@kya-os/mcp-i-core 1.2.2-canary.37 → 1.2.2-canary.38

package/.turbo/turbo-test.log

@@ -1,23 +1,22 @@
 
-> @kya-os/mcp-i-core@1.2.2-canary.36 test /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core
+> @kya-os/mcp-i-core@1.2.2-canary.37 test /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core
 > vitest run
 
 
  RUN  v4.0.5 /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core
 
- ✓ src/__tests__/cache/tool-protection-cache.test.ts (49 tests) 194ms
 stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should validate wrapped response with success field in data
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '8707998e-3593-4d2e-84da-3df4e845449e',
+  correlationId: 'ea6b157d-a119-4da4-be23-27554a52c1b1',
   status: 200,
   statusText: undefined,
   headers: {},
   responseTextLength: 191,
-  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.241Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.241Z"}}'
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.400Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.400Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '8707998e-3593-4d2e-84da-3df4e845449e',
+  correlationId: 'ea6b157d-a119-4da4-be23-27554a52c1b1',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
@@ -35,7 +34,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-24T21:27:09.241Z"\n' +
+    '    "timestamp": "2025-11-24T22:24:12.400Z"\n' +
     '  }\n' +
     '}'
 }
@@ -53,11 +52,11 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-24T21:27:09.241Z"
+    "timestamp": "2025-11-24T22:24:12.400Z"
   }
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE: {
-  correlationId: '8707998e-3593-4d2e-84da-3df4e845449e',
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: 'ea6b157d-a119-4da4-be23-27554a52c1b1',
   dataKeys: [ 'accepted', 'rejected', 'outcomes' ],
   hasAccepted: true,
   hasRejected: true,
@@ -83,7 +82,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '8707998e-3593-4d2e-84da-3df4e845449e',
+  correlationId: 'ea6b157d-a119-4da4-be23-27554a52c1b1',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   hasSuccess: true,
   successValue: true,
@@ -108,16 +107,16 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
 
 stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should validate wrapped response with errors array
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'fe761a5f-5edf-4479-a037-def4f9d7fb3c',
+  correlationId: '26a86e15-8aea-45b0-b1c9-023fe034f7b6',
   status: 200,
   statusText: undefined,
   headers: {},
   responseTextLength: 333,
-  responseTextPreview: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.258Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.258Z"}}'
+  responseTextPreview: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.411Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.411Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'fe761a5f-5edf-4479-a037-def4f9d7fb3c',
+  correlationId: '26a86e15-8aea-45b0-b1c9-023fe034f7b6',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
@@ -147,7 +146,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-24T21:27:09.258Z"\n' +
+    '    "timestamp": "2025-11-24T22:24:12.411Z"\n' +
     '  }\n' +
     '}'
 }
@@ -177,11 +176,11 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-24T21:27:09.258Z"
+    "timestamp": "2025-11-24T22:24:12.411Z"
   }
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE: {
-  correlationId: 'fe761a5f-5edf-4479-a037-def4f9d7fb3c',
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '26a86e15-8aea-45b0-b1c9-023fe034f7b6',
   dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
   hasAccepted: true,
   hasRejected: true,
@@ -219,7 +218,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: 'fe761a5f-5edf-4479-a037-def4f9d7fb3c',
+  correlationId: '26a86e15-8aea-45b0-b1c9-023fe034f7b6',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
   hasSuccess: true,
   successValue: true,
@@ -256,16 +255,16 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
 
 stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should validate wrapped response without outcomes (optional field)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '28e2ed4d-794e-46d3-a8ed-a2afc5b6f5e2',
+  correlationId: '0c1cae26-4e3a-4cf9-9a09-7d6993ede1d3',
   status: 200,
   statusText: undefined,
   headers: {},
   responseTextLength: 133,
-  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.265Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.265Z"}}'
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.412Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.412Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '28e2ed4d-794e-46d3-a8ed-a2afc5b6f5e2',
+  correlationId: '0c1cae26-4e3a-4cf9-9a09-7d6993ede1d3',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
@@ -277,7 +276,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-24T21:27:09.265Z"\n' +
+    '    "timestamp": "2025-11-24T22:24:12.412Z"\n' +
     '  }\n' +
     '}'
 }
@@ -289,11 +288,11 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-24T21:27:09.265Z"
+    "timestamp": "2025-11-24T22:24:12.412Z"
   }
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE: {
-  correlationId: '28e2ed4d-794e-46d3-a8ed-a2afc5b6f5e2',
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '0c1cae26-4e3a-4cf9-9a09-7d6993ede1d3',
   dataKeys: [ 'accepted', 'rejected' ],
   hasAccepted: true,
   hasRejected: true,
@@ -310,7 +309,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   fullData: '{\n  "accepted": 1,\n  "rejected": 0\n}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '28e2ed4d-794e-46d3-a8ed-a2afc5b6f5e2',
+  correlationId: '0c1cae26-4e3a-4cf9-9a09-7d6993ede1d3',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected' ],
   hasSuccess: true,
   successValue: true,
@@ -323,169 +322,9 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   fullDataWithSuccess: '{\n  "success": true,\n  "accepted": 1,\n  "rejected": 0\n}'
 }
 
-stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Error Handling > should handle network timeout
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use X-API-Key header for new endpoint
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.241Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use Authorization Bearer header for old endpoint
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.244Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use project-scoped endpoint when projectId is available
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Fallback Behavior > should cache fallback config
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.245Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use agent-scoped endpoint when projectId is not available
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-
-  cacheExpiresAt: '2025-11-24T21:32:09.245Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode projectId in URL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'project/with/special-chars',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.246Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode agent DID in URL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.246Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle new endpoint format (toolProtections object)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.246Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools array)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.248Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools object)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.249Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle snake_case field names
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.249Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle camelCase field names
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.250Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should prefer camelCase over snake_case when both present
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.250Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should cache successful API responses
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.253Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 1000,
-  cacheExpiresAt: '2025-11-24T21:27:10.254Z'
-}
-
 stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should submit proofs successfully
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '2741baf3-0d00-4d89-b75f-f7a965771a8a',
+  correlationId: '8a2288e1-e205-4f2f-897d-c60ad883c16c',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -494,7 +333,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '2741baf3-0d00-4d89-b75f-f7a965771a8a',
+  correlationId: '8a2288e1-e205-4f2f-897d-c60ad883c16c',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
@@ -524,7 +363,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
 
 stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle all_proofs_rejected error gracefully
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '7df25795-5744-4c07-a552-30e1ef3709de',
+  correlationId: '8e2ab903-ee64-45ff-a8cc-7c5c162bd111',
   status: 400,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -533,7 +372,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullResponseText: '{"success":false,"error":{"code":"all_proofs_rejected","message":"All proofs rejected","details":{"rejected":1,"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid signature"}}]}}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '7df25795-5744-4c07-a552-30e1ef3709de',
+  correlationId: '8e2ab903-ee64-45ff-a8cc-7c5c162bd111',
   status: 400,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'error' ],
@@ -560,16 +399,16 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
 
 stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle wrapped response format
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '5c904fce-908b-4c51-90e9-3b001a2a959f',
+  correlationId: '3f10c3cf-c6f1-49f1-9f6e-39180605db4c',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
   responseTextLength: 206,
-  responseTextPreview: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.280Z"}}',
-  fullResponseText: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.280Z"}}'
+  responseTextPreview: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.422Z"}}',
+  fullResponseText: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.422Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '5c904fce-908b-4c51-90e9-3b001a2a959f',
+  correlationId: '3f10c3cf-c6f1-49f1-9f6e-39180605db4c',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
@@ -588,7 +427,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-24T21:27:09.280Z"\n' +
+    '    "timestamp": "2025-11-24T22:24:12.422Z"\n' +
     '  }\n' +
     '}'
 }
@@ -607,11 +446,11 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-24T21:27:09.280Z"
+    "timestamp": "2025-11-24T22:24:12.422Z"
   }
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE: {
-  correlationId: '5c904fce-908b-4c51-90e9-3b001a2a959f',
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '3f10c3cf-c6f1-49f1-9f6e-39180605db4c',
   dataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   hasAccepted: true,
   hasRejected: true,
@@ -638,7 +477,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '5c904fce-908b-4c51-90e9-3b001a2a959f',
+  correlationId: '3f10c3cf-c6f1-49f1-9f6e-39180605db4c',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   hasSuccess: true,
   successValue: true,
@@ -663,7 +502,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
 
 stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '244e4a95-b546-4c7f-be74-34889a648656',
+  correlationId: 'd0a2a5db-0ac0-43dc-8f4e-dd8f279e1f05',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -672,7 +511,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullResponseText: '{"success":true,"accepted":1,"rejected":0}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '244e4a95-b546-4c7f-be74-34889a648656',
+  correlationId: 'd0a2a5db-0ac0-43dc-8f4e-dd8f279e1f05',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'accepted', 'rejected' ],
@@ -686,7 +525,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
 
 stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '64dfd2fd-dbd4-4147-91ab-0c7d4de5c291',
+  correlationId: '20fdb9d9-56b6-4792-a387-4064d69810ae',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -695,7 +534,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '64dfd2fd-dbd4-4147-91ab-0c7d4de5c291',
+  correlationId: '20fdb9d9-56b6-4792-a387-4064d69810ae',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
@@ -725,7 +564,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
 
 stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '8b2993e3-eede-4db1-a8a0-271240338bd5',
+  correlationId: '0ad4015b-7342-439d-8616-f2f7bbddb219',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -734,7 +573,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '8b2993e3-eede-4db1-a8a0-271240338bd5',
+  correlationId: '0ad4015b-7342-439d-8616-f2f7bbddb219',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
@@ -749,7 +588,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
 
 stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle wrapped response with invalid data structure
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '11f2d355-b2da-4bbe-8025-ef47207398f5',
+  correlationId: '44b9437e-e75f-4cb0-8923-a42dbdf0a650',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -758,7 +597,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullResponseText: '{"success":true,"data":{"message":"Invalid format"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '11f2d355-b2da-4bbe-8025-ef47207398f5',
+  correlationId: '44b9437e-e75f-4cb0-8923-a42dbdf0a650',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data' ],
@@ -770,8 +609,8 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
     "message": "Invalid format"
   }
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE: {
-  correlationId: '11f2d355-b2da-4bbe-8025-ef47207398f5',
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '44b9437e-e75f-4cb0-8923-a42dbdf0a650',
   dataKeys: [ 'message' ],
   hasAccepted: false,
   hasRejected: false,
@@ -788,7 +627,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullData: '{\n  "message": "Invalid format"\n}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '11f2d355-b2da-4bbe-8025-ef47207398f5',
+  correlationId: '44b9437e-e75f-4cb0-8923-a42dbdf0a650',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected' ],
   hasSuccess: true,
   successValue: true,
@@ -801,7 +640,7 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   fullDataWithSuccess: '{\n  "success": true\n}'
 }
 [AccessControl] ❌ MISSING REQUIRED FIELDS AFTER CONSTRUCTION: {
-  correlationId: '11f2d355-b2da-4bbe-8025-ef47207398f5',
+  correlationId: '44b9437e-e75f-4cb0-8923-a42dbdf0a650',
   hasAccepted: true,
   acceptedType: 'undefined',
   acceptedValue: undefined,
@@ -817,16 +656,16 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
 
 stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should throw validation error if data object missing success field
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'e1b45b6c-b040-4768-8549-68cd87c7d71a',
+  correlationId: '9115b4d2-1852-46ed-9130-eedad1228d12',
   status: 200,
   statusText: undefined,
   headers: {},
   responseTextLength: 191,
-  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.266Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T21:27:09.266Z"}}'
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.412Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-24T22:24:12.412Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'e1b45b6c-b040-4768-8549-68cd87c7d71a',
+  correlationId: '9115b4d2-1852-46ed-9130-eedad1228d12',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
@@ -844,7 +683,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-24T21:27:09.266Z"\n' +
+    '    "timestamp": "2025-11-24T22:24:12.412Z"\n' +
     '  }\n' +
     '}'
 }
@@ -862,11 +701,11 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-24T21:27:09.266Z"
+    "timestamp": "2025-11-24T22:24:12.412Z"
   }
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE: {
-  correlationId: 'e1b45b6c-b040-4768-8549-68cd87c7d71a',
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '9115b4d2-1852-46ed-9130-eedad1228d12',
   dataKeys: [ 'accepted', 'rejected', 'outcomes' ],
   hasAccepted: true,
   hasRejected: true,
@@ -892,7 +731,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: 'e1b45b6c-b040-4768-8549-68cd87c7d71a',
+  correlationId: '9115b4d2-1852-46ed-9130-eedad1228d12',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   hasSuccess: true,
   successValue: true,
@@ -915,145 +754,718 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 
- ✓ src/services/__tests__/access-control.proof-response-validation.test.ts (9 tests) 28ms
- ✓ src/delegation/__tests__/cascading-revocation.test.ts (23 tests) 9ms
- ✓ src/__tests__/config/provider-runtime-config.test.ts (9 tests) 2ms
- ✓ src/delegation/__tests__/vc-verifier.test.ts (35 tests) 356ms
- ✓ src/services/__tests__/access-control.service.test.ts (23 tests) 260ms
- ✓ src/delegation/__tests__/vc-issuer.test.ts (21 tests) 188ms
-stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Submission Flow > should submit proof end-to-end
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should correctly extract data from wrapped response after JSON deep clone
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'd81452e3-6d9a-4015-9340-c92ec6d86643',
+  correlationId: 'beaa0854-86a0-4a4e-b1c2-9019e14b5311',
   status: 200,
-  statusText: '',
-  headers: { 'content-type': 'application/json' },
-  responseTextLength: 100,
-  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}',
-  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 191,
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1},"errors":[]},"metadata":{"requestId":"fc1fa88f-9b22-4161-b4fd-17d8215098ee","timestamp":"2025-11-24T21:36:33.029Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1},"errors":[]},"metadata":{"requestId":"fc1fa88f-9b22-4161-b4fd-17d8215098ee","timestamp":"2025-11-24T21:36:33.029Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'd81452e3-6d9a-4015-9340-c92ec6d86643',
+  correlationId: 'beaa0854-86a0-4a4e-b1c2-9019e14b5311',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  responseDataKeys: [ 'success', 'data', 'metadata' ],
   responseData: '{\n' +
     '  "success": true,\n' +
-    '  "accepted": 1,\n' +
-    '  "rejected": 0,\n' +
-    '  "outcomes": {\n' +
-    '    "success": 1,\n' +
-    '    "failed": 0,\n' +
-    '    "blocked": 0,\n' +
-    '    "error": 0\n' +
+    '  "data": {\n' +
+    '    "accepted": 1,\n' +
+    '    "rejected": 0,\n' +
+    '    "outcomes": {\n' +
+    '      "success": 1\n' +
+    '    },\n' +
+    '    "errors": []\n' +
+    '  },\n' +
+    '  "metadata": {\n' +
+    '    "requestId": "fc1fa88f-9b22-4161-b4fd-17d8215098ee",\n' +
+    '    "timestamp": "2025-11-24T21:36:33.029Z"\n' +
     '  }\n' +
     '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
-  "accepted": 1,
-  "rejected": 0,
-  "outcomes": {
-    "success": 1,
-    "failed": 0,
-    "blocked": 0,
-    "error": 0
+  "data": {
+    "accepted": 1,
+    "rejected": 0,
+    "outcomes": {
+      "success": 1
+    },
+    "errors": []
+  },
+  "metadata": {
+    "requestId": "fc1fa88f-9b22-4161-b4fd-17d8215098ee",
+    "timestamp": "2025-11-24T21:36:33.029Z"
   }
 }
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: 'beaa0854-86a0-4a4e-b1c2-9019e14b5311',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasAccepted: true,
+  hasRejected: true,
+  hasOutcomes: true,
+  hasErrors: true,
+  acceptedType: 'number',
+  acceptedValue: 1,
+  rejectedType: 'number',
+  rejectedValue: 0,
+  outcomesType: 'object',
+  outcomesValue: { success: 1 },
+  errorsType: 'object',
+  errorsIsArray: true,
+  fullData: '{\n' +
+    '  "accepted": 1,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1\n' +
+    '  },\n' +
+    '  "errors": []\n' +
+    '}'
+}
+[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
+  correlationId: 'beaa0854-86a0-4a4e-b1c2-9019e14b5311',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasSuccess: true,
+  successValue: true,
+  hasAccepted: true,
+  acceptedValue: 1,
+  hasRejected: true,
+  rejectedValue: 0,
+  hasOutcomes: true,
+  outcomesValue: { success: 1 },
+  fullDataWithSuccess: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 1,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1\n' +
+    '  },\n' +
+    '  "errors": []\n' +
+    '}'
+}
 
-stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Submission Flow > should handle proof submission with errors
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should handle response where data fields are numeric values (not undefined)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'ca388041-d0dc-4667-b6d7-2aeb05027351',
+  correlationId: 'dea8ab38-6efc-496d-949f-a1839864cdb6',
   status: 200,
-  statusText: '',
-  headers: { 'content-type': 'application/json' },
-  responseTextLength: 200,
-  responseTextPreview: '{"success":true,"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid JWS signature"}}]}',
-  fullResponseText: '{"success":true,"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid JWS signature"}}]}'
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 151,
+  responseTextPreview: '{"success":true,"data":{"accepted":0,"rejected":0,"outcomes":{},"errors":[]},"metadata":{"requestId":"test-id","timestamp":"2025-11-24T22:24:12.414Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":0,"rejected":0,"outcomes":{},"errors":[]},"metadata":{"requestId":"test-id","timestamp":"2025-11-24T22:24:12.414Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'ca388041-d0dc-4667-b6d7-2aeb05027351',
+  correlationId: 'dea8ab38-6efc-496d-949f-a1839864cdb6',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
+  responseDataKeys: [ 'success', 'data', 'metadata' ],
   responseData: '{\n' +
     '  "success": true,\n' +
-    '  "accepted": 0,\n' +
-    '  "rejected": 1,\n' +
-    '  "outcomes": {\n' +
-    '    "success": 0,\n' +
-    '    "failed": 1,\n' +
-    '    "blocked": 0,\n' +
-    '    "error": 0\n' +
+    '  "data": {\n' +
+    '    "accepted": 0,\n' +
+    '    "rejected": 0,\n' +
+    '    "outcomes": {},\n' +
+    '    "errors": []\n' +
     '  },\n' +
-    '  "errors": [\n' +
-    '    {\n' +
-    '      "proof_index": 0,\n' +
-    '      "error": {\n' +
-    '        "code": "invalid_signature",\n' +
-    '        "message": "Invalid JWS signature"\n' +
-    '      }\n' +
-    '    }\n' +
-    '  ]\n' +
+    '  "metadata": {\n' +
+    '    "requestId": "test-id",\n' +
+    '    "timestamp": "2025-11-24T22:24:12.414Z"\n' +
+    '  }\n' +
     '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
-  "accepted": 0,
-  "rejected": 1,
-  "outcomes": {
-    "success": 0,
-    "failed": 1,
-    "blocked": 0,
-    "error": 0
+  "data": {
+    "accepted": 0,
+    "rejected": 0,
+    "outcomes": {},
+    "errors": []
   },
-  "errors": [
-    {
-      "proof_index": 0,
-      "error": {
-        "code": "invalid_signature",
-        "message": "Invalid JWS signature"
+  "metadata": {
+    "requestId": "test-id",
+    "timestamp": "2025-11-24T22:24:12.414Z"
+  }
+}
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: 'dea8ab38-6efc-496d-949f-a1839864cdb6',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasAccepted: true,
+  hasRejected: true,
+  hasOutcomes: true,
+  hasErrors: true,
+  acceptedType: 'number',
+  acceptedValue: 0,
+  rejectedType: 'number',
+  rejectedValue: 0,
+  outcomesType: 'object',
+  outcomesValue: {},
+  errorsType: 'object',
+  errorsIsArray: true,
+  fullData: '{\n  "accepted": 0,\n  "rejected": 0,\n  "outcomes": {},\n  "errors": []\n}'
+}
+[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
+  correlationId: 'dea8ab38-6efc-496d-949f-a1839864cdb6',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasSuccess: true,
+  successValue: true,
+  hasAccepted: true,
+  acceptedValue: 0,
+  hasRejected: true,
+  rejectedValue: 0,
+  hasOutcomes: true,
+  outcomesValue: {},
+  fullDataWithSuccess: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 0,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {},\n' +
+    '  "errors": []\n' +
+    '}'
+}
+
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should handle response with nested outcomes object
+[AccessControl] 🔍 RAW API RESPONSE (before parsing): {
+  correlationId: '1983e035-996d-450b-ba1c-9fbed355bed8',
+  status: 200,
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 278,
+  responseTextPreview: '{"success":true,"data":{"accepted":3,"rejected":2,"outcomes":{"success":1,"failed":1,"blocked":1,"error":2},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Invalid signature"}}]},"metadata":{"requestId":"test-id","timestamp":"2025-11-24T22:24:12.415Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":3,"rejected":2,"outcomes":{"success":1,"failed":1,"blocked":1,"error":2},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Invalid signature"}}]},"metadata":{"requestId":"test-id","timestamp":"2025-11-24T22:24:12.415Z"}}'
+}
+[AccessControl] 🔍 PARSED RESPONSE DATA: {
+  correlationId: '1983e035-996d-450b-ba1c-9fbed355bed8',
+  status: 200,
+  responseDataType: 'object',
+  responseDataKeys: [ 'success', 'data', 'metadata' ],
+  responseData: '{\n' +
+    '  "success": true,\n' +
+    '  "data": {\n' +
+    '    "accepted": 3,\n' +
+    '    "rejected": 2,\n' +
+    '    "outcomes": {\n' +
+    '      "success": 1,\n' +
+    '      "failed": 1,\n' +
+    '      "blocked": 1,\n' +
+    '      "error": 2\n' +
+    '    },\n' +
+    '    "errors": [\n' +
+    '      {\n' +
+    '        "proof_index": 0,\n' +
+    '        "error": {\n' +
+    '          "code": "validation_error",\n' +
+    '          "message": "Invalid signature"\n' +
+    '        }\n' +
+    '      }\n' +
+    '    ]\n' +
+    '  },\n' +
+    '  "metadata": {\n' +
+    '    "requestId": "test-id",\n' +
+    '    "timestamp": "2025-11-24T22:24:12.415Z"\n' +
+    '  }\n' +
+    '}'
+}
+[AccessControl] Raw response received: {
+  "success": true,
+  "data": {
+    "accepted": 3,
+    "rejected": 2,
+    "outcomes": {
+      "success": 1,
+      "failed": 1,
+      "blocked": 1,
+      "error": 2
+    },
+    "errors": [
+      {
+        "proof_index": 0,
+        "error": {
+          "code": "validation_error",
+          "message": "Invalid signature"
+        }
       }
-    }
-  ]
+    ]
+  },
+  "metadata": {
+    "requestId": "test-id",
+    "timestamp": "2025-11-24T22:24:12.415Z"
+  }
+}
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '1983e035-996d-450b-ba1c-9fbed355bed8',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasAccepted: true,
+  hasRejected: true,
+  hasOutcomes: true,
+  hasErrors: true,
+  acceptedType: 'number',
+  acceptedValue: 3,
+  rejectedType: 'number',
+  rejectedValue: 2,
+  outcomesType: 'object',
+  outcomesValue: { success: 1, failed: 1, blocked: 1, error: 2 },
+  errorsType: 'object',
+  errorsIsArray: true,
+  fullData: '{\n' +
+    '  "accepted": 3,\n' +
+    '  "rejected": 2,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 1,\n' +
+    '    "blocked": 1,\n' +
+    '    "error": 2\n' +
+    '  },\n' +
+    '  "errors": [\n' +
+    '    {\n' +
+    '      "proof_index": 0,\n' +
+    '      "error": {\n' +
+    '        "code": "validation_error",\n' +
+    '        "message": "Invalid signature"\n' +
+    '      }\n' +
+    '    }\n' +
+    '  ]\n' +
+    '}'
+}
+[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
+  correlationId: '1983e035-996d-450b-ba1c-9fbed355bed8',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasSuccess: true,
+  successValue: true,
+  hasAccepted: true,
+  acceptedValue: 3,
+  hasRejected: true,
+  rejectedValue: 2,
+  hasOutcomes: true,
+  outcomesValue: { success: 1, failed: 1, blocked: 1, error: 2 },
+  fullDataWithSuccess: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 3,\n' +
+    '  "rejected": 2,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 1,\n' +
+    '    "blocked": 1,\n' +
+    '    "error": 2\n' +
+    '  },\n' +
+    '  "errors": [\n' +
+    '    {\n' +
+    '      "proof_index": 0,\n' +
+    '      "error": {\n' +
+    '        "code": "validation_error",\n' +
+    '        "message": "Invalid signature"\n' +
+    '      }\n' +
+    '    }\n' +
+    '  ]\n' +
+    '}'
+}
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyEd25519 > should return false on verification error
+[CryptoService] Ed25519 verification error: Error: Verification failed
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:62:9
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject invalid JWK format
+[CryptoService] Invalid Ed25519 JWK format
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with wrong kty
+[CryptoService] Invalid Ed25519 JWK format
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with wrong crv
+[CryptoService] Invalid Ed25519 JWK format
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with missing x field
+[CryptoService] Invalid Ed25519 JWK format
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with empty x field
+[CryptoService] Invalid Ed25519 JWK format
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject malformed JWS
+[CryptoService] Invalid JWS format: Error: Invalid header base64: Unexpected token 'ž', "ž‹" is not valid JSON
+    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:91:13)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:230:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject non-EdDSA algorithms
+[CryptoService] Unsupported algorithm: RS256, expected EdDSA
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject HS256 algorithm
+[CryptoService] Unsupported algorithm: HS256, expected EdDSA
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle empty JWS components
+[CryptoService] Invalid JWS format: Error: Invalid header base64: Unexpected end of JSON input
+    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:91:13)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:271:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - single part
+[CryptoService] Invalid JWS format: Error: Invalid JWS format: expected header.payload.signature
+    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:78:13)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:279:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - two parts
+[CryptoService] Invalid JWS format: Error: Invalid JWS format: expected header.payload.signature
+    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:78:13)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:287:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - four parts
+[CryptoService] Invalid JWS format: Error: Invalid JWS format: expected header.payload.signature
+    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:78:13)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:302:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - invalid JSON header
+[CryptoService] Invalid JWS format: Error: Invalid header base64: Unexpected token 'o', "notjson" is not valid JSON
+    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:91:13)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:316:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - invalid base64
+[CryptoService] Invalid JWS format: Error: Invalid payload base64: Invalid base64url string: Invalid character
+    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:107:15)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:334:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should validate expectedKid option
+[CryptoService] Key ID mismatch
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should validate alg option
+[CryptoService] Unsupported algorithm: EdDSA, expected RS256
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should validate Ed25519 key length
+[CryptoService] Failed to extract public key: Error: Invalid Ed25519 public key length: 5
+    at CryptoService.jwkToBase64PublicKey (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:295:13)
+    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:249:32)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:398:42
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+
+stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle signature verification error
+[CryptoService] Ed25519 verification error: Error: Crypto error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:449:61
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+
+ ✓ src/services/__tests__/crypto.service.test.ts (34 tests) 21ms
+ ✓ src/services/__tests__/access-control.proof-response-validation.test.ts (12 tests) 16ms
+ ✓ src/services/__tests__/access-control.service.test.ts (23 tests) 24ms
+ ✓ src/__tests__/cache/tool-protection-cache.test.ts (49 tests) 181ms
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use X-API-Key header for new endpoint
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.671Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use Authorization Bearer header for old endpoint
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.675Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use project-scoped endpoint when projectId is available
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.677Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use agent-scoped endpoint when projectId is not available
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.677Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode projectId in URL
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'project/with/special-chars',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.677Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode agent DID in URL
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.677Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle new endpoint format (toolProtections object)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 2,
+  protectedTools: [ 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.678Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools array)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 2,
+  protectedTools: [ 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.678Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools object)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 2,
+  protectedTools: [ 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.678Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle snake_case field names
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.678Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle camelCase field names
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.679Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should prefer camelCase over snake_case when both present
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.679Z'
 }
 
-stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Verification Flow > should verify proof using ProofVerifier
-[CryptoService] Key ID mismatch
+stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Error Handling > should handle network timeout
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
 
- ✓ src/__tests__/runtime/route-interception.test.ts (21 tests) 28ms
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when protection required and no delegation
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
+stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Fallback Behavior > should cache fallback config
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should cache successful API responses
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:12.683Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 1000,
+  cacheExpiresAt: '2025-11-24T22:24:13.683Z'
+}
+
+stderr | src/services/__tests__/proof-verifier.test.ts > ProofVerifier Security > Signature Verification > should handle signature verification errors gracefully
+[CryptoService] Ed25519 verification error: Error: Crypto error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.test.ts:328:9
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+
+ ✓ src/services/__tests__/proof-verifier.test.ts (21 tests) 15ms
+stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
+[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
+    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:252:7
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
+
+stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
+[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
+    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:257:9
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
+
+ ✓ src/services/__tests__/proof-verifier.integration.test.ts (13 tests | 1 skipped) 65ms
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
+[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
+
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
+[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
+
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should fall back to memory when Redis connection fails
+[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
+
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should use KV namespace when provided
+[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
+
+ ✓ src/services/__tests__/storage.service.test.ts (17 tests) 17ms
+ ✓ src/delegation/__tests__/vc-verifier.test.ts (35 tests) 195ms
+ ✓ src/delegation/__tests__/vc-issuer.test.ts (21 tests) 377ms
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when no protection required
 [MCP-I] Checking tool protection: {
   tool: 'unprotectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
-  requiredScopes: [ 'files:write' ],
 
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6kcs_midnqpi5',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when no protection required
 [MCP-I] Tool protection check passed (no delegation required) {
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_gw6kcs_midnqpi5'
-}
   tool: 'unprotectedTool',
   agentDid: 'did:key:zmock123...',
   reason: 'Tool not configured to require delegation'
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when protection required and no delegation
-
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when protection required and no delegation
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_bfpxzb_midps2x1',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_bfpxzb_midps2x1'
+}
+
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
+[MCP-I] ❌ Delegation verification FAILED {
+  tool: 'protectedTool',
+  agentDid: 'did:key:zmock123...',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when protection required and delegation provided
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
+  reason: 'Delegation token expired',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
 }
@@ -1062,22 +1474,37 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
+  errorCode: undefined,
   hasDelegationToken: true,
+  errorMessage: undefined,
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
+  requiredScopes: [ 'files:write' ]
+}
+
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation has wrong scopes
+[MCP-I] ❌ Delegation verification FAILED {
+  tool: 'protectedTool',
+  agentDid: 'did:key:zmock123...',
+  reason: 'Insufficient scopes',
 }
+  errorCode: undefined,
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when protection required and delegation provided
+  errorMessage: undefined,
 [MCP-I] ✅ Delegation verification SUCCEEDED {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   delegationId: 'test-delegation-id',
   credentialScopes: [ 'files:write' ],
   requiredScopes: [ 'files:write' ]
+  requiredScopes: [ 'files:write' ]
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when protection required and consentProof provided
 [MCP-I] Checking tool protection: {
+}
+
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
@@ -1101,15 +1528,12 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   requiredScopes: [ 'files:write' ]
 }
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-[MCP-I] ❌ Delegation verification FAILED {
   hasDelegation: true
 }
-  tool: 'protectedTool',
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
@@ -1127,47 +1551,22 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   hasDelegation: true
 }
 
-  agentDid: 'did:key:zmock123...',
-  reason: 'Delegation token expired',
-  errorCode: undefined,
-  errorMessage: undefined,
-  requiredScopes: [ 'files:write' ]
-}
-
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation has wrong scopes
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
   tool: 'protectedTool',
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation has wrong scopes
-[MCP-I] ❌ Delegation verification FAILED {
-  tool: 'protectedTool',
-  agentDid: 'did:key:zmock123...',
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
-  reason: 'Insufficient scopes',
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
 }
 
-  errorCode: undefined,
-  errorMessage: undefined,
-  requiredScopes: [ 'files:write' ]
-}
-
-stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
-[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
-    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:252:7
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should handle API errors during verification gracefully
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should handle API errors during verification gracefully
 [MCP-I] Checking tool protection: {
-[MCP-I] ❌ Delegation verification error (API failure) {
-  tool: 'protectedTool',
   tool: 'protectedTool',
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should handle API errors during verification gracefully
+[MCP-I] ❌ Delegation verification error (API failure) {
   agentDid: 'did:key:zmock123...',
+  tool: 'protectedTool',
   hasDelegation: true
   agentDid: 'did:key:zmock123...',
 }
@@ -1176,140 +1575,166 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-  hasDelegationToken: true,
   errorCode: 'network_error',
-  hasConsentProof: false,
   errorMessage: 'API unavailable',
+  hasDelegationToken: true,
+  hasConsentProof: false,
   errorDetails: {}
+}
   requiredScopes: [ 'files:write' ]
 }
 
+
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when access control service not configured (graceful degradation)
-}
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when access control service not configured (graceful degradation)
-[MCP-I] ⚠️ Delegation token provided but AccessControlApiService not configured - skipping verification {
   agentDid: 'did:key:zmock123...',
-  tool: 'protectedTool',
   hasDelegation: true
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when access control service not configured (graceful degradation)
+[MCP-I] ⚠️ Delegation token provided but AccessControlApiService not configured - skipping verification {
+  tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
   hasConsentProof: false
 }
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should reject delegation when user_identifier does not match session userDid
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should reject delegation when user_identifier does not match session userDid
-[MCP-I] 🔒 SECURITY: User identifier validation FAILED {
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
-  tool: 'protectedTool',
-  agentDid: 'did:key:zmock123...',
 }
 
-  delegationUserIdentifier: 'did:key:zUserB987654...',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should reject delegation when user_identifier does not match session userDid
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
-  sessionUserDid: 'did:key:zUserA123456...',
-  sessionId: 'session123...',
   tool: 'protectedTool',
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should reject delegation when user_identifier does not match session userDid
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
-  reason: 'user_identifier_mismatch',
   hasConsentProof: false,
-  severity: 'high'
-}
-
   requiredScopes: [ 'files:write' ]
 }
+[MCP-I] 🔒 SECURITY: User identifier validation FAILED {
+  tool: 'protectedTool',
+  agentDid: 'did:key:zmock123...',
 
+  delegationUserIdentifier: 'did:key:zUserB987654...',
+  sessionUserDid: 'did:key:zUserA123456...',
+  sessionId: 'session123...',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should accept delegation when user_identifier matches session userDid
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
 }
+  reason: 'user_identifier_mismatch',
+  severity: 'high'
+}
+
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should accept delegation when user_identifier matches session userDid
+[MCP-I] ⚠️ Delegation has user_identifier but session missing userDid {
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
+  tool: 'protectedTool',
   hasDelegationToken: true,
   hasConsentProof: false,
+  agentDid: 'did:key:zmock123...',
   requiredScopes: [ 'files:write' ]
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should accept delegation when user_identifier matches session userDid
 [MCP-I] ✅ User identifier validation PASSED {
   tool: 'protectedTool',
+  delegationUserIdentifier: 'did:key:zUserA123456...',
   agentDid: 'did:key:zmock123...',
+  sessionId: 'session123...'
+}
   userDid: 'did:key:zUserA123456...',
   sessionId: 'session123...'
 }
 [MCP-I] ✅ Delegation verification SUCCEEDED {
+
   tool: 'protectedTool',
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should not create proof when tool execution is blocked
   agentDid: 'did:key:zmock123...',
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
   delegationId: 'test-delegation-id',
+  tool: 'protectedTool',
   credentialScopes: [ 'files:write' ],
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
   requiredScopes: [ 'files:write' ]
 }
 
+  resumeToken: 'resume_bg3syy_midps2x8',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_bg3syy_midps2x8'
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing user_identifier gracefully (backward compatibility)
 [MCP-I] Checking tool protection: {
+}
   tool: 'protectedTool',
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
-[MCP-I] ⚠️ Delegation has user_identifier but session missing userDid {
-  tool: 'protectedTool',
-  agentDid: 'did:key:zmock123...',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
 }
-  delegationUserIdentifier: 'did:key:zUserA123456...',
-  sessionId: 'session123...'
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing user_identifier gracefully (backward compatibility)
+
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include tool name in error
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing user_identifier gracefully (backward compatibility)
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
 [MCP-I] ✅ Delegation verification SUCCEEDED {
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   delegationId: 'test-delegation-id',
   credentialScopes: [ 'files:write' ],
   requiredScopes: [ 'files:write' ]
 }
+  resumeToken: 'resume_bg3syy_midps2x8',
 
-stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_bg3syy_midps2x8'
 }
-
+stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
+
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include required scopes in error
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
 }
 
+  requiredScopes: [ 'files:write', 'files:read' ],
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
+  agentDid: 'did:key:zmock123...',
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
+  resumeToken: 'resume_bg3syy_midps2x9',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite%2Cfiles%3Aread&session_id=session123&agent_did=&resume_token=resume_bg3syy_midps2x9'
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
 [MCP-I] ✅ Delegation verification SUCCEEDED {
+}
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   delegationId: 'test-delegation-id',
@@ -1338,130 +1763,112 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   hasDelegation: false
 }
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should not create proof when tool execution is blocked
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
-  requiredScopes: [ 'files:write' ],
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6or8_midnqpjr',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_gw6or8_midnqpjr'
-}
-
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include tool name in error
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include tool name in error
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include required scopes in error
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
 [MCP-I] Checking tool protection: {
-  tool: 'protectedTool',
-  requiredScopes: [ 'files:write' ],
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6or8_midnqpjr',
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
 
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_gw6or8_midnqpjr'
-}
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include required scopes in error
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
-  requiredScopes: [ 'files:write', 'files:read' ],
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6os3_midnqpjs',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite%2Cfiles%3Aread&session_id=session123&agent_did=&resume_token=resume_gw6os3_midnqpjs'
-}
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include consent URL in error
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include consent URL in error
 [MCP-I] Checking tool protection: {
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include consent URL in error
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
 [MCP-I] BLOCKED: Tool requires delegation but none provided {
-
   tool: 'protectedTool',
+
   requiredScopes: [ 'files:write' ],
   agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6os3_midnqpjs',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_gw6os3_midnqpjs'
+  resumeToken: 'resume_bg3t0o_midps2xa',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_bg3t0o_midps2xa'
 }
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include resume token in error
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include resume token in error
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include resume token in error
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
 }
 
+  tool: 'protectedTool',
+  requiredScopes: [ 'files:write' ],
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include intercepted call context in error
 [MCP-I] Checking tool protection: {
-  requiredScopes: [ 'files:write' ],
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
 
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6os3_midnqpjs',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_gw6os3_midnqpjs'
-}
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include intercepted call context in error
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
-  requiredScopes: [ 'files:write' ],
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_x2ww0e_midnqpjs',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_x2ww0e_midnqpjs'
-}
-
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > audit logging > should log tool protection check when audit enabled
+  agentDid: 'did:key:zmock123...',
 [MCP-I] Checking tool protection: {
   tool: 'testTool',
+  resumeToken: 'resume_bg3t0o_midps2xa',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > audit logging > should log tool protection check when audit enabled
 [MCP-I] Tool protection check passed (no delegation required) {
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_bg3t0o_midps2xa'
   tool: 'testTool',
+}
   agentDid: 'did:key:zmock123...',
+
   reason: 'Tool not configured to require delegation'
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include intercepted call context in error
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > audit logging > should log blocked tool call when audit enabled
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
+  requiredScopes: [ 'files:write' ],
   hasDelegation: false
+  agentDid: 'did:key:zmock123...',
+}
+  resumeToken: 'resume_rmu08z_midps2xb',
+
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_rmu08z_midps2xb'
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle empty required scopes array
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > tool protection service integration > should use agent DID from identity for protection check
 [MCP-I] Checking tool protection: {
+  requiredScopes: [],
   tool: 'testTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > tool protection service integration > should use agent DID from identity for protection check
+  agentDid: 'did:key:zmock123...',
 [MCP-I] Tool protection check passed (no delegation required) {
   tool: 'testTool',
   agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_bg3t2e_midps2xc',
   reason: 'Tool not configured to require delegation'
 }
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=&session_id=session123&agent_did=&resume_token=resume_bg3t2e_midps2xc'
 
+}
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > tool protection service integration > should handle tool protection service errors gracefully
 [MCP-I] Checking tool protection: {
   tool: 'testTool',
@@ -1469,6 +1876,7 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   hasDelegation: false
 }
 
+
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle empty required scopes array
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
@@ -1476,224 +1884,153 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   hasDelegation: false
 }
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle empty required scopes array
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
-  requiredScopes: [],
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6osy_midnqpjt',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=&session_id=session123&agent_did=&resume_token=resume_gw6osy_midnqpjt'
-}
-
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle multiple required scopes
 [MCP-I] Checking tool protection: {
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle multiple required scopes
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle multiple required scopes
   hasDelegation: false
 [MCP-I] BLOCKED: Tool requires delegation but none provided {
-}
-
   tool: 'protectedTool',
-  requiredScopes: [ 'scope1', 'scope2', 'scope3' ],
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_gw6ott_midnqpju',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=scope1%2Cscope2%2Cscope3&session_id=session123&agent_did=&resume_token=resume_gw6ott_midnqpju'
 }
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle session without id
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle session without id
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-  tool: 'protectedTool',
   hasDelegation: false
 }
 
-  requiredScopes: [ 'files:write' ],
+  requiredScopes: [ 'scope1', 'scope2', 'scope3' ],
   agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_ty8p8j_midnqpju',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=&agent_did=&resume_token=resume_ty8p8j_midnqpju'
-}
-
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle handler errors independently of protection
+  resumeToken: 'resume_bg3t2e_midps2xc',
 [MCP-I] Checking tool protection: {
   tool: 'errorTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=scope1%2Cscope2%2Cscope3&session_id=session123&agent_did=&resume_token=resume_bg3t2e_midps2xc'
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle handler errors independently of protection
+}
 [MCP-I] Tool protection check passed (no delegation required) {
+
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle session without id
   tool: 'errorTool',
   agentDid: 'did:key:zmock123...',
   reason: 'Tool not configured to require delegation'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should allow unprotected tool calls
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.791Z'
-}
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.792Z'
-}
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
-[ToolProtectionService] Protection check {
-  tool: 'checkout',
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  found: true,
-  isWildcard: false,
-  requiresDelegation: true,
-  availableTools: [ 'checkout' ]
-}
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should fetch tool protection config from AgentShield
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'protected_tool' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.793Z'
-}
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should cache tool protection config
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.794Z'
-}
-
-stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should use fallback config when API fails
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
-
- ✓ src/__tests__/runtime/tool-protection-enforcement.test.ts (29 tests) 72ms
-stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle tool protection service errors gracefully
-[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  error: 'Network error',
-  cacheKey: 'config:tool-protections:test-project'
-}
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should share cache across multiple service instances
-stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle network timeouts
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
-  toolCount: 1,
-
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.796Z'
-}
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.796Z'
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_oi5th4_midps2xd',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=&agent_did=&resume_token=resume_oi5th4_midps2xd'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.796Z'
+stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Submission Flow > should submit proof end-to-end
+[AccessControl] 🔍 RAW API RESPONSE (before parsing): {
+  correlationId: '62201c2c-5666-4b80-93aa-478e29b02b89',
+  status: 200,
+  statusText: '',
+  headers: { 'content-type': 'application/json' },
+  responseTextLength: 100,
+  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}',
+  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
 }
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 3,
-  protectedTools: [ 'add_to_cart', 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.797Z'
+[AccessControl] 🔍 PARSED RESPONSE DATA: {
+  correlationId: '62201c2c-5666-4b80-93aa-478e29b02b89',
+  status: 200,
+  responseDataType: 'object',
+  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  responseData: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 1,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 0,\n' +
+    '    "blocked": 0,\n' +
+    '    "error": 0\n' +
+    '  }\n' +
+    '}'
 }
-
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
-[ToolProtectionService] Protection check {
-  tool: 'add_to_cart',
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  found: true,
-  isWildcard: false,
-  requiresDelegation: true,
-  availableTools: [ 'search_products', 'add_to_cart', 'checkout' ]
+[AccessControl] Raw response received: {
+  "success": true,
+  "accepted": 1,
+  "rejected": 0,
+  "outcomes": {
+    "success": 1,
+    "failed": 0,
+    "blocked": 0,
+    "error": 0
+  }
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Concurrent operations > should handle concurrent cache operations
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.797Z'
-}
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.797Z'
+stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Submission Flow > should handle proof submission with errors
+[AccessControl] 🔍 RAW API RESPONSE (before parsing): {
+  correlationId: '2a0fcc38-ed6c-4aa0-9d78-2c5dce6cb8af',
+  status: 200,
+  statusText: '',
+  headers: { 'content-type': 'application/json' },
+  responseTextLength: 200,
+  responseTextPreview: '{"success":true,"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid JWS signature"}}]}',
+  fullResponseText: '{"success":true,"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid JWS signature"}}]}'
 }
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:09.797Z'
+[AccessControl] 🔍 PARSED RESPONSE DATA: {
+  correlationId: '2a0fcc38-ed6c-4aa0-9d78-2c5dce6cb8af',
+  status: 200,
+  responseDataType: 'object',
+  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
+  responseData: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 0,\n' +
+    '  "rejected": 1,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 0,\n' +
+    '    "failed": 1,\n' +
+    '    "blocked": 0,\n' +
+    '    "error": 0\n' +
+    '  },\n' +
+    '  "errors": [\n' +
+    '    {\n' +
+    '      "proof_index": 0,\n' +
+    '      "error": {\n' +
+    '        "code": "invalid_signature",\n' +
+    '        "message": "Invalid JWS signature"\n' +
+    '      }\n' +
+    '    }\n' +
+    '  ]\n' +
+    '}'
 }
+[AccessControl] Raw response received: {
+  "success": true,
+  "accepted": 0,
+  "rejected": 1,
+  "outcomes": {
+    "success": 0,
+    "failed": 1,
+    "blocked": 0,
+    "error": 0
+  },
+  "errors": [
+    {
+      "proof_index": 0,
+      "error": {
+        "code": "invalid_signature",
+        "message": "Invalid JWS signature"
+      }
+    }
+  ]
+}
+
+stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Verification Flow > should verify proof using ProofVerifier
+[CryptoService] Key ID mismatch
 
- ✓ src/__tests__/integration/full-flow.test.ts (21 tests) 15ms
-stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
-[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
-    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:257:9
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
-
- ✓ src/__tests__/runtime/base.test.ts (55 tests) 24ms
- ✓ src/services/__tests__/proof-verifier.integration.test.ts (13 tests | 1 skipped) 165ms
- ✓ src/services/__tests__/access-control.integration.test.ts (9 tests) 200ms
+ ✓ src/__tests__/runtime/tool-protection-enforcement.test.ts (29 tests) 18ms
+ ✓ src/__tests__/runtime/route-interception.test.ts (21 tests) 26ms
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should fetch from project-scoped endpoint when projectId is available
 [ToolProtectionService] Config loaded from API {
   source: 'api',
@@ -1702,7 +2039,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.105Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.058Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should handle new endpoint format with toolProtections object
@@ -1713,7 +2050,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.107Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.061Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should parse oauthProvider from new endpoint format (Phase 2)
@@ -1724,7 +2061,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.107Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.062Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should preserve oauthProvider through cache operations
@@ -1735,7 +2072,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.107Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.062Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should fetch from agent-scoped endpoint when projectId is not available
@@ -1746,7 +2083,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.107Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.062Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should handle old endpoint format with tools array
@@ -1757,7 +2094,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.108Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.062Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should parse oauthProvider from old endpoint format (tools array)
@@ -1768,7 +2105,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.108Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.063Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should handle old endpoint format with tools object
@@ -1779,7 +2116,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.108Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.063Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should parse oauthProvider from old endpoint format (tools object)
@@ -1790,7 +2127,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.108Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.063Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should skip tools without name in array format
@@ -1833,7 +2170,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.109Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.063Z'
 }
 [ToolProtectionService] API fetch successful, config cached {
   source: 'cache-write',
@@ -1843,37 +2180,38 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   tools: [ { name: 'valid_tool', requiresDelegation: true, scopeCount: 0 } ],
   ttlMs: 300000,
   ttlMinutes: 5,
-  expiresAt: '2025-11-24T21:32:10.109Z',
+  expiresAt: '2025-11-24T22:29:13.063Z',
   expiresIn: '300s'
 }
 
-stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > caching behavior > should cache successful API responses
+ ✓ src/delegation/__tests__/cascading-revocation.test.ts (23 tests) 7ms
 stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch error handling > should handle network errors gracefully
 [ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
-[ToolProtectionService] Config loaded from API {
   agentDid: 'did:key:z6MkhaXgBZDv...',
+  error: 'ECONNREFUSED',
+  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
+}
+
+stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > caching behavior > should cache successful API responses
+[ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
   protectedTools: [ 'tool1' ],
-  error: 'ECONNREFUSED',
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.112Z'
-  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
-}
+  cacheExpiresAt: '2025-11-24T22:29:13.068Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > caching behavior > should use default cache TTL when not specified
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 0,
-
   protectedTools: [],
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.112Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.068Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > caching behavior > should use custom cache TTL when specified
@@ -1884,7 +2222,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 600000,
-  cacheExpiresAt: '2025-11-24T21:37:10.112Z'
+  cacheExpiresAt: '2025-11-24T22:34:13.068Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > edge cases > should handle empty toolProtections object
@@ -1895,7 +2233,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.112Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.068Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > edge cases > should handle null requiredScopes
@@ -1906,7 +2244,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.112Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.068Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > edge cases > should handle mixed camelCase and snake_case in response
@@ -1917,7 +2255,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.112Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.069Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return null when tool has no protection
@@ -1928,7 +2266,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.112Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.070Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return null when tool is not in config
@@ -1939,7 +2277,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.112Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.071Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return null when tool is not in config
@@ -1953,7 +2291,6 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return wildcard protection when tool not found and wildcard exists
-stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should use wildcard protection in fail-safe deny-all mode
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 2,
@@ -1961,7 +2298,7 @@ stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.113Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.071Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return wildcard protection when tool not found and wildcard exists
@@ -1972,7 +2309,6 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   isWildcard: true,
   requiresDelegation: true,
   availableTools: [ '*', 'specific_tool' ]
-[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should prioritize specific tool protection over wildcard
@@ -1981,24 +2317,26 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   toolCount: 2,
   protectedTools: [ '*' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  error: 'Network error',
-  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
-}
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.114Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.073Z'
 }
 
+stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should use wildcard protection in fail-safe deny-all mode
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should use wildcard protection in fail-safe deny-all mode
-
+[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
 [ToolProtectionService] Protection check {
   tool: 'any_tool',
   agentDid: 'did:key:z6MkhaXgBZDv...',
+  agentDid: 'did:key:z6MkhaXgBZDv...',
   found: true,
   isWildcard: true,
   requiresDelegation: true,
+  error: 'Network error',
   availableTools: [ '*' ]
+}
+  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
+
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return protection config when tool requires delegation
@@ -2009,7 +2347,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.114Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.073Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return protection config when tool requires delegation
@@ -2022,119 +2360,318 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   availableTools: [ 'protected_tool' ]
 }
 
-stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > integration with NoOpToolProtectionCache > should work with NoOpToolProtectionCache
+stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > integration with NoOpToolProtectionCache > should work with NoOpToolProtectionCache
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.074Z'
+}
+
+stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > integration with NoOpToolProtectionCache > should work with NoOpToolProtectionCache
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.074Z'
+}
+
+ ✓ src/__tests__/services/tool-protection.service.test.ts (49 tests) 22ms
+ ✓ src/__tests__/runtime/base.test.ts (55 tests) 19ms
+ ✓ src/__tests__/runtime/base-extensions.test.ts (38 tests) 19ms
+stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > error handling > should handle storage.get errors gracefully
+[UserDidManager] Storage.get failed, generating new DID: Error: Storage error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/__tests__/identity/user-did-manager.test.ts:187:67
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+
+stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > error handling > should handle storage.set errors gracefully
+[UserDidManager] Storage.set failed, continuing with cached DID: Error: Storage error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/__tests__/identity/user-did-manager.test.ts:196:67
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+
+stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > error handling > should handle storage.delete errors gracefully
+[UserDidManager] Storage.delete failed, continuing: Error: Storage error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/__tests__/identity/user-did-manager.test.ts:206:70
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
+
+ ✓ src/__tests__/identity/user-did-manager.test.ts (17 tests) 13ms
+ ✓ src/services/__tests__/access-control.integration.test.ts (9 tests) 124ms
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should allow unprotected tool calls
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.350Z'
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.351Z'
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
+[ToolProtectionService] Protection check {
+  tool: 'checkout',
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  found: true,
+  isWildcard: false,
+  requiresDelegation: true,
+  availableTools: [ 'checkout' ]
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should fetch tool protection config from AgentShield
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'protected_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.352Z'
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should cache tool protection config
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.353Z'
+}
+
+stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should use fallback config when API fails
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
+
+stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle tool protection service errors gracefully
+[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  error: 'Network error',
+  cacheKey: 'config:tool-protections:test-project'
+}
+
+stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle network timeouts
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should share cache across multiple service instances
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.354Z'
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.354Z'
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.354Z'
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 3,
+  protectedTools: [ 'add_to_cart', 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.354Z'
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
+[ToolProtectionService] Protection check {
+  tool: 'add_to_cart',
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  found: true,
+  isWildcard: false,
+  requiresDelegation: true,
+  availableTools: [ 'search_products', 'add_to_cart', 'checkout' ]
+}
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Concurrent operations > should handle concurrent cache operations
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.355Z'
+}
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.355Z'
+}
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.355Z'
+}
+
+ ✓ src/__tests__/integration/full-flow.test.ts (21 tests) 12ms
+ ✓ src/__tests__/providers/memory.test.ts (34 tests) 10ms
+stderr | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > No Regressions > Phase 1 OAuth flow > should still work with Phase 1 OAuth flow (no oauthProvider)
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Phase 1 tools (no oauthProvider) > should work with Phase 1 tools that don't specify oauthProvider
+[ToolProtectionService] Config loaded from API {
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'phase1_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.361Z'
+}
+
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools array)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'old_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.368Z'
+}
+
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools object)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'old_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.370Z'
+}
+
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > snake_case field names > should still support snake_case field names
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  protectedTools: [ 'tool_with_snake_case' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.115Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.370Z'
 }
 
-stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > integration with NoOpToolProtectionCache > should work with NoOpToolProtectionCache
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Mixed Phase 1 and Phase 2 tools > should handle mix of Phase 1 and Phase 2 tools in same project
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  toolCount: 2,
+  protectedTools: [ 'phase1_tool', 'phase2_tool' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.115Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.371Z'
 }
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyEd25519 > should return false on verification error
-[CryptoService] Ed25519 verification error: Error: Verification failed
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:62:9
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+ ✓ src/__tests__/regression/phase2-regression.test.ts (12 tests) 11ms
+stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zbpsbpFxkSQb1iVhtLNeESvH8mhg7suz_","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053370,"timestampFormatted":"2025-11-24T22:24:13.370Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject invalid JWK format
-[CryptoService] Invalid Ed25519 JWK format
+stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
+[AUDIT] {"event":"tool_executed","data":{"tool":"greetingTool","sessionId":"b791abf20fb642084411bcd1aebb9092","timestamp":1764023053370},"timestamp":1764023053370,"timestampFormatted":"2025-11-24T22:24:13.370Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with wrong kty
-[CryptoService] Invalid Ed25519 JWK format
+stdout | src/__tests__/integration.test.ts > Integration Tests > Session expiry handling > should handle expired sessions correctly
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zhRMN0XEtj_z-Vd9WDhZMuObd8NTphcyG","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053396,"timestampFormatted":"2025-11-24T22:24:13.396Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with wrong crv
-[CryptoService] Invalid Ed25519 JWK format
+stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zirae5Sfp8Z8zhg4_wC0XDhl2TOs98RNb","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053396,"timestampFormatted":"2025-11-24T22:24:13.396Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with missing x field
-[CryptoService] Invalid Ed25519 JWK format
+stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
+[AUDIT] {"event":"keys_rotated","data":{"oldDid":"did:key:zirae5Sfp8Z8zhg4_wC0XDhl2TOs98RNb","newDid":"did:key:zE11g3QOgNtNhQWI5Cg1I5RwrnUbPR2_C","timestamp":1764023053396},"timestamp":1764023053396,"timestampFormatted":"2025-11-24T22:24:13.396Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject JWK with empty x field
-[CryptoService] Invalid Ed25519 JWK format
+stdout | src/__tests__/integration.test.ts > Integration Tests > Well-known endpoints > should provide identity discovery endpoints
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:z8evK7ya-cxhZWH7dpBi8nXPrnP2bZ1UK","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053397,"timestampFormatted":"2025-11-24T22:24:13.397Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject malformed JWS
-[CryptoService] Invalid JWS format: Error: Invalid header base64: Unexpected token 'ž', "ž‹" is not valid JSON
-    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:91:13)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:230:42
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+stdout | src/__tests__/integration.test.ts > Integration Tests > Nonce replay protection > should prevent nonce reuse
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:z7LtUTT9dvGc_aBW8U3KA-WTw2IhJ1YV_","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053397,"timestampFormatted":"2025-11-24T22:24:13.397Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject non-EdDSA algorithms
-[CryptoService] Unsupported algorithm: RS256, expected EdDSA
+stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle network errors gracefully
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zkbu4fmX7Tz5my6O1V9r5bgSGhbQyxQWw","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053397,"timestampFormatted":"2025-11-24T22:24:13.397Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should reject HS256 algorithm
-[CryptoService] Unsupported algorithm: HS256, expected EdDSA
+stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle malformed DID documents
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zcuYsoOGhsJ2-vAzjQynEly08PnbjaTQ4","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053397,"timestampFormatted":"2025-11-24T22:24:13.397Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle empty JWS components
-[CryptoService] Invalid JWS format: Error: Invalid header base64: Unexpected end of JSON input
-    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:91:13)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:271:42
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should provide debug information in development
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zvLryzaIg4z4MFZKvL9m_Te--A9QM-3X4","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053397,"timestampFormatted":"2025-11-24T22:24:13.397Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - single part
-[CryptoService] Invalid JWS format: Error: Invalid JWS format: expected header.payload.signature
-    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:78:13)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:279:42
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should be disabled in production
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zXSTNznD9nicCwc6fhFKt058_cfCFmFBo","environment":"development","userDidGeneration":"disabled"},"timestamp":1764023053398,"timestampFormatted":"2025-11-24T22:24:13.398Z"}
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - two parts
-[CryptoService] Invalid JWS format: Error: Invalid JWS format: expected header.payload.signature
-    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:78:13)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:287:42
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+ ✓ src/__tests__/integration.test.ts (9 tests) 36ms
+ ✓ src/__tests__/runtime/proof-client-did.test.ts (17 tests) 32ms
+ ✓ src/compliance/__tests__/schema-verifier.test.ts (30 tests) 4ms
+stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if API request fails
+[RemoteConfig] API returned 404: Not Found
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - four parts
-[CryptoService] Invalid JWS format: Error: Invalid JWS format: expected header.payload.signature
-    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:78:13)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:302:42
+stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if API throws error
+[RemoteConfig] Failed to fetch config: Error: Network error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/config/__tests__/remote-config.spec.ts:170:35
     at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
     at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
     at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
@@ -2142,25 +2679,15 @@ stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJ
     at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
     at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - invalid JSON header
-[CryptoService] Invalid JWS format: Error: Invalid header base64: Unexpected token 'o', "notjson" is not valid JSON
-    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:91:13)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:316:42
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if neither projectId nor agentDid provided
+[RemoteConfig] Neither projectId nor agentDid provided
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle malformed JWS - invalid base64
-[CryptoService] Invalid JWS format: Error: Invalid payload base64: Invalid base64url string: Invalid character
-    at CryptoService.parseJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:107:15)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:169:23)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:334:42
+stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should handle cache read errors gracefully
+[RemoteConfig] Cache read failed: Error: Cache error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/config/__tests__/remote-config.spec.ts:198:50
     at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
     at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
     at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
@@ -2168,77 +2695,127 @@ stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJ
     at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
     at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should validate expectedKid option
-[CryptoService] Key ID mismatch
+ ✓ src/config/__tests__/remote-config.spec.ts (9 tests) 6ms
+ ✓ src/delegation/__tests__/bitstring.test.ts (30 tests) 4ms
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify gmail → google mapping works
+[ProviderResolver] Inferred provider "google" from scopes
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should validate alg option
-[CryptoService] Unsupported algorithm: EdDSA, expected RS256
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify calendar → google mapping works
+[ProviderResolver] Inferred provider "google" from scopes
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle empty scopes array
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should validate Ed25519 key length
-[CryptoService] Failed to extract public key: Error: Invalid Ed25519 public key length: 5
-    at CryptoService.jwkToBase64PublicKey (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:295:13)
-    at CryptoService.verifyJWS (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/crypto.service.ts:249:32)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:398:42
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
 
-stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJWS > should handle signature verification error
-[CryptoService] Ed25519 verification error: Error: Crypto error
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:449:61
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify outlook → microsoft mapping works
+[ProviderResolver] Inferred provider "microsoft" from scopes
 
- ✓ src/services/__tests__/crypto.service.test.ts (34 tests) 25ms
- ✓ src/__tests__/services/tool-protection.service.test.ts (49 tests) 20ms
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
-[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle ambiguous scopes (multiple providers inferred)
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
 
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
-[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle unknown scope prefixes
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
 
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should fall back to memory when Redis connection fails
-[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle scopes without colons
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
+
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle inferred provider not in registry
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "google" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
+
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Provider name case sensitivity > should handle provider names case-insensitively in inference
+[ProviderResolver] Inferred provider "github" from scopes
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Fallback behavior (Priority 3) > should use first configured provider when oauthProvider not specified
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
+
+
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Multiple scopes with same provider > should handle multiple scopes from same provider
+[ProviderResolver] Inferred provider "github" from scopes
+
+ ✓ src/__tests__/providers/base.test.ts (14 tests) 5ms
+ ✓ src/__tests__/services/provider-resolver-edge-cases.test.ts (19 tests | 1 skipped) 33ms
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
+[ToolProtectionService] Config loaded from API {
+stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle API rate limiting gracefully
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+[ToolProtectionService] API fetch failed, using fallback config {
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  error: 'Failed to fetch bouncer config: 429 Too Many Requests - Rate limit exceeded'
+  projectId: 'test-project-123',
+  cacheTtlMs: 1000,
+  cacheExpiresAt: '2025-11-24T22:24:14.784Z'
+}
+}
+
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle typical e-commerce tool protection config
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 4,
+  protectedTools: [ 'add_to_cart', 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.784Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle concurrent requests
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.785Z'
+}
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.785Z'
+}
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-24T22:29:13.785Z'
+}
+
+ ✓ src/__tests__/services/agentshield-integration.test.ts (30 tests) 1115ms
+       ✓ should respect cache TTL  1101ms
+stdout | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should infer provider from github scope prefix
+[ProviderResolver] Inferred provider "github" from scopes
+
+stdout | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should infer provider from gmail scope prefix (maps to google)
+[ProviderResolver] Inferred provider "google" from scopes
 
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should use KV namespace when provided
-[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
+stderr | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should return null for ambiguous scopes
+[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
 
-stderr | src/services/__tests__/proof-verifier.test.ts > ProofVerifier Security > Signature Verification > should handle signature verification errors gracefully
+ ✓ src/services/__tests__/provider-resolver.test.ts (8 tests) 5ms
+ ✓ src/delegation/__tests__/delegation-graph.test.ts (28 tests) 7ms
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should parse oauthProvider from camelCase field
-[CryptoService] Ed25519 verification error: Error: Crypto error
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 2,
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.test.ts:328:9
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
   protectedTools: [ 'read_repos', 'send_email' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.294Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.875Z'
 }
 
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should parse oauthProvider from snake_case field
 [ToolProtectionService] Config loaded from API {
   source: 'api',
@@ -2247,7 +2824,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.297Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.878Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should prefer camelCase over snake_case when both present
@@ -2258,7 +2835,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.297Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.879Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should handle missing oauthProvider field (backward compatible)
@@ -2269,10 +2846,9 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.298Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.879Z'
 }
 
- ✓ src/services/__tests__/proof-verifier.test.ts (21 tests) 11ms
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should parse oauthProvider from array format with camelCase
 [ToolProtectionService] Config loaded from API {
   source: 'api',
@@ -2281,7 +2857,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.304Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.879Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should parse oauthProvider from array format with snake_case
@@ -2292,7 +2868,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.304Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.880Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should prefer camelCase over snake_case in array format
@@ -2303,7 +2879,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.304Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.880Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should parse oauthProvider from object format with camelCase
@@ -2314,7 +2890,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.304Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.880Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should parse oauthProvider from object format with snake_case
@@ -2325,7 +2901,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.305Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.880Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should prefer camelCase over snake_case in object format
@@ -2336,7 +2912,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.305Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.880Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Caching > should cache oauthProvider field correctly
@@ -2347,7 +2923,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.305Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.880Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > oauthProvider field inclusion > should include oauthProvider in returned ToolProtection objects when present
@@ -2358,7 +2934,7 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.305Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.881Z'
 }
 
 stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > oauthProvider field inclusion > should handle empty string oauthProvider gracefully
@@ -2369,298 +2945,29 @@ stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolPro
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.307Z'
-}
-
- ✓ src/__tests__/services/tool-protection-oauth-provider.test.ts (14 tests) 14ms
- ✓ src/services/__tests__/storage.service.test.ts (17 tests) 33ms
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Phase 1 tools (no oauthProvider) > should work with Phase 1 tools that don't specify oauthProvider
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'phase1_tool' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.317Z'
-}
-
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools array)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'old_tool' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.321Z'
-}
-
-stderr | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > No Regressions > Phase 1 OAuth flow > should still work with Phase 1 OAuth flow (no oauthProvider)
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools object)
-[ToolProtectionService] Config loaded from API {
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'old_tool' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.321Z'
-
-}
-
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > snake_case field names > should still support snake_case field names
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool_with_snake_case' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.321Z'
-}
-
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Mixed Phase 1 and Phase 2 tools > should handle mix of Phase 1 and Phase 2 tools in same project
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'phase1_tool', 'phase2_tool' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.322Z'
-}
-
- ✓ src/__tests__/regression/phase2-regression.test.ts (12 tests) 6ms
-stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zHrIAXiPd82_S4D4jgQVnnrEpM9cytCcW","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630327,"timestampFormatted":"2025-11-24T21:27:10.327Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
-[AUDIT] {"event":"tool_executed","data":{"tool":"greetingTool","sessionId":"087bdca49ced15c22721f1060a548c8e","timestamp":1764019630327},"timestamp":1764019630327,"timestampFormatted":"2025-11-24T21:27:10.327Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Session expiry handling > should handle expired sessions correctly
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zUTYHZ87G7YghsT2EBWJwJh17s2nUugJ5","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630342,"timestampFormatted":"2025-11-24T21:27:10.342Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zGCVcbJoakpFxOVCaDxZC3cl-BNu3dvtn","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630343,"timestampFormatted":"2025-11-24T21:27:10.343Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
-[AUDIT] {"event":"keys_rotated","data":{"oldDid":"did:key:zGCVcbJoakpFxOVCaDxZC3cl-BNu3dvtn","newDid":"did:key:zvXEK_BBk1qAaau-LEv6gsbbBCXtoMuL7","timestamp":1764019630343},"timestamp":1764019630343,"timestampFormatted":"2025-11-24T21:27:10.343Z"}
-
- ✓ src/__tests__/providers/memory.test.ts (34 tests) 15ms
-stdout | src/__tests__/integration.test.ts > Integration Tests > Well-known endpoints > should provide identity discovery endpoints
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zKOWuYWu7A7ZfSQ1WZd0qCs14PWDWkxiF","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630343,"timestampFormatted":"2025-11-24T21:27:10.343Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Nonce replay protection > should prevent nonce reuse
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zHiFFzI1Uh2MZ7X32utWo4tgatqF4aRTp","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630343,"timestampFormatted":"2025-11-24T21:27:10.343Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle network errors gracefully
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zFWe89pbeL-6G20NEqLQcPD-NlAKxz_WW","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630344,"timestampFormatted":"2025-11-24T21:27:10.344Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle malformed DID documents
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:z0B6tZqPGRmCXPWxrmhGe8F5R1X6ERiux","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630344,"timestampFormatted":"2025-11-24T21:27:10.344Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should provide debug information in development
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zwvaoj9oPq89uorHnMZsdmvqWDO-VK-Vw","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630344,"timestampFormatted":"2025-11-24T21:27:10.344Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should be disabled in production
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zCzYL45UA04Cx8blnD1nJ27feOqEHJkrv","environment":"development","userDidGeneration":"disabled"},"timestamp":1764019630344,"timestampFormatted":"2025-11-24T21:27:10.344Z"}
-
- ✓ src/delegation/storage/__tests__/memory-statuslist-storage.test.ts (14 tests) 8ms
- ✓ src/__tests__/integration.test.ts (9 tests) 19ms
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 1000,
-  cacheExpiresAt: '2025-11-24T21:27:11.354Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle typical e-commerce tool protection config
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 4,
-  protectedTools: [ 'add_to_cart', 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.355Z'
-}
-
-stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle API rate limiting gracefully
-[ToolProtectionService] API fetch failed, using fallback config {
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle concurrent requests
-  error: 'Failed to fetch bouncer config: 429 Too Many Requests - Rate limit exceeded'
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.355Z'
+  cacheExpiresAt: '2025-11-24T22:29:13.881Z'
 }
 
-}
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.355Z'
-}
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-24T21:32:10.355Z'
-}
-
- ✓ src/__tests__/services/agentshield-integration.test.ts (30 tests) 1115ms
-       ✓ should respect cache TTL  1101ms
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify gmail → google mapping works
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle empty scopes array
-[ProviderResolver] Inferred provider "google" from scopes
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle ambiguous scopes (multiple providers inferred)
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify calendar → google mapping works
-[ProviderResolver] Inferred provider "google" from scopes
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify outlook → microsoft mapping works
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle unknown scope prefixes
-[ProviderResolver] Inferred provider "microsoft" from scopes
-
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle scopes without colons
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle inferred provider not in registry
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "google" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Fallback behavior (Priority 3) > should use first configured provider when oauthProvider not specified
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
- ✓ src/delegation/storage/__tests__/memory-graph-storage.test.ts (27 tests) 5ms
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Provider name case sensitivity > should handle provider names case-insensitively in inference
-
-[ProviderResolver] Inferred provider "github" from scopes
-
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Multiple scopes with same provider > should handle multiple scopes from same provider
-[ProviderResolver] Inferred provider "github" from scopes
-
- ✓ src/__tests__/services/provider-resolver-edge-cases.test.ts (19 tests | 1 skipped) 111ms
-stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > error handling > should handle storage.get errors gracefully
-[UserDidManager] Storage.get failed, generating new DID: Error: Storage error
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/__tests__/identity/user-did-manager.test.ts:187:67
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-
-stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > error handling > should handle storage.set errors gracefully
-[UserDidManager] Storage.set failed, continuing with cached DID: Error: Storage error
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/__tests__/identity/user-did-manager.test.ts:196:67
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-
-stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > error handling > should handle storage.delete errors gracefully
-[UserDidManager] Storage.delete failed, continuing: Error: Storage error
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/__tests__/identity/user-did-manager.test.ts:206:70
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
-
- ✓ src/__tests__/identity/user-did-manager.test.ts (17 tests) 6ms
- ✓ src/__tests__/runtime/delegation-flow.test.ts (4 tests) 4ms
- ✓ src/__tests__/runtime/base-extensions.test.ts (38 tests) 14ms
- ✓ src/__tests__/runtime/proof-client-did.test.ts (17 tests) 7ms
+ ✓ src/__tests__/services/tool-protection-oauth-provider.test.ts (14 tests) 7ms
+ ✓ src/delegation/storage/__tests__/memory-graph-storage.test.ts (27 tests) 38ms
 stderr | src/services/__tests__/provider-resolution.integration.test.ts > Provider Resolution Integration > Backward compatibility > should work with Phase 1 tools (no oauthProvider field)
 [ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
 
- ✓ src/services/__tests__/provider-resolution.integration.test.ts (6 tests) 4ms
+ ✓ src/services/__tests__/provider-resolution.integration.test.ts (6 tests) 3ms
+ ✓ src/__tests__/runtime/delegation-flow.test.ts (4 tests) 5ms
+ ✓ src/__tests__/config/provider-runtime-config.test.ts (9 tests) 2ms
+ ✓ src/__tests__/runtime/audit-logger.test.ts (9 tests) 2ms
+ ✓ src/delegation/storage/__tests__/memory-statuslist-storage.test.ts (14 tests) 3ms
  ✓ src/services/__tests__/oauth-provider-registry.test.ts (9 tests) 3ms
- ✓ src/delegation/__tests__/delegation-graph.test.ts (28 tests) 173ms
-stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if API request fails
-[RemoteConfig] API returned 404: Not Found
-
-stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if API throws error
-[RemoteConfig] Failed to fetch config: Error: Network error
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/config/__tests__/remote-config.spec.ts:170:35
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-
-stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if neither projectId nor agentDid provided
-[RemoteConfig] Neither projectId nor agentDid provided
-
-stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should handle cache read errors gracefully
-[RemoteConfig] Cache read failed: Error: Cache error
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/config/__tests__/remote-config.spec.ts:198:50
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-
-stdout | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should infer provider from github scope prefix
-[ProviderResolver] Inferred provider "github" from scopes
-
-stdout | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should infer provider from gmail scope prefix (maps to google)
-[ProviderResolver] Inferred provider "google" from scopes
-
-stderr | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should return null for ambiguous scopes
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
- ✓ src/delegation/__tests__/bitstring.test.ts (30 tests) 5ms
- ✓ src/compliance/__tests__/schema-verifier.test.ts (30 tests) 5ms
- ✓ src/config/__tests__/remote-config.spec.ts (9 tests) 8ms
- ✓ src/services/__tests__/provider-resolver.test.ts (8 tests) 8ms
- ✓ src/utils/__tests__/did-helpers.test.ts (11 tests) 2ms
- ✓ src/delegation/__tests__/utils.test.ts (28 tests) 5ms
- ✓ src/services/__tests__/batch-delegation.service.test.ts (11 tests) 5ms
- ✓ src/__tests__/runtime/audit-logger.test.ts (9 tests) 5ms
- ✓ src/__tests__/providers/base.test.ts (14 tests) 5ms
+ ✓ src/services/__tests__/batch-delegation.service.test.ts (11 tests) 3ms
+ ✓ src/delegation/__tests__/utils.test.ts (28 tests) 2ms
+ ✓ src/utils/__tests__/did-helpers.test.ts (11 tests) 3ms
  ✓ src/delegation/__tests__/audience-validator.test.ts (5 tests) 1ms
  ↓ src/__tests__/delegation-e2e.test.ts (14 tests | 14 skipped)
  ✓ src/__tests__/index.test.ts (4 tests) 2ms
 
  Test Files  43 passed | 1 skipped (44)
-      Tests  873 passed | 16 skipped (889)
-   Start at  15:27:06
-   Duration  5.26s (transform 11.76s, setup 0ms, collect 19.41s, tests 3.18s, environment 3ms, prepare 2.03s)
+      Tests  876 passed | 16 skipped (892)
+   Start at  16:24:11
+   Duration  2.93s (transform 7.39s, setup 0ms, collect 12.71s, tests 2.51s, environment 6ms, prepare 2.12s)