Add one adversarial bundle with a single, explicit fault: a payload/request mismatch, missing role, digest change, invalid side condition, or theorem-level overclaim.
Include a valid control and assert the narrowest expected rejection. Keep the contribution to one attack case with a stable oracle.
Add one adversarial bundle with a single, explicit fault: a payload/request mismatch, missing role, digest change, invalid side condition, or theorem-level overclaim.
Include a valid control and assert the narrowest expected rejection. Keep the contribution to one attack case with a stable oracle.