{
  "sample_type": "合成设计样例",
  "execution_status": "尚未在目标环境执行",
  "origins": {
    "host": "https://host.example.invalid",
    "agent_frame": "https://agent.other.invalid",
    "same_site_control_frame": "https://agent.example.invalid"
  },
  "message_example": {
    "type": "DEMO_SESSION_HANDOFF",
    "nonce_alias": "DEMO-NONCE-1",
    "exchange_code": "仅别名，非真实凭据"
  },
  "browser_matrix_columns": [
    "browser_version",
    "privacy_mode",
    "enterprise_policy",
    "cookie_set_observed",
    "cookie_sent_observed",
    "backend_identity",
    "frame_identity",
    "evidence"
  ],
  "cases": [
    {
      "case_id": "CK01",
      "input": "Cookie可用",
      "expected": "仍验证后端身份与权限，不能只看页面",
      "observed": ""
    },
    {
      "case_id": "CK02",
      "input": "Cookie被策略限制",
      "expected": "记录实际阻止原因与受控替代入口，不泛化所有浏览器",
      "observed": ""
    },
    {
      "case_id": "CK03",
      "input": "应用会话过期",
      "expected": "重新认证或交接，不能归因Cookie必然被拦",
      "observed": ""
    },
    {
      "case_id": "CK04",
      "input": "宿主从甲切换乙",
      "expected": "iframe刷新/拒绝旧会话，不显示甲历史",
      "observed": ""
    },
    {
      "case_id": "CK05",
      "input": "消息来源或窗口不符",
      "expected": "拒绝，不接收任意用户ID作为认证",
      "observed": ""
    },
    {
      "case_id": "CK06",
      "input": "重放一次性兑换凭证",
      "expected": "后端拒绝，具体机制需实现",
      "observed": ""
    },
    {
      "case_id": "CK07",
      "input": "宿主导航/iframe重载",
      "expected": "按生命周期重新核对，旧凭证不无限复用",
      "observed": ""
    },
    {
      "case_id": "CK08",
      "input": "CORS允许但Cookie不可用",
      "expected": "分层排查，不把CORS当登录成功证据",
      "observed": ""
    },
    {
      "expected": "根据实际站点关系记录策略，不把跨子域一概当第三方",
      "input": "比较同站控制组与跨站嵌入组",
      "case_id": "CK09",
      "observed": ""
    }
  ]
}