Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Run the GraphQL matrix
Use resource and resourceInsecure with User A, User B, Admin, and Anonymous. Interpret 200 errors semantically.
Run the room matrix
Send subscribe for user_b through /ws-secure and /ws-insecure under the same four identities. Record handshake and message authorization separately.
Replay captured events
Capture User B's event_replay request and apply User A. Compare secure denial with insecure foreign secret exposure.
Mutate channel and tenant fields
Test only captured room, channel, object, and tenant candidates. Require two foreign resources or rooms before raising confidence.
Test subscription abuse
Distinguish unauthorized subscription, unauthorized event replay, duplicate delivery, and harmless public events. Save the exact abusive action.
Prove it before moving on.
One evidence set shows identity application across GraphQL query, WebSocket handshake, subscription, room mutation, and event replay.