "Added local-echo service (echo.upstream.test:18080, bearer ECHO_TOKEN); issued session token; sent request via proxy with dummy Bearer __echo_token__; upstream received Bearer secret-echo-789 (HTTP 200).",
    "make test: first run failed because a live server (PID 8516) was present; stopped server and reran: exit 0. Final example isolates HOME so the test does not see the running server pidfile; exit 0.",
    "Recorded examples and cycles; ran checker --validate --replay: valid true."
  ],
  "stuck_step": null,
  "suggested_fix": "None required. Consider making TestEnsureServerStopped_* independent of the developer's real ~/.agent-vault pidfile, e.g. by setting HOME to a temp dir inside the test."
}