{
  "schema": 1,
  "synthetic": true,
  "description": "Normalized teaching evidence. No payload, memory bytes or credentials.",
  "cases": [
    {
      "id": "unexpected",
      "label": "Unexpected executable mapping",
      "approval": "unapproved",
      "coverage": "complete",
      "events": [
        {
          "phase": "request",
          "timeMs": 10,
          "callId": "unexpected-call",
          "process": "node-a/boot-7/pid-820/start-9",
          "podUid": "pod-uid-a",
          "containerId": "container-a",
          "mappingId": "mapping-42",
          "operation": "mprotect",
          "before": "rw-",
          "requested": "r-x"
        },
        {
          "phase": "result",
          "timeMs": 12,
          "callId": "unexpected-call",
          "process": "node-a/boot-7/pid-820/start-9",
          "podUid": "pod-uid-a",
          "containerId": "container-a",
          "mappingId": "mapping-42",
          "operation": "mprotect",
          "result": 0,
          "after": "r-x"
        }
      ]
    },
    {
      "id": "jit",
      "label": "Approved JIT workload",
      "approval": "approved",
      "coverage": "complete",
      "events": [
        {
          "phase": "request",
          "timeMs": 10,
          "callId": "jit-call",
          "process": "node-a/boot-7/pid-820/start-9",
          "podUid": "pod-uid-a",
          "containerId": "container-a",
          "mappingId": "mapping-42",
          "operation": "mprotect",
          "before": "rw-",
          "requested": "r-x"
        },
        {
          "phase": "result",
          "timeMs": 12,
          "callId": "jit-call",
          "process": "node-a/boot-7/pid-820/start-9",
          "podUid": "pod-uid-a",
          "containerId": "container-a",
          "mappingId": "mapping-42",
          "operation": "mprotect",
          "result": 0,
          "after": "r-x"
        }
      ]
    },
    {
      "id": "denied",
      "label": "Permission change denied",
      "approval": "unapproved",
      "coverage": "complete",
      "events": [
        {
          "phase": "request",
          "timeMs": 10,
          "callId": "denied-call",
          "process": "node-a/boot-7/pid-820/start-9",
          "podUid": "pod-uid-a",
          "containerId": "container-a",
          "mappingId": "mapping-42",
          "operation": "mprotect",
          "before": "rw-",
          "requested": "r-x"
        },
        {
          "phase": "result",
          "timeMs": 12,
          "callId": "denied-call",
          "process": "node-a/boot-7/pid-820/start-9",
          "podUid": "pod-uid-a",
          "containerId": "container-a",
          "mappingId": "mapping-42",
          "operation": "mprotect",
          "result": -1,
          "after": "rw-",
          "error": "EACCES"
        }
      ]
    },
    {
      "id": "gap",
      "label": "Collector coverage gap",
      "approval": "unknown",
      "coverage": "loss",
      "events": [
        {
          "phase": "request",
          "timeMs": 10,
          "callId": "gap-call",
          "process": "node-a/boot-7/pid-820/start-9",
          "podUid": "pod-uid-a",
          "containerId": "container-a",
          "mappingId": "mapping-42",
          "operation": "mprotect",
          "before": "rw-",
          "requested": "r-x"
        }
      ]
    }
  ]
}