karst 0.2.0 → 0.4.0

data/lib/karst/cli/reproduction.rb

@@ -0,0 +1,267 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "../../karst"
+require_relative "identity_serialization"
+require_relative "principal_reference"
+require_relative "../reproduction/exercise"
+require_relative "../reproduction/curl"
+
+module Karst
+  module CLI
+    # The one adapter over Karst::Reproduction::Exercise, shared by
+    # `bin/rails karst:reproduce`, the MCP reproduce_request tool, and the
+    # /karst panel -- exactly as Karst::CLI::Verification is shared by
+    # `karst:verify` and verify_access. Nothing downstream re-runs an
+    # Exercise or re-serializes an Observation, so the recipe an agent reads
+    # and the recipe a developer reads cannot drift apart.
+    #
+    # This class owns two decisions Exercise deliberately does not: which
+    # identity to send the request under (the first candidate Karst's own
+    # sampler offers, or a genuine anonymous probe), and how an Observation
+    # becomes a stable evidence document.
+    # rubocop:disable Metrics/ClassLength
+    class Reproduction
+      include IdentitySerialization
+
+      # 3 (was 2): `execution` gained controller_completed, exception_phase,
+      # and rendered -- additive -- but `response` (status/content_type/
+      # redirect) also stopped trusting session.request/session.response
+      # once a target request raised before producing one. Those fields
+      # could previously read back an *earlier* request's status, content
+      # type, or location on the same reproduction session (identity
+      # establishment's own request, most often); they now report nil, named
+      # in `unobserved`, in exactly that situation. This is a correctness
+      # fix, not a new failure mode: any consumer reading `response.status`
+      # after `execution.exception_class` was already set was reading a
+      # value Karst should never have reported.
+      SCHEMA_VERSION = 3
+
+      # Same-connection rollback contains database writes and nothing else.
+      # Named in the document rather than left implicit, so an agent
+      # reasoning about whether to issue a mutating request sees the real
+      # boundary instead of assuming "isolated" means isolated.
+      NOT_ISOLATED = ["background jobs", "mail", "outbound HTTP", "files", "other database connections"].freeze
+
+      # `as`, when given, is a human-only "MODEL:ID" reference (e.g.
+      # "User:72") naming one existing principal to send this one request as,
+      # instead of the ordinary sampled candidate -- see
+      # Karst::CLI::PrincipalReference. Resolved exclusively through
+      # Karst::Identity.resolve, so it can never select a record outside a
+      # configured principal source. Mutually exclusive with `anonymous`;
+      # nothing about this reaches the MCP reproduce_request tool, which
+      # never accepts it.
+      # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
+      def initialize(path:, http_method: "GET", body: nil, content_type: nil, headers: {},
+                     anonymous: false, as: nil, base_url: nil, output: $stdout, json: false)
+        PrincipalReference.parse(as) if as
+        raise ArgumentError, "--anonymous and --as cannot be combined" if anonymous && as
+
+        @path = path
+        @http_method = http_method
+        @body = body
+        @content_type = content_type
+        @headers = headers || {}
+        @anonymous = anonymous
+        @as = as
+        @base_url = base_url.to_s.empty? ? Karst::Reproduction::Curl::DEFAULT_BASE_URL : base_url.to_s
+        @output = output
+        @json = json
+      end
+      # rubocop:enable Metrics/ParameterLists, Metrics/MethodLength
+
+      def call
+        observation = run
+        @output.puts(@json ? JSON.generate(document(observation)) : human(observation))
+        observation.exception_class ? 1 : 0
+      rescue Access::Error, Identity::Error, ArgumentError => e
+        @output.puts(@json ? JSON.generate(error_document(e)) : "Karst cannot reproduce this request:\n#{e.message}")
+        2
+      end
+
+      # The stable evidence document, with no dependency on @output. Always
+      # returns a Hash -- either the recipe or error_document(e) -- so no
+      # adapter has to decide how a Karst failure becomes a transport error.
+      def evidence
+        document(run)
+      rescue Access::Error, Identity::Error, ArgumentError => e
+        error_document(e)
+      end
+
+      private
+
+      # rubocop:disable Metrics/MethodLength
+      def run
+        @identity_reason = nil
+        principal = if @anonymous
+                      Identity::ANONYMOUS
+                    elsif @as
+                      PrincipalReference.resolve(@as)
+                    else
+                      sampled_principal
+                    end
+        Karst::Reproduction::Exercise.new(
+          path: @path, http_method: @http_method, body: @body, content_type: @content_type,
+          headers: @headers, principal: principal
+        ).call
+      end
+      # rubocop:enable Metrics/MethodLength
+
+      # One candidate, not a sample: reproduction issues exactly one request,
+      # so asking the sampler for more than one would query for records
+      # Karst has already decided it will never send. Falling back to
+      # Identity::ANONYMOUS (rather than a bare nil) when no candidate is
+      # available means this still runs, and is still confirmed, as a real
+      # anonymous probe -- never a request whose identity Karst simply never
+      # got around to establishing.
+      def sampled_principal
+        selection = Access::PrincipalSelection.new(sources: Identity.principal_sources, limit: 1).call
+        principal = selection.principals.first
+        return principal if principal
+
+        @identity_reason = "no principal was available from the configured principal source"
+        Identity::ANONYMOUS
+      rescue Identity::Error => e
+        @identity_reason = e.message
+        Identity::ANONYMOUS
+      end
+
+      # rubocop:disable Metrics/MethodLength
+      def document(observation)
+        {
+          schema_version: SCHEMA_VERSION,
+          request: request(observation),
+          identity: identity(observation),
+          execution: execution(observation),
+          response: response(observation),
+          unobserved: observation.unobserved,
+          isolation: { database: "same_connection_rollback_attempted", not_isolated: NOT_ISOLATED },
+          reproduce: { curl: curl(observation) },
+          summary: { elapsed_ms: observation.elapsed_ms }
+        }
+      end
+      # rubocop:enable Metrics/MethodLength
+
+      def request(observation)
+        {
+          method: observation.http_method, path: observation.url_path,
+          url: Karst::Reproduction::Curl.url(observation, @base_url),
+          query_params: observation.query_params, route_params: observation.route_params,
+          content_type: observation.content_type, body_format: observation.body_representation.to_s,
+          body: (observation.body? ? observation.body_params : nil), headers: observation.headers
+        }
+      end
+
+      # The same requested/observed/confirmation document verify_access
+      # produces (see Karst::CLI::IdentitySerialization), plus `reason`: why
+      # Karst ran this request under no identity at all, when that was not
+      # what the caller asked for (an anonymous request the caller
+      # deliberately chose carries no reason -- there is nothing to explain).
+      def identity(observation)
+        identity_document(observation.identity).merge(reason: @identity_reason)
+      end
+
+      def execution(observation)
+        {
+          controller: observation.controller, action: observation.action,
+          controller_completed: observation.controller_completed,
+          halted_callback: observation.halted_callback, exception_class: observation.exception_class,
+          exception_phase: observation.exception_phase, rendered: observation.rendered,
+          writes_observed: observation.writes_observed, write_count: observation.write_count,
+          database_rollback_attempted: observation.database_rollback_attempted
+        }
+      end
+
+      def response(observation)
+        { status: observation.status, content_type: observation.response_content_type,
+          redirect: observation.redirect }
+      end
+
+      def curl(observation)
+        Karst::Reproduction::Curl.render(observation, base_url: @base_url)
+      end
+
+      # observation_error: Karst could not observe the request it ran, so it
+      # reports nothing about the application rather than partial evidence.
+      def error_document(error)
+        type = if error.is_a?(Identity::Error) then "configuration_error"
+               elsif error.is_a?(Access::ObservationError) then "observation_error"
+               else "input_error"
+               end
+        { schema_version: SCHEMA_VERSION, error: { type: type, message: error.message } }
+      end
+
+      def human(observation)
+        lines = ["Karst request reproduction", "", "Request",
+                 "  #{observation.http_method} #{observation.url_path}"]
+        append_identity(lines, observation)
+        append_execution(lines, observation)
+        append_response(lines, observation)
+        append_effects(lines, observation)
+        append_unobserved(lines, observation)
+        lines.push("", "Reproduce", curl(observation).lines.map { |line| "  #{line}" }.join.rstrip)
+        lines.join("\n")
+      end
+
+      def append_identity(lines, observation)
+        lines.push("", "Identity", "  #{identity_line(observation.identity)}")
+        lines << "  (#{@identity_reason})" if @identity_reason
+        lines << "  Karst assumed this identity directly; it did not exercise how an external " \
+                 "client would authenticate this endpoint."
+      end
+
+      def append_execution(lines, observation)
+        lines.push("", "Observed execution")
+        lines << if observation.controller
+                   "  #{observation.controller}##{observation.action}"
+                 else
+                   "  no controller dispatched"
+                 end
+        append_execution_detail(lines, observation)
+        append_rendered(lines, observation.rendered)
+      end
+
+      def append_execution_detail(lines, observation)
+        lines << "  controller completed: #{observation.controller_completed}" \
+                 unless observation.controller_completed.nil?
+        lines << "  halted at #{observation.halted_callback}" if observation.halted_callback
+        lines << "  exception #{observation.exception_class} (during #{observation.exception_phase})" \
+                 if observation.exception_class
+      end
+
+      def append_rendered(lines, rendered)
+        return if rendered.empty?
+
+        lines << "  rendered:"
+        rendered.each do |template|
+          lines << "    #{template[:virtual_path]}#{' (raised)' unless template[:completed]}"
+        end
+      end
+
+      def append_response(lines, observation)
+        lines.push("", "Observed response")
+        type = observation.response_content_type
+        lines << if observation.status
+                   "  #{observation.status}#{" #{type}" if type}"
+                 else
+                   "  no response observed"
+                 end
+        lines << "  redirect #{observation.redirect}" if observation.redirect
+      end
+
+      def append_effects(lines, observation)
+        lines.push("", "Observed effects",
+                   "  #{observation.write_count} database #{observation.write_count == 1 ? 'write' : 'writes'} " \
+                   "(rollback attempted on the same connection)")
+        lines << "  Not isolated: #{NOT_ISOLATED.join(', ')}."
+      end
+
+      def append_unobserved(lines, observation)
+        return if observation.unobserved.empty?
+
+        lines.push("", "Not observed", "  #{observation.unobserved.join(', ')}")
+      end
+    end
+    # rubocop:enable Metrics/ClassLength
+  end
+end

data/lib/karst/cli/verification.rb

@@ -1,7 +1,12 @@
 # frozen_string_literal: true
 
 require "json"
+require "time"
 require_relative "../../karst"
+require_relative "identity_serialization"
+require_relative "principal_reference"
+require_relative "outcome_summary"
+require_relative "../access/outcome_groups"
 
 module Karst
   module CLI
@@ -12,14 +17,53 @@ module Karst
     # place, keeping the versioned contract auditable.
     # rubocop:disable Metrics/ClassLength, Metrics/MethodLength, Metrics/AbcSize
     class Verification
-      SCHEMA_VERSION = 1
+      include IdentitySerialization
 
-      def initialize(path:, http_method: "GET", output: $stdout, json: false)
+      # 2 (was 1): every principal field is now explicitly either a
+      # *requested* identity (what Karst was asked to run as) or an
+      # *observed* one (what the application itself resolved at runtime),
+      # and each outcome carries an `identity` document saying whether the
+      # two agree. The ambiguous v1 `principal`/`verified_principal` keys are
+      # gone rather than renamed in place: a consumer reading "principal" and
+      # believing it described the request that actually ran is precisely the
+      # false attribution this schema exists to make impossible.
+      #
+      # 3 (was 2): `outcomes` groups are now semantic -- keyed by what the
+      # request observed (see Access::OutcomeGroups), never by per-probe
+      # timing -- so equivalent outcomes from several users form one group
+      # instead of one group per user. A group therefore no longer carries
+      # `elapsed_ms` (it had no single value once groups held more than one
+      # probe; `summary.elapsed_ms` and `verified_outcome.elapsed_ms` are
+      # unchanged), gains `verified_usable` (the configured policy's verdict,
+      # shared by every member), and groups are ordered largest first.
+      SCHEMA_VERSION = 3
+
+      # A deliberate identity-free probe: no principal is established, and
+      # the application is expected to resolve none. Requires no principal
+      # source at all, so a route can be probed anonymously in an application
+      # Karst could not otherwise test.
+      ANONYMOUS = :anonymous
+
+      # `as`, when given, is a human-only "MODEL:ID" reference (e.g.
+      # "User:72") naming one existing principal to run this probe as
+      # instead of sampling one -- see Karst::CLI::PrincipalReference. It is
+      # resolved exclusively through Karst::Identity.resolve, so it can never
+      # select a record outside a configured principal source. Mutually
+      # exclusive with `identity: "anonymous"`; nothing about this reaches
+      # the MCP verify_access tool, which never accepts it.
+      # rubocop:disable Metrics/ParameterLists
+      def initialize(path:, http_method: "GET", output: $stdout, json: false, identity: nil, as: nil)
         @path = path
         @http_method = http_method
         @output = output
         @json = json
+        @identity = normalize_identity(identity)
+        PrincipalReference.parse(as) if as
+        raise ArgumentError, "--anonymous and --as cannot be combined" if anonymous? && as
+
+        @as = as
       end
+      # rubocop:enable Metrics/ParameterLists
 
       def call
         result = run_search
@@ -44,13 +88,64 @@ module Karst
 
       private
 
+      def normalize_identity(value)
+        return nil if value.nil?
+        return ANONYMOUS if value.to_s == ANONYMOUS.to_s
+
+        raise ArgumentError, "identity must be \"anonymous\" when given"
+      end
+
+      def anonymous?
+        @identity == ANONYMOUS
+      end
+
+      # An additive third value alongside the documented "anonymous" and
+      # "application_identities": a --as probe is still a real application
+      # identity, just a human-selected one rather than one Karst sampled --
+      # a distinction worth reporting honestly rather than folding into
+      # "application_identities" and implying this result came from the
+      # ordinary search.
+      def probe_identity
+        return "anonymous" if anonymous?
+        return "specific_principal" if @as
+
+        "application_identities"
+      end
+
+      # One Identity::Snapshot for the whole operation: readiness, --as
+      # resolution, and the search itself all read the same single
+      # resolution of the effective principal sources.
       def run_search
-        validate_setup!
-        Access::Search.new(path: @path, http_method: @http_method, sources: Identity.principal_sources).call
+        return anonymous_search if anonymous?
+
+        snapshot = Identity.snapshot
+        validate_setup!(snapshot.setup_state)
+        return as_search(snapshot) if @as
+
+        Access::Search.new(path: @path, http_method: @http_method, sources: snapshot.principal_sources!).call
+      end
+
+      # One request against exactly the requested principal, never a sample
+      # and never a population retry: --as means "run as this one existing
+      # record," not "start a search that happens to prefer it." Wrapped in
+      # Access::Search::Result (with no attempts) purely so every downstream
+      # adapter method below stays the same for every probe kind.
+      def as_search(snapshot)
+        principal = PrincipalReference.resolve(@as, sources: snapshot.principal_sources!)
+        sweep = Access::Sweep.new(path: @path, http_method: @http_method, principals: [principal], limit: 1).call
+        Access::Search::Result.new(initial: sweep, attempts: [].freeze)
       end
 
-      def validate_setup!
-        state = Identity.setup_state
+      # One request, no principal source consulted and none required: the
+      # whole point is that nothing is authenticated. Reuses Search::Result so
+      # every adapter below stays identical for both probe kinds.
+      def anonymous_search
+        sweep = Access::Sweep.new(path: @path, http_method: @http_method,
+                                  principals: [Identity::ANONYMOUS], limit: 1).call
+        Access::Search::Result.new(initial: sweep, attempts: [].freeze)
+      end
+
+      def validate_setup!(state)
         return if state.status.to_s.start_with?("ready_")
 
         message = state.message || "no principal source is configured"
@@ -58,13 +153,16 @@ module Karst
       end
 
       def document(result)
+        @groups = {}.compare_by_identity
         winner = result.verified_outcome
         {
           schema_version: SCHEMA_VERSION,
           request: { method: result.http_method, path: result.path },
+          probe: { identity: probe_identity },
+          provenance: provenance,
           verified_usable: !winner.nil?,
-          verified_principal: winner && principal(winner.principal),
-          verified_outcome: winner && outcome(winner, include_principal: false),
+          verified_identity: winner && identity_document(winner.identity),
+          verified_outcome: winner && outcome(winner),
           source: result.verified_source,
           sample: sweep(result.initial),
           populations: result.attempts.map { |attempt| population(attempt) },
@@ -72,86 +170,146 @@ module Karst
         }
       end
 
+      # What execution produced these observations. Deliberately cheap and
+      # certain: versions, environment, and when the probe ran. It does not
+      # yet carry an application source digest/commit -- a consumer that must
+      # know the evidence still matches the code it is reasoning about needs
+      # freshness machinery this adapter does not own.
+      def provenance
+        {
+          karst_version: Karst::VERSION,
+          rails_version: defined?(Rails::VERSION::STRING) ? Rails::VERSION::STRING : nil,
+          rails_env: defined?(Rails) && Rails.respond_to?(:env) ? Rails.env.to_s : nil,
+          ruby_version: RUBY_VERSION,
+          observed_at: Time.now.utc.iso8601
+        }
+      end
+
       def sweep(result)
+        groups = groups_for(result)
         {
           candidate_pool_size: result.candidate_pool_size,
           users_tested: result.outcomes.size,
-          verified_usable: result.outcomes.any? { |item| Karst.config.usable_access_outcome.call(item) },
+          verified_usable: groups.any?(&:usable),
           database_isolation: result.database_isolation.to_s,
-          outcomes: grouped_outcomes(result.outcomes)
+          outcomes: grouped_outcomes(groups)
         }
       end
 
+      # Semantic groups for one stage's sweep result, computed once per
+      # document so the usable policy runs once per outcome here.
+      def groups_for(sweep_result)
+        @groups ||= {}.compare_by_identity
+        @groups[sweep_result] ||= Access::OutcomeGroups.group(sweep_result.outcomes)
+      end
+
       def population(attempt)
         data = { name: attempt.name.to_s, source: attempt.source_name.to_s, state: attempt.state.to_s }
         data[:reason] = attempt.error if attempt.error
         return data unless attempt.result
 
-        data.merge(users_tested: attempt.result.outcomes.size, outcomes: grouped_outcomes(attempt.result.outcomes))
+        data.merge(users_tested: attempt.result.outcomes.size, outcomes: grouped_outcomes(groups_for(attempt.result)))
       end
 
-      def grouped_outcomes(outcomes)
-        outcomes.group_by { |item| outcome(item, include_principal: false) }.map do |evidence, items|
-          evidence.merge(count: items.size, principals: items.map { |item| principal(item.principal) })
+      # Outcomes that observed the same thing (see Access::OutcomeGroups) are
+      # reported once, with every probe's own identity evidence listed under
+      # it -- so "three requests halted at authorize_admin" never flattens
+      # into one claim about who made them. Per-probe timing belongs to the
+      # probe, not the outcome, so a group carries none.
+      def grouped_outcomes(groups)
+        groups.map do |group|
+          evidence = outcome(group.representative).tap { |fields| fields.delete(:elapsed_ms) }
+          evidence.merge(verified_usable: group.usable, count: group.count,
+                         identities: group.outcomes.map { |item| identity_document(item.identity) })
         end
       end
 
-      def outcome(item, include_principal: true)
-        data = {
+      def outcome(item)
+        {
           status: item.status, redirect: item.redirect, exception_class: item.exception_class,
           halted_callback: item.halted_callback&.to_s, writes_observed: item.writes_observed,
           write_count: item.write_count, database_rollback_attempted: item.database_rollback_attempted,
-          elapsed_ms: item.elapsed_ms
+          elapsed_ms: item.elapsed_ms, controller: item.controller, action: item.action
         }
-        data[:principal] = principal(item.principal) if include_principal
-        data
-      end
-
-      def principal(value)
-        # JSON is also the MCP contract. Framework-inferred login identifiers
-        # must never cross that machine-readable boundary. An application-
-        # authored principal_label remains explicit configuration and keeps
-        # its longstanding serialization behavior.
-        label = if Karst.config.principal_label
-                  value.display_label.to_s
-                else
-                  "#{value.model_name} ##{value.id}"
-                end
-        { model: value.model_name.to_s, id: primitive_id(value.id), label: label }
-      end
-
-      def primitive_id(value)
-        value.is_a?(Integer) ? value : value.to_s
       end
 
+      # observation_error: Karst could not observe the request it ran, so it
+      # reports nothing about the application rather than partial evidence.
       def error_document(error)
-        type = error.is_a?(Identity::Error) ? "configuration_error" : "input_error"
+        type = if error.is_a?(Identity::Error) then "configuration_error"
+               elsif error.is_a?(Access::ObservationError) then "observation_error"
+               else "input_error"
+               end
         { schema_version: SCHEMA_VERSION, error: { type: type, message: error.message } }
       end
 
       def human(result)
-        lines = ["Karst verification", "", "#{result.http_method} #{result.path}", "", "Sample",
-                 "  #{result.initial.outcomes.size} users tested",
-                 "  #{sample_usable_count(result)} verified usable"]
-        append_key_evidence(lines, result.initial.outcomes)
+        @groups = {}.compare_by_identity
+        lines = ["Karst verification", "", "#{result.http_method} #{result.path}",
+                 "Probe identity: #{probe_identity_description}", "",
+                 "#{probe_section_heading}: #{stage_counts(result.initial)}"]
+        append_outcomes(lines, result.initial, indent: "  ")
         append_populations(lines, result)
         append_result(lines, result)
         lines.join("\n")
       end
 
-      def sample_usable_count(result)
-        result.initial.outcomes.count { |item| Karst.config.usable_access_outcome.call(item) }
+      def probe_identity_description
+        return "anonymous" if anonymous?
+        return "the specific principal requested via --as" if @as
+
+        "the application's own identities"
+      end
+
+      def probe_section_heading
+        return "Probe" if anonymous?
+        return "Requested" if @as
+
+        "Sample"
+      end
+
+      # How many were probed, and -- for a principal probe -- how many of
+      # them the configured usable policy accepted. An anonymous probe is a
+      # request, not a user, and has no "verified usable user" to count.
+      def stage_counts(sweep_result)
+        size = sweep_result.outcomes.size
+        return "#{size} #{size == 1 ? 'request' : 'requests'}" if anonymous?
+
+        usable = groups_for(sweep_result).select(&:usable).sum(&:count)
+        "#{size} #{size == 1 ? 'user' : 'users'} tested, #{usable} verified usable"
+      end
+
+      # The bounded outcome summary (see CLI::OutcomeSummary), then identity
+      # and write evidence for the whole stage -- never just its first probe.
+      def append_outcomes(lines, sweep_result, indent:)
+        outcomes = sweep_result.outcomes
+        return if outcomes.empty?
+
+        lines.concat(OutcomeSummary.new(groups_for(sweep_result), indent: indent).lines)
+        append_identity_evidence(lines, outcomes, indent)
+        append_write_evidence(lines, outcomes, indent)
       end
 
-      def append_key_evidence(lines, outcomes)
-        evidence = outcomes.first
-        return unless evidence
+      # One probe: its full identity evidence line. Several: how many probes
+      # reached each identity confirmation state, so an unconfirmed identity
+      # is visible even when its outcome matches everyone else's.
+      def append_identity_evidence(lines, outcomes, indent)
+        if outcomes.size == 1
+          lines << "#{indent}#{identity_line(outcomes.first.identity)}" if outcomes.first.identity
+          return
+        end
 
-        lines << "  status #{evidence.status}" if evidence.status
-        lines << "  redirect #{evidence.redirect}" if evidence.redirect
-        lines << "  halted at #{evidence.halted_callback}" if evidence.halted_callback
-        lines << "  exception #{evidence.exception_class}" if evidence.exception_class
-        lines << "  WARNING: #{evidence.write_count} writes observed" if evidence.writes_observed
+        tally = outcomes.map { |item| item.identity ? item.identity.confirmation.to_s : "not recorded" }.tally
+        states = tally.sort_by { |state, count| [-count, state] }.map { |state, count| "#{count} #{state}" }
+        lines << "#{indent}identity: #{states.join(', ')}"
+      end
+
+      def append_write_evidence(lines, outcomes, indent)
+        writing = outcomes.count(&:writes_observed)
+        return if writing.zero?
+
+        lines << "#{indent}WARNING: database writes observed in #{writing} of #{outcomes.size} " \
+                 "#{outcomes.size == 1 ? 'request' : 'requests'} (rollback attempted on the same connection)"
       end
 
       def append_populations(lines, result)
@@ -161,21 +319,27 @@ module Karst
         result.attempts.each do |attempt|
           count = attempt.result&.outcomes&.size || 0
           lines << "  #{attempt.name}: #{attempt.state} (#{count} users tested)"
-          append_key_evidence(lines, attempt.result.outcomes) if attempt.result
+          append_outcomes(lines, attempt.result, indent: "    ") if attempt.result
         end
       end
 
       def append_result(lines, result)
         lines.push("", "Result")
-        if result.verified_outcome
-          lines << "  verified usable user: #{result.verified_outcome.principal.display_label}"
+        winner = result.verified_outcome
+        if winner
+          lines << "  verified usable: #{winner_label(winner)}"
+          lines << "  #{identity_line(winner.identity)}" if winner.identity
           source = result.verified_source
           lines << "  source: #{source[:type]}#{"=#{source[:name]}" if source[:name]}"
         else
-          lines << "  no verified usable user found"
+          lines << (anonymous? ? "  not usable anonymously" : "  no verified usable user found")
         end
         lines << "  #{result.request_count} requests in #{result.elapsed_ms} ms"
       end
+
+      def winner_label(winner)
+        winner.principal ? winner.principal.display_label : "anonymous request"
+      end
     end
     # rubocop:enable Metrics/ClassLength, Metrics/MethodLength, Metrics/AbcSize
   end