{
  "host": "certificate-demo.sugarbushagent.com",
  "mode": "Cloudflare Free-plan Worker with application-level C=US certificate validation; not Cloudflare Access",
  "tool": "Codex, Python TLS, YubiKey PIV, Cloudflare Worker and signed C=US registry",
  "testedAt": "2026-11-01T16:21:15.818623+00:00",
  "cases": [
    {
      "case": "no_certificate",
      "status": 401,
      "response": {
        "allowed": false,
        "reason": "A TLS client certificate is required; HTTP identity headers are not proof",
        "disclosure": "C=US demonstration. Lafayette personhood is simulated. Certificate authentication is separate from current Directory authority. This endpoint performs no agent action."
      }
    },
    {
      "case": "forged_identity_headers",
      "status": 401,
      "response": {
        "allowed": false,
        "reason": "A TLS client certificate is required; HTTP identity headers are not proof",
        "disclosure": "C=US demonstration. Lafayette personhood is simulated. Certificate authentication is separate from current Directory authority. This endpoint performs no agent action."
      }
    },
    {
      "case": "untrusted_lookalike_certificate",
      "status": 403,
      "response": {
        "allowed": false,
        "reason": "not issued by the c=US root",
        "disclosure": "C=US demonstration. Lafayette personhood is simulated. Certificate authentication is separate from current Directory authority. This endpoint performs no agent action."
      }
    },
    {
      "case": "registered_yubikey_certificate",
      "path": "/whoami",
      "status": 200,
      "response": {
        "certificateAuthenticated": true,
        "agentIdentifier": "wimse://cequs.com/agents/testagentantigrav1",
        "fingerprint": "6806839A5DF006A85A9348C1484F08449AD5CF33EB6E7C5640FAE929973E8E19",
        "certificateNotAfter": "2026-11-16T15:01:18.000Z",
        "issuer": "C=US hardware root",
        "accountablePerson": "Marquis de La Fayette (illustrative; personhood simulated)",
        "directoryBranch": "st=Schuylkill,c=US",
        "authorityChecked": false,
        "disclosure": "C=US demonstration. Lafayette personhood is simulated. Certificate authentication is separate from current Directory authority. This endpoint performs no agent action."
      },
      "proof": {
        "yubikeySignatures": 1,
        "tlsVersion": "TLS 1.3"
      }
    },
    {
      "case": "registered_yubikey_certificate",
      "path": "/authorize",
      "status": 200,
      "response": {
        "certificateAuthenticated": true,
        "agentIdentifier": "wimse://cequs.com/agents/testagentantigrav1",
        "fingerprint": "6806839A5DF006A85A9348C1484F08449AD5CF33EB6E7C5640FAE929973E8E19",
        "certificateNotAfter": "2026-11-16T15:01:18.000Z",
        "issuer": "C=US hardware root",
        "accountablePerson": "Marquis de La Fayette (illustrative; personhood simulated)",
        "directoryBranch": "st=Schuylkill,c=US",
        "authorityChecked": true,
        "allowed": true,
        "action": "cequs.architecture.review.propose",
        "resource": "o=Cequs,c=US",
        "reason": "C=US: certificate bound to an active agent holding a current grant under o=Cequs,c=US for cequs.architecture.review.propose",
        "registryEvaluatedAt": "2026-11-01T16:21:16Z",
        "disclosure": "C=US demonstration. Lafayette personhood is simulated. Certificate authentication is separate from current Directory authority. This endpoint performs no agent action."
      },
      "proof": {
        "yubikeySignatures": 1,
        "tlsVersion": "TLS 1.3"
      }
    }
  ],
  "limitations": [
    "Lafayette personhood is simulated",
    "No live stop or restart was performed",
    "No Amazon authorization is implied"
  ]
}