@kya-os/mcp-i-core 1.3.0 → 1.3.2

package/.turbo/turbo-test.log

@@ -5,166 +5,6 @@
 
  RUN  v4.0.5 /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core
 
-stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Error Handling > should handle network timeout
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use X-API-Key header for new endpoint
-
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Fallback Behavior > should cache fallback config
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
-
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:17.990Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use Authorization Bearer header for old endpoint
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:17.997Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use project-scoped endpoint when projectId is available
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:17.999Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use agent-scoped endpoint when projectId is not available
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:17.999Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode projectId in URL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'project/with/special-chars',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:17.999Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode agent DID in URL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:17.999Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle new endpoint format (toolProtections object)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:17.999Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools array)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.000Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools object)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.000Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle snake_case field names
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.000Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle camelCase field names
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.000Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should prefer camelCase over snake_case when both present
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.000Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should cache successful API responses
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.002Z'
-}
-
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 1000,
-  cacheExpiresAt: '2025-11-25T02:03:19.002Z'
-}
-
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should fetch from project-scoped endpoint when projectId is available
 [ToolProtectionService] Config loaded from API {
   source: 'api',
@@ -173,7 +13,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.377Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.874Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should handle new endpoint format with toolProtections object
@@ -184,7 +24,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.379Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.876Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should parse oauthProvider from new endpoint format (Phase 2)
@@ -195,7 +35,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.379Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.876Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - new endpoint format > should preserve oauthProvider through cache operations
@@ -206,54 +46,40 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.379Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.876Z'
 }
 
-stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch error handling > should handle network errors gracefully
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should fetch from agent-scoped endpoint when projectId is not available
 [ToolProtectionService] Config loaded from API {
-[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
   source: 'api',
   toolCount: 2,
   protectedTools: [ 'checkout' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.379Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.877Z'
 }
-  agentDid: 'did:key:z6MkhaXgBZDv...',
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should handle old endpoint format with tools array
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  error: 'ECONNREFUSED',
-  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
   toolCount: 2,
   protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
-}
-
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.380Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.878Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should parse oauthProvider from old endpoint format (tools array)
-stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should use wildcard protection in fail-safe deny-all mode
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 2,
-[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
   protectedTools: [ 'read_repos', 'send_email' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  cacheExpiresAt: '2025-11-25T02:08:18.380Z'
-  error: 'Network error',
-  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
-}
-
+  cacheExpiresAt: '2025-11-25T04:41:28.878Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should handle old endpoint format with tools object
@@ -264,7 +90,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.380Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.878Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should parse oauthProvider from old endpoint format (tools object)
@@ -275,7 +101,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.380Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.878Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch - old endpoint format > should skip tools without name in array format
@@ -318,7 +144,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.381Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.879Z'
 }
 [ToolProtectionService] API fetch successful, config cached {
   source: 'cache-write',
@@ -328,10 +154,17 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   tools: [ { name: 'valid_tool', requiresDelegation: true, scopeCount: 0 } ],
   ttlMs: 300000,
   ttlMinutes: 5,
-  expiresAt: '2025-11-25T02:08:18.381Z',
+  expiresAt: '2025-11-25T04:41:28.879Z',
   expiresIn: '300s'
 }
 
+stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > API fetch error handling > should handle network errors gracefully
+[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  error: 'ECONNREFUSED',
+  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
+}
+
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > caching behavior > should cache successful API responses
 [ToolProtectionService] Config loaded from API {
   source: 'api',
@@ -340,7 +173,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.384Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.883Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > caching behavior > should use default cache TTL when not specified
@@ -351,7 +184,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.384Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.883Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > caching behavior > should use custom cache TTL when specified
@@ -362,7 +195,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 600000,
-  cacheExpiresAt: '2025-11-25T02:13:18.385Z'
+  cacheExpiresAt: '2025-11-25T04:46:28.883Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > edge cases > should handle empty toolProtections object
@@ -373,7 +206,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.385Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.883Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > edge cases > should handle null requiredScopes
@@ -384,7 +217,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.385Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.884Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > getToolProtectionConfig > edge cases > should handle mixed camelCase and snake_case in response
@@ -395,7 +228,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.385Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.884Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return null when tool has no protection
@@ -406,7 +239,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.385Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.884Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return null when tool is not in config
@@ -417,7 +250,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.386Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.884Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return null when tool is not in config
@@ -429,17 +262,24 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   requiresDelegation: false,
   availableTools: [ 'other_tool' ]
 }
+stderr | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should use wildcard protection in fail-safe deny-all mode
+[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
 
+  agentDid: 'did:key:z6MkhaXgBZDv...',
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return wildcard protection when tool not found and wildcard exists
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 2,
+  error: 'Network error',
   protectedTools: [ '*' ],
+  cacheKey: 'agent:did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.386Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.885Z'
 }
+}
+
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return wildcard protection when tool not found and wildcard exists
 [ToolProtectionService] Protection check {
@@ -459,7 +299,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.387Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.885Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should use wildcard protection in fail-safe deny-all mode
@@ -480,7 +320,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.388Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.885Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > checkToolProtection > should return protection config when tool requires delegation
@@ -501,7 +341,7 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.388Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.887Z'
 }
 
 stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtectionService > integration with NoOpToolProtectionCache > should work with NoOpToolProtectionCache
@@ -512,75 +352,248 @@ stdout | src/__tests__/services/tool-protection.service.test.ts > ToolProtection
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:18.388Z'
+  cacheExpiresAt: '2025-11-25T04:41:28.887Z'
 }
 
-stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should validate wrapped response with success field in data
-[AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '052e98cb-4b9d-4981-9aec-7aeaeb6df6bb',
-  status: 200,
-  statusText: undefined,
-  headers: {},
-  responseTextLength: 191,
-  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.374Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.374Z"}}'
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use X-API-Key header for new endpoint
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.883Z'
 }
-[AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '052e98cb-4b9d-4981-9aec-7aeaeb6df6bb',
-  status: 200,
-  responseDataType: 'object',
-  responseDataKeys: [ 'success', 'data', 'metadata' ],
-  responseData: '{\n' +
-    '  "success": true,\n' +
-    '  "data": {\n' +
-    '    "accepted": 1,\n' +
-    '    "rejected": 0,\n' +
-    '    "outcomes": {\n' +
-    '      "success": 1,\n' +
-    '      "failed": 0,\n' +
-    '      "blocked": 0,\n' +
-    '      "error": 0\n' +
-    '    }\n' +
-    '  },\n' +
-    '  "metadata": {\n' +
-    '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-25T02:03:18.374Z"\n' +
-    '  }\n' +
-    '}'
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > API Authentication > should use Authorization Bearer header for old endpoint
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.886Z'
 }
-[AccessControl] Raw response received: {
-  "success": true,
-  "data": {
-    "accepted": 1,
-    "rejected": 0,
-    "outcomes": {
-      "success": 1,
-      "failed": 0,
-      "blocked": 0,
-      "error": 0
-    }
-  },
-  "metadata": {
-    "requestId": "test-request-id",
-    "timestamp": "2025-11-25T02:03:18.374Z"
-  }
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use project-scoped endpoint when projectId is available
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.888Z'
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '052e98cb-4b9d-4981-9aec-7aeaeb6df6bb',
-  dataKeys: [ 'accepted', 'rejected', 'outcomes' ],
-  hasAccepted: true,
-  hasRejected: true,
-  hasOutcomes: true,
-  hasErrors: false,
-  acceptedType: 'number',
-  acceptedValue: 1,
-  rejectedType: 'number',
-  rejectedValue: 0,
-  outcomesType: 'object',
-  outcomesValue: { success: 1, failed: 0, blocked: 0, error: 0 },
-  errorsType: 'undefined',
-  errorsIsArray: false,
-  fullData: '{\n' +
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should use agent-scoped endpoint when projectId is not available
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.888Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode projectId in URL
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'project/with/special-chars',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.888Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Endpoint Selection > should encode agent DID in URL
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.888Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle new endpoint format (toolProtections object)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 2,
+  protectedTools: [ 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.888Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools array)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 2,
+  protectedTools: [ 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.889Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle old endpoint format (tools object)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 2,
+  protectedTools: [ 'checkout' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.889Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle snake_case field names
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.889Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should handle camelCase field names
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.889Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Response Format Compatibility > should prefer camelCase over snake_case when both present
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.889Z'
+}
+
+stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Error Handling > should handle network timeout
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
+
+ ✓ src/__tests__/services/tool-protection.service.test.ts (49 tests) 17ms
+stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Fallback Behavior > should cache fallback config
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should cache successful API responses
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:28.891Z'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 0,
+  protectedTools: [],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 1000,
+  cacheExpiresAt: '2025-11-25T04:36:29.891Z'
+}
+
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
+[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
+
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
+[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
+
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should fall back to memory when Redis connection fails
+[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
+
+stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should use KV namespace when provided
+[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
+
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should validate wrapped response with success field in data
+[AccessControl] 🔍 RAW API RESPONSE (before parsing): {
+  correlationId: '5bf01627-155b-4a7c-a036-1d47d5179f21',
+  status: 200,
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 191,
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.897Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.897Z"}}'
+}
+[AccessControl] 🔍 PARSED RESPONSE DATA: {
+  correlationId: '5bf01627-155b-4a7c-a036-1d47d5179f21',
+  status: 200,
+  responseDataType: 'object',
+  responseDataKeys: [ 'success', 'data', 'metadata' ],
+  responseData: '{\n' +
+    '  "success": true,\n' +
+    '  "data": {\n' +
+    '    "accepted": 1,\n' +
+    '    "rejected": 0,\n' +
+    '    "outcomes": {\n' +
+    '      "success": 1,\n' +
+    '      "failed": 0,\n' +
+    '      "blocked": 0,\n' +
+    '      "error": 0\n' +
+    '    }\n' +
+    '  },\n' +
+    '  "metadata": {\n' +
+    '    "requestId": "test-request-id",\n' +
+    '    "timestamp": "2025-11-25T04:36:28.897Z"\n' +
+    '  }\n' +
+    '}'
+}
+[AccessControl] Raw response received: {
+  "success": true,
+  "data": {
+    "accepted": 1,
+    "rejected": 0,
+    "outcomes": {
+      "success": 1,
+      "failed": 0,
+      "blocked": 0,
+      "error": 0
+    }
+  },
+  "metadata": {
+    "requestId": "test-request-id",
+    "timestamp": "2025-11-25T04:36:28.897Z"
+  }
+}
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '5bf01627-155b-4a7c-a036-1d47d5179f21',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes' ],
+  hasAccepted: true,
+  hasRejected: true,
+  hasOutcomes: true,
+  hasErrors: false,
+  acceptedType: 'number',
+  acceptedValue: 1,
+  rejectedType: 'number',
+  rejectedValue: 0,
+  outcomesType: 'object',
+  outcomesValue: { success: 1, failed: 0, blocked: 0, error: 0 },
+  errorsType: 'undefined',
+  errorsIsArray: false,
+  fullData: '{\n' +
     '  "accepted": 1,\n' +
     '  "rejected": 0,\n' +
     '  "outcomes": {\n' +
@@ -592,7 +605,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '052e98cb-4b9d-4981-9aec-7aeaeb6df6bb',
+  correlationId: '5bf01627-155b-4a7c-a036-1d47d5179f21',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   hasSuccess: true,
   successValue: true,
@@ -617,16 +630,16 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
 
 stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should validate wrapped response with errors array
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '0e40c627-1a9a-448c-9c29-9f2162d86daa',
+  correlationId: '0f14b326-19f6-4c9f-888e-5aa41c678320',
   status: 200,
   statusText: undefined,
   headers: {},
   responseTextLength: 333,
-  responseTextPreview: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.397Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.397Z"}}'
+  responseTextPreview: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.914Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Proof validation failed","details":{"reason":"invalid_signature"}}}]},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.914Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '0e40c627-1a9a-448c-9c29-9f2162d86daa',
+  correlationId: '0f14b326-19f6-4c9f-888e-5aa41c678320',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
@@ -656,7 +669,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-25T02:03:18.397Z"\n' +
+    '    "timestamp": "2025-11-25T04:36:28.914Z"\n' +
     '  }\n' +
     '}'
 }
@@ -686,11 +699,11 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-25T02:03:18.397Z"
+    "timestamp": "2025-11-25T04:36:28.914Z"
   }
 }
 [AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '0e40c627-1a9a-448c-9c29-9f2162d86daa',
+  correlationId: '0f14b326-19f6-4c9f-888e-5aa41c678320',
   dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
   hasAccepted: true,
   hasRejected: true,
@@ -728,7 +741,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '0e40c627-1a9a-448c-9c29-9f2162d86daa',
+  correlationId: '0f14b326-19f6-4c9f-888e-5aa41c678320',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
   hasSuccess: true,
   successValue: true,
@@ -765,16 +778,16 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
 
 stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should validate wrapped response without outcomes (optional field)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '8d58e856-79e9-4400-80e4-3d91549cc82b',
+  correlationId: '172348da-80f7-467d-af69-0363c437d6ad',
   status: 200,
   statusText: undefined,
   headers: {},
   responseTextLength: 133,
-  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.399Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.399Z"}}'
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.915Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.915Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '8d58e856-79e9-4400-80e4-3d91549cc82b',
+  correlationId: '172348da-80f7-467d-af69-0363c437d6ad',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
@@ -786,7 +799,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-25T02:03:18.399Z"\n' +
+    '    "timestamp": "2025-11-25T04:36:28.915Z"\n' +
     '  }\n' +
     '}'
 }
@@ -798,11 +811,11 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-25T02:03:18.399Z"
+    "timestamp": "2025-11-25T04:36:28.915Z"
   }
 }
 [AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '8d58e856-79e9-4400-80e4-3d91549cc82b',
+  correlationId: '172348da-80f7-467d-af69-0363c437d6ad',
   dataKeys: [ 'accepted', 'rejected' ],
   hasAccepted: true,
   hasRejected: true,
@@ -819,7 +832,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   fullData: '{\n  "accepted": 1,\n  "rejected": 0\n}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '8d58e856-79e9-4400-80e4-3d91549cc82b',
+  correlationId: '172348da-80f7-467d-af69-0363c437d6ad',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected' ],
   hasSuccess: true,
   successValue: true,
@@ -832,23 +845,72 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   fullDataWithSuccess: '{\n  "success": true,\n  "accepted": 1,\n  "rejected": 0\n}'
 }
 
-stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should submit proofs successfully
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should throw validation error if data object missing success field
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '5d1d9d9f-b2fa-4ce8-9dbb-e4502c7d46cc',
+  correlationId: '0712185d-64ea-405e-b5fe-55aff5541a9b',
   status: 200,
-  statusText: '',
-  headers: { 'content-type': 'application/json' },
-  responseTextLength: 100,
-  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}',
-  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 191,
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.915Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.915Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '5d1d9d9f-b2fa-4ce8-9dbb-e4502c7d46cc',
+  correlationId: '0712185d-64ea-405e-b5fe-55aff5541a9b',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  responseDataKeys: [ 'success', 'data', 'metadata' ],
   responseData: '{\n' +
     '  "success": true,\n' +
+    '  "data": {\n' +
+    '    "accepted": 1,\n' +
+    '    "rejected": 0,\n' +
+    '    "outcomes": {\n' +
+    '      "success": 1,\n' +
+    '      "failed": 0,\n' +
+    '      "blocked": 0,\n' +
+    '      "error": 0\n' +
+    '    }\n' +
+    '  },\n' +
+    '  "metadata": {\n' +
+    '    "requestId": "test-request-id",\n' +
+    '    "timestamp": "2025-11-25T04:36:28.915Z"\n' +
+    '  }\n' +
+    '}'
+}
+[AccessControl] Raw response received: {
+  "success": true,
+  "data": {
+    "accepted": 1,
+    "rejected": 0,
+    "outcomes": {
+      "success": 1,
+      "failed": 0,
+      "blocked": 0,
+      "error": 0
+    }
+  },
+  "metadata": {
+    "requestId": "test-request-id",
+    "timestamp": "2025-11-25T04:36:28.915Z"
+  }
+}
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: '0712185d-64ea-405e-b5fe-55aff5541a9b',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes' ],
+  hasAccepted: true,
+  hasRejected: true,
+  hasOutcomes: true,
+  hasErrors: false,
+  acceptedType: 'number',
+  acceptedValue: 1,
+  rejectedType: 'number',
+  rejectedValue: 0,
+  outcomesType: 'object',
+  outcomesValue: { success: 1, failed: 0, blocked: 0, error: 0 },
+  errorsType: 'undefined',
+  errorsIsArray: false,
+  fullData: '{\n' +
     '  "accepted": 1,\n' +
     '  "rejected": 0,\n' +
     '  "outcomes": {\n' +
@@ -859,136 +921,103 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
     '  }\n' +
     '}'
 }
-[AccessControl] Raw response received: {
-  "success": true,
-  "accepted": 1,
-  "rejected": 0,
-  "outcomes": {
-    "success": 1,
-    "failed": 0,
-    "blocked": 0,
-    "error": 0
-  }
-}
-
-stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle all_proofs_rejected error gracefully
-[AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'f0d056dd-14cb-4f99-a55a-ef918706ddd3',
-  status: 400,
-  statusText: '',
-  headers: { 'content-type': 'application/json' },
-  responseTextLength: 209,
-  responseTextPreview: '{"success":false,"error":{"code":"all_proofs_rejected","message":"All proofs rejected","details":{"rejected":1,"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid signature"}}]}}}',
-  fullResponseText: '{"success":false,"error":{"code":"all_proofs_rejected","message":"All proofs rejected","details":{"rejected":1,"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid signature"}}]}}}'
-}
-[AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'f0d056dd-14cb-4f99-a55a-ef918706ddd3',
-  status: 400,
-  responseDataType: 'object',
-  responseDataKeys: [ 'success', 'error' ],
-  responseData: '{\n' +
-    '  "success": false,\n' +
-    '  "error": {\n' +
-    '    "code": "all_proofs_rejected",\n' +
-    '    "message": "All proofs rejected",\n' +
-    '    "details": {\n' +
-    '      "rejected": 1,\n' +
-    '      "errors": [\n' +
-    '        {\n' +
-    '          "proof_index": 0,\n' +
-    '          "error": {\n' +
-    '            "code": "invalid_signature",\n' +
-    '            "message": "Invalid signature"\n' +
-    '          }\n' +
-    '        }\n' +
-    '      ]\n' +
-    '    }\n' +
+[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
+  correlationId: '0712185d-64ea-405e-b5fe-55aff5541a9b',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  hasSuccess: true,
+  successValue: true,
+  hasAccepted: true,
+  acceptedValue: 1,
+  hasRejected: true,
+  rejectedValue: 0,
+  hasOutcomes: true,
+  outcomesValue: { success: 1, failed: 0, blocked: 0, error: 0 },
+  fullDataWithSuccess: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 1,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 0,\n' +
+    '    "blocked": 0,\n' +
+    '    "error": 0\n' +
     '  }\n' +
     '}'
 }
 
-stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle wrapped response format
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should correctly extract data from wrapped response after JSON deep clone
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '124586d3-e42f-46e3-bfad-3a9dbc9caa34',
+  correlationId: '7985cde2-5225-4856-9ada-619bea8fe8f7',
   status: 200,
-  statusText: '',
-  headers: { 'content-type': 'application/json' },
-  responseTextLength: 206,
-  responseTextPreview: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.423Z"}}',
-  fullResponseText: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.423Z"}}'
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 191,
+  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1},"errors":[]},"metadata":{"requestId":"fc1fa88f-9b22-4161-b4fd-17d8215098ee","timestamp":"2025-11-24T21:36:33.029Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1},"errors":[]},"metadata":{"requestId":"fc1fa88f-9b22-4161-b4fd-17d8215098ee","timestamp":"2025-11-24T21:36:33.029Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '124586d3-e42f-46e3-bfad-3a9dbc9caa34',
+  correlationId: '7985cde2-5225-4856-9ada-619bea8fe8f7',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
   responseData: '{\n' +
     '  "success": true,\n' +
     '  "data": {\n' +
-    '    "success": true,\n' +
     '    "accepted": 1,\n' +
     '    "rejected": 0,\n' +
     '    "outcomes": {\n' +
-    '      "success": 1,\n' +
-    '      "failed": 0,\n' +
-    '      "blocked": 0,\n' +
-    '      "error": 0\n' +
-    '    }\n' +
+    '      "success": 1\n' +
+    '    },\n' +
+    '    "errors": []\n' +
     '  },\n' +
     '  "metadata": {\n' +
-    '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-25T02:03:18.423Z"\n' +
+    '    "requestId": "fc1fa88f-9b22-4161-b4fd-17d8215098ee",\n' +
+    '    "timestamp": "2025-11-24T21:36:33.029Z"\n' +
     '  }\n' +
     '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
   "data": {
-    "success": true,
     "accepted": 1,
     "rejected": 0,
     "outcomes": {
-      "success": 1,
-      "failed": 0,
-      "blocked": 0,
-      "error": 0
-    }
+      "success": 1
+    },
+    "errors": []
   },
   "metadata": {
-    "requestId": "test-request-id",
-    "timestamp": "2025-11-25T02:03:18.423Z"
+    "requestId": "fc1fa88f-9b22-4161-b4fd-17d8215098ee",
+    "timestamp": "2025-11-24T21:36:33.029Z"
   }
 }
 [AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '124586d3-e42f-46e3-bfad-3a9dbc9caa34',
-  dataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  correlationId: '7985cde2-5225-4856-9ada-619bea8fe8f7',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
   hasAccepted: true,
   hasRejected: true,
   hasOutcomes: true,
-  hasErrors: false,
+  hasErrors: true,
   acceptedType: 'number',
   acceptedValue: 1,
   rejectedType: 'number',
   rejectedValue: 0,
   outcomesType: 'object',
-  outcomesValue: { success: 1, failed: 0, blocked: 0, error: 0 },
-  errorsType: 'undefined',
-  errorsIsArray: false,
+  outcomesValue: { success: 1 },
+  errorsType: 'object',
+  errorsIsArray: true,
   fullData: '{\n' +
-    '  "success": true,\n' +
     '  "accepted": 1,\n' +
     '  "rejected": 0,\n' +
     '  "outcomes": {\n' +
-    '    "success": 1,\n' +
-    '    "failed": 0,\n' +
-    '    "blocked": 0,\n' +
-    '    "error": 0\n' +
-    '  }\n' +
+    '    "success": 1\n' +
+    '  },\n' +
+    '  "errors": []\n' +
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '124586d3-e42f-46e3-bfad-3a9dbc9caa34',
-  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  correlationId: '7985cde2-5225-4856-9ada-619bea8fe8f7',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
   hasSuccess: true,
   successValue: true,
   hasAccepted: true,
@@ -996,192 +1025,328 @@ stderr | src/services/__tests__/access-control.service.test.ts > AccessControlAp
   hasRejected: true,
   rejectedValue: 0,
   hasOutcomes: true,
-  outcomesValue: { success: 1, failed: 0, blocked: 0, error: 0 },
+  outcomesValue: { success: 1 },
   fullDataWithSuccess: '{\n' +
     '  "success": true,\n' +
     '  "accepted": 1,\n' +
     '  "rejected": 0,\n' +
     '  "outcomes": {\n' +
-    '    "success": 1,\n' +
-    '    "failed": 0,\n' +
-    '    "blocked": 0,\n' +
-    '    "error": 0\n' +
-    '  }\n' +
+    '    "success": 1\n' +
+    '  },\n' +
+    '  "errors": []\n' +
     '}'
 }
 
-stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should handle response where data fields are numeric values (not undefined)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '39db810f-b8c3-469f-850c-834e111b7333',
+  correlationId: 'b4e5312a-cba1-4bcb-9f38-d2f40f5b42f9',
   status: 200,
-  statusText: '',
-  headers: { 'content-type': 'application/json' },
-  responseTextLength: 42,
-  responseTextPreview: '{"success":true,"accepted":1,"rejected":0}',
-  fullResponseText: '{"success":true,"accepted":1,"rejected":0}'
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 151,
+  responseTextPreview: '{"success":true,"data":{"accepted":0,"rejected":0,"outcomes":{},"errors":[]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T04:36:28.917Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":0,"rejected":0,"outcomes":{},"errors":[]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T04:36:28.917Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '39db810f-b8c3-469f-850c-834e111b7333',
+  correlationId: 'b4e5312a-cba1-4bcb-9f38-d2f40f5b42f9',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'accepted', 'rejected' ],
-  responseData: '{\n  "success": true,\n  "accepted": 1,\n  "rejected": 0\n}'
+  responseDataKeys: [ 'success', 'data', 'metadata' ],
+  responseData: '{\n' +
+    '  "success": true,\n' +
+    '  "data": {\n' +
+    '    "accepted": 0,\n' +
+    '    "rejected": 0,\n' +
+    '    "outcomes": {},\n' +
+    '    "errors": []\n' +
+    '  },\n' +
+    '  "metadata": {\n' +
+    '    "requestId": "test-id",\n' +
+    '    "timestamp": "2025-11-25T04:36:28.917Z"\n' +
+    '  }\n' +
+    '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
-  "accepted": 1,
-  "rejected": 0
+  "data": {
+    "accepted": 0,
+    "rejected": 0,
+    "outcomes": {},
+    "errors": []
+  },
+  "metadata": {
+    "requestId": "test-id",
+    "timestamp": "2025-11-25T04:36:28.917Z"
+  }
+}
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: 'b4e5312a-cba1-4bcb-9f38-d2f40f5b42f9',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasAccepted: true,
+  hasRejected: true,
+  hasOutcomes: true,
+  hasErrors: true,
+  acceptedType: 'number',
+  acceptedValue: 0,
+  rejectedType: 'number',
+  rejectedValue: 0,
+  outcomesType: 'object',
+  outcomesValue: {},
+  errorsType: 'object',
+  errorsIsArray: true,
+  fullData: '{\n  "accepted": 0,\n  "rejected": 0,\n  "outcomes": {},\n  "errors": []\n}'
+}
+[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
+  correlationId: 'b4e5312a-cba1-4bcb-9f38-d2f40f5b42f9',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasSuccess: true,
+  successValue: true,
+  hasAccepted: true,
+  acceptedValue: 0,
+  hasRejected: true,
+  rejectedValue: 0,
+  hasOutcomes: true,
+  outcomesValue: {},
+  fullDataWithSuccess: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 0,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {},\n' +
+    '  "errors": []\n' +
+    '}'
 }
 
-stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
+stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should handle response with nested outcomes object
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '1708e238-9bbd-4dc7-a565-476361541d05',
+  correlationId: 'cf7e9132-17f9-4bbd-a2d4-cc01a08c13b1',
   status: 200,
-  statusText: '',
-  headers: { 'content-type': 'application/json' },
-  responseTextLength: 100,
-  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}',
-  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
+  statusText: undefined,
+  headers: {},
+  responseTextLength: 278,
+  responseTextPreview: '{"success":true,"data":{"accepted":3,"rejected":2,"outcomes":{"success":1,"failed":1,"blocked":1,"error":2},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Invalid signature"}}]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T04:36:28.917Z"}}',
+  fullResponseText: '{"success":true,"data":{"accepted":3,"rejected":2,"outcomes":{"success":1,"failed":1,"blocked":1,"error":2},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Invalid signature"}}]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T04:36:28.917Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '1708e238-9bbd-4dc7-a565-476361541d05',
+  correlationId: 'cf7e9132-17f9-4bbd-a2d4-cc01a08c13b1',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  responseDataKeys: [ 'success', 'data', 'metadata' ],
   responseData: '{\n' +
     '  "success": true,\n' +
-    '  "accepted": 1,\n' +
-    '  "rejected": 0,\n' +
-    '  "outcomes": {\n' +
-    '    "success": 1,\n' +
-    '    "failed": 0,\n' +
-    '    "blocked": 0,\n' +
-    '    "error": 0\n' +
+    '  "data": {\n' +
+    '    "accepted": 3,\n' +
+    '    "rejected": 2,\n' +
+    '    "outcomes": {\n' +
+    '      "success": 1,\n' +
+    '      "failed": 1,\n' +
+    '      "blocked": 1,\n' +
+    '      "error": 2\n' +
+    '    },\n' +
+    '    "errors": [\n' +
+    '      {\n' +
+    '        "proof_index": 0,\n' +
+    '        "error": {\n' +
+    '          "code": "validation_error",\n' +
+    '          "message": "Invalid signature"\n' +
+    '        }\n' +
+    '      }\n' +
+    '    ]\n' +
+    '  },\n' +
+    '  "metadata": {\n' +
+    '    "requestId": "test-id",\n' +
+    '    "timestamp": "2025-11-25T04:36:28.917Z"\n' +
     '  }\n' +
     '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
-  "accepted": 1,
-  "rejected": 0,
-  "outcomes": {
-    "success": 1,
-    "failed": 0,
-    "blocked": 0,
-    "error": 0
+  "data": {
+    "accepted": 3,
+    "rejected": 2,
+    "outcomes": {
+      "success": 1,
+      "failed": 1,
+      "blocked": 1,
+      "error": 2
+    },
+    "errors": [
+      {
+        "proof_index": 0,
+        "error": {
+          "code": "validation_error",
+          "message": "Invalid signature"
+        }
+      }
+    ]
+  },
+  "metadata": {
+    "requestId": "test-id",
+    "timestamp": "2025-11-25T04:36:28.917Z"
   }
 }
-
-stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
+[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
+  correlationId: 'cf7e9132-17f9-4bbd-a2d4-cc01a08c13b1',
+  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasAccepted: true,
+  hasRejected: true,
+  hasOutcomes: true,
+  hasErrors: true,
+  acceptedType: 'number',
+  acceptedValue: 3,
+  rejectedType: 'number',
+  rejectedValue: 2,
+  outcomesType: 'object',
+  outcomesValue: { success: 1, failed: 1, blocked: 1, error: 2 },
+  errorsType: 'object',
+  errorsIsArray: true,
+  fullData: '{\n' +
+    '  "accepted": 3,\n' +
+    '  "rejected": 2,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 1,\n' +
+    '    "blocked": 1,\n' +
+    '    "error": 2\n' +
+    '  },\n' +
+    '  "errors": [\n' +
+    '    {\n' +
+    '      "proof_index": 0,\n' +
+    '      "error": {\n' +
+    '        "code": "validation_error",\n' +
+    '        "message": "Invalid signature"\n' +
+    '      }\n' +
+    '    }\n' +
+    '  ]\n' +
+    '}'
+}
+[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
+  correlationId: 'cf7e9132-17f9-4bbd-a2d4-cc01a08c13b1',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
+  hasSuccess: true,
+  successValue: true,
+  hasAccepted: true,
+  acceptedValue: 3,
+  hasRejected: true,
+  rejectedValue: 2,
+  hasOutcomes: true,
+  outcomesValue: { success: 1, failed: 1, blocked: 1, error: 2 },
+  fullDataWithSuccess: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 3,\n' +
+    '  "rejected": 2,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 1,\n' +
+    '    "blocked": 1,\n' +
+    '    "error": 2\n' +
+    '  },\n' +
+    '  "errors": [\n' +
+    '    {\n' +
+    '      "proof_index": 0,\n' +
+    '      "error": {\n' +
+    '        "code": "validation_error",\n' +
+    '        "message": "Invalid signature"\n' +
+    '      }\n' +
+    '    }\n' +
+    '  ]\n' +
+    '}'
+}
+
+stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should submit proofs successfully
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '67622268-5090-47c5-a906-d30de6728a7d',
+  correlationId: '96380a2a-7032-492c-bbcd-95dda37efd60',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
-  responseTextLength: 56,
-  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{}}',
-  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{}}'
+  responseTextLength: 100,
+  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}',
+  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '67622268-5090-47c5-a906-d30de6728a7d',
+  correlationId: '96380a2a-7032-492c-bbcd-95dda37efd60',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
-  responseData: '{\n  "success": true,\n  "accepted": 1,\n  "rejected": 0,\n  "outcomes": {}\n}'
+  responseData: '{\n' +
+    '  "success": true,\n' +
+    '  "accepted": 1,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 0,\n' +
+    '    "blocked": 0,\n' +
+    '    "error": 0\n' +
+    '  }\n' +
+    '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
   "accepted": 1,
   "rejected": 0,
-  "outcomes": {}
+  "outcomes": {
+    "success": 1,
+    "failed": 0,
+    "blocked": 0,
+    "error": 0
+  }
 }
 
-stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle wrapped response with invalid data structure
+ ✓ src/services/__tests__/access-control.proof-response-validation.test.ts (12 tests) 23ms
+stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle all_proofs_rejected error gracefully
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '82ef5233-aecd-458c-b5f0-5ae11b2be808',
-  status: 200,
+  correlationId: '5c8fe8c0-6cc3-4a19-95bd-d09df94048af',
+  status: 400,
   statusText: '',
   headers: { 'content-type': 'application/json' },
-  responseTextLength: 52,
-  responseTextPreview: '{"success":true,"data":{"message":"Invalid format"}}',
-  fullResponseText: '{"success":true,"data":{"message":"Invalid format"}}'
+  responseTextLength: 209,
+  responseTextPreview: '{"success":false,"error":{"code":"all_proofs_rejected","message":"All proofs rejected","details":{"rejected":1,"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid signature"}}]}}}',
+  fullResponseText: '{"success":false,"error":{"code":"all_proofs_rejected","message":"All proofs rejected","details":{"rejected":1,"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid signature"}}]}}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '82ef5233-aecd-458c-b5f0-5ae11b2be808',
-  status: 200,
+  correlationId: '5c8fe8c0-6cc3-4a19-95bd-d09df94048af',
+  status: 400,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'data' ],
-  responseData: '{\n  "success": true,\n  "data": {\n    "message": "Invalid format"\n  }\n}'
-}
-[AccessControl] Raw response received: {
-  "success": true,
-  "data": {
-    "message": "Invalid format"
-  }
-}
-[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '82ef5233-aecd-458c-b5f0-5ae11b2be808',
-  dataKeys: [ 'message' ],
-  hasAccepted: false,
-  hasRejected: false,
-  hasOutcomes: false,
-  hasErrors: false,
-  acceptedType: 'undefined',
-  acceptedValue: undefined,
-  rejectedType: 'undefined',
-  rejectedValue: undefined,
-  outcomesType: 'undefined',
-  outcomesValue: undefined,
-  errorsType: 'undefined',
-  errorsIsArray: false,
-  fullData: '{\n  "message": "Invalid format"\n}'
-}
-[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '82ef5233-aecd-458c-b5f0-5ae11b2be808',
-  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected' ],
-  hasSuccess: true,
-  successValue: true,
-  hasAccepted: true,
-  acceptedValue: undefined,
-  hasRejected: true,
-  rejectedValue: undefined,
-  hasOutcomes: false,
-  outcomesValue: undefined,
-  fullDataWithSuccess: '{\n  "success": true\n}'
-}
-[AccessControl] ❌ MISSING REQUIRED FIELDS AFTER CONSTRUCTION: {
-  correlationId: '82ef5233-aecd-458c-b5f0-5ae11b2be808',
-  hasAccepted: true,
-  acceptedType: 'undefined',
-  acceptedValue: undefined,
-  hasRejected: true,
-  rejectedType: 'undefined',
-  rejectedValue: undefined,
-  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected' ],
-  fullDataWithSuccess: '{\n  "success": true\n}',
-  dataToValidateKeys: [ 'message' ],
-  fullDataToValidate: '{\n  "message": "Invalid format"\n}',
-  originalResponseData: '{\n  "success": true,\n  "data": {\n    "message": "Invalid format"\n  }\n}'
+  responseDataKeys: [ 'success', 'error' ],
+  responseData: '{\n' +
+    '  "success": false,\n' +
+    '  "error": {\n' +
+    '    "code": "all_proofs_rejected",\n' +
+    '    "message": "All proofs rejected",\n' +
+    '    "details": {\n' +
+    '      "rejected": 1,\n' +
+    '      "errors": [\n' +
+    '        {\n' +
+    '          "proof_index": 0,\n' +
+    '          "error": {\n' +
+    '            "code": "invalid_signature",\n' +
+    '            "message": "Invalid signature"\n' +
+    '          }\n' +
+    '        }\n' +
+    '      ]\n' +
+    '    }\n' +
+    '  }\n' +
+    '}'
 }
 
-stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > Wrapped Response Format (AgentShield API) > should throw validation error if data object missing success field
+stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle wrapped response format
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '7d80184b-5aa3-4a3f-8972-3061ae1c43cd',
+  correlationId: '41b732d8-5fe7-4a3a-a6d0-f29468247738',
   status: 200,
-  statusText: undefined,
-  headers: {},
-  responseTextLength: 191,
-  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.399Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T02:03:18.399Z"}}'
+  statusText: '',
+  headers: { 'content-type': 'application/json' },
+  responseTextLength: 206,
+  responseTextPreview: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.920Z"}}',
+  fullResponseText: '{"success":true,"data":{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}},"metadata":{"requestId":"test-request-id","timestamp":"2025-11-25T04:36:28.920Z"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '7d80184b-5aa3-4a3f-8972-3061ae1c43cd',
+  correlationId: '41b732d8-5fe7-4a3a-a6d0-f29468247738',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'data', 'metadata' ],
   responseData: '{\n' +
     '  "success": true,\n' +
     '  "data": {\n' +
+    '    "success": true,\n' +
     '    "accepted": 1,\n' +
     '    "rejected": 0,\n' +
     '    "outcomes": {\n' +
@@ -1193,13 +1358,14 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '  },\n' +
     '  "metadata": {\n' +
     '    "requestId": "test-request-id",\n' +
-    '    "timestamp": "2025-11-25T02:03:18.399Z"\n' +
+    '    "timestamp": "2025-11-25T04:36:28.920Z"\n' +
     '  }\n' +
     '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
   "data": {
+    "success": true,
     "accepted": 1,
     "rejected": 0,
     "outcomes": {
@@ -1211,12 +1377,12 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   },
   "metadata": {
     "requestId": "test-request-id",
-    "timestamp": "2025-11-25T02:03:18.399Z"
+    "timestamp": "2025-11-25T04:36:28.920Z"
   }
 }
 [AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '7d80184b-5aa3-4a3f-8972-3061ae1c43cd',
-  dataKeys: [ 'accepted', 'rejected', 'outcomes' ],
+  correlationId: '41b732d8-5fe7-4a3a-a6d0-f29468247738',
+  dataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   hasAccepted: true,
   hasRejected: true,
   hasOutcomes: true,
@@ -1230,6 +1396,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
   errorsType: 'undefined',
   errorsIsArray: false,
   fullData: '{\n' +
+    '  "success": true,\n' +
     '  "accepted": 1,\n' +
     '  "rejected": 0,\n' +
     '  "outcomes": {\n' +
@@ -1241,7 +1408,7 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 [AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '7d80184b-5aa3-4a3f-8972-3061ae1c43cd',
+  correlationId: '41b732d8-5fe7-4a3a-a6d0-f29468247738',
   dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   hasSuccess: true,
   successValue: true,
@@ -1264,347 +1431,162 @@ stderr | src/services/__tests__/access-control.proof-response-validation.test.ts
     '}'
 }
 
-stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should correctly extract data from wrapped response after JSON deep clone
+ ✓ src/services/__tests__/storage.service.test.ts (17 tests) 18ms
+stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '47ea7dc9-4568-4db4-b6ba-95b4d5e80089',
+  correlationId: '41208dc0-279a-46a9-a275-856b68c89e4f',
   status: 200,
-  statusText: undefined,
-  headers: {},
-  responseTextLength: 191,
-  responseTextPreview: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1},"errors":[]},"metadata":{"requestId":"fc1fa88f-9b22-4161-b4fd-17d8215098ee","timestamp":"2025-11-24T21:36:33.029Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":1,"rejected":0,"outcomes":{"success":1},"errors":[]},"metadata":{"requestId":"fc1fa88f-9b22-4161-b4fd-17d8215098ee","timestamp":"2025-11-24T21:36:33.029Z"}}'
+  statusText: '',
+  headers: { 'content-type': 'application/json' },
+  responseTextLength: 42,
+  responseTextPreview: '{"success":true,"accepted":1,"rejected":0}',
+  fullResponseText: '{"success":true,"accepted":1,"rejected":0}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '47ea7dc9-4568-4db4-b6ba-95b4d5e80089',
+  correlationId: '41208dc0-279a-46a9-a275-856b68c89e4f',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'data', 'metadata' ],
-  responseData: '{\n' +
-    '  "success": true,\n' +
-    '  "data": {\n' +
-    '    "accepted": 1,\n' +
-    '    "rejected": 0,\n' +
-    '    "outcomes": {\n' +
-    '      "success": 1\n' +
-    '    },\n' +
-    '    "errors": []\n' +
-    '  },\n' +
-    '  "metadata": {\n' +
-    '    "requestId": "fc1fa88f-9b22-4161-b4fd-17d8215098ee",\n' +
-    '    "timestamp": "2025-11-24T21:36:33.029Z"\n' +
-    '  }\n' +
-    '}'
+  responseDataKeys: [ 'success', 'accepted', 'rejected' ],
+  responseData: '{\n  "success": true,\n  "accepted": 1,\n  "rejected": 0\n}'
 }
 [AccessControl] Raw response received: {
   "success": true,
-  "data": {
-    "accepted": 1,
-    "rejected": 0,
-    "outcomes": {
-      "success": 1
-    },
-    "errors": []
-  },
-  "metadata": {
-    "requestId": "fc1fa88f-9b22-4161-b4fd-17d8215098ee",
-    "timestamp": "2025-11-24T21:36:33.029Z"
-  }
-}
-[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '47ea7dc9-4568-4db4-b6ba-95b4d5e80089',
-  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
-  hasAccepted: true,
-  hasRejected: true,
-  hasOutcomes: true,
-  hasErrors: true,
-  acceptedType: 'number',
-  acceptedValue: 1,
-  rejectedType: 'number',
-  rejectedValue: 0,
-  outcomesType: 'object',
-  outcomesValue: { success: 1 },
-  errorsType: 'object',
-  errorsIsArray: true,
-  fullData: '{\n' +
-    '  "accepted": 1,\n' +
-    '  "rejected": 0,\n' +
-    '  "outcomes": {\n' +
-    '    "success": 1\n' +
-    '  },\n' +
-    '  "errors": []\n' +
-    '}'
-}
-[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '47ea7dc9-4568-4db4-b6ba-95b4d5e80089',
-  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
-  hasSuccess: true,
-  successValue: true,
-  hasAccepted: true,
-  acceptedValue: 1,
-  hasRejected: true,
-  rejectedValue: 0,
-  hasOutcomes: true,
-  outcomesValue: { success: 1 },
-  fullDataWithSuccess: '{\n' +
-    '  "success": true,\n' +
-    '  "accepted": 1,\n' +
-    '  "rejected": 0,\n' +
-    '  "outcomes": {\n' +
-    '    "success": 1\n' +
-    '  },\n' +
-    '  "errors": []\n' +
-    '}'
+  "accepted": 1,
+  "rejected": 0
 }
 
-stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should handle response where data fields are numeric values (not undefined)
+stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: '94685d71-0f50-46e3-a370-9b5121ba7b7b',
+  correlationId: '7f533deb-63b3-47a6-adb6-f9c4e5d3f9e3',
   status: 200,
-  statusText: undefined,
-  headers: {},
-  responseTextLength: 151,
-  responseTextPreview: '{"success":true,"data":{"accepted":0,"rejected":0,"outcomes":{},"errors":[]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T02:03:18.404Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":0,"rejected":0,"outcomes":{},"errors":[]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T02:03:18.404Z"}}'
+  statusText: '',
+  headers: { 'content-type': 'application/json' },
+  responseTextLength: 100,
+  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}',
+  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: '94685d71-0f50-46e3-a370-9b5121ba7b7b',
+  correlationId: '7f533deb-63b3-47a6-adb6-f9c4e5d3f9e3',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'data', 'metadata' ],
+  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
   responseData: '{\n' +
     '  "success": true,\n' +
-    '  "data": {\n' +
-    '    "accepted": 0,\n' +
-    '    "rejected": 0,\n' +
-    '    "outcomes": {},\n' +
-    '    "errors": []\n' +
-    '  },\n' +
-    '  "metadata": {\n' +
-    '    "requestId": "test-id",\n' +
-    '    "timestamp": "2025-11-25T02:03:18.404Z"\n' +
+    '  "accepted": 1,\n' +
+    '  "rejected": 0,\n' +
+    '  "outcomes": {\n' +
+    '    "success": 1,\n' +
+    '    "failed": 0,\n' +
+    '    "blocked": 0,\n' +
+    '    "error": 0\n' +
     '  }\n' +
     '}'
 }
 [AccessControl] Raw response received: {
   "success": true,
-  "data": {
-    "accepted": 0,
-    "rejected": 0,
-    "outcomes": {},
-    "errors": []
-  },
-  "metadata": {
-    "requestId": "test-id",
-    "timestamp": "2025-11-25T02:03:18.404Z"
+  "accepted": 1,
+  "rejected": 0,
+  "outcomes": {
+    "success": 1,
+    "failed": 0,
+    "blocked": 0,
+    "error": 0
   }
 }
-[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: '94685d71-0f50-46e3-a370-9b5121ba7b7b',
-  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
-  hasAccepted: true,
-  hasRejected: true,
-  hasOutcomes: true,
-  hasErrors: true,
-  acceptedType: 'number',
-  acceptedValue: 0,
-  rejectedType: 'number',
-  rejectedValue: 0,
-  outcomesType: 'object',
-  outcomesValue: {},
-  errorsType: 'object',
-  errorsIsArray: true,
-  fullData: '{\n  "accepted": 0,\n  "rejected": 0,\n  "outcomes": {},\n  "errors": []\n}'
+
+stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle response with missing outcomes field (outcomes is optional)
+[AccessControl] 🔍 RAW API RESPONSE (before parsing): {
+  correlationId: 'f47f75d0-f98c-4f33-834c-1fb71807d14f',
+  status: 200,
+  statusText: '',
+  headers: { 'content-type': 'application/json' },
+  responseTextLength: 56,
+  responseTextPreview: '{"success":true,"accepted":1,"rejected":0,"outcomes":{}}',
+  fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{}}'
 }
-[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: '94685d71-0f50-46e3-a370-9b5121ba7b7b',
-  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
-  hasSuccess: true,
-  successValue: true,
-  hasAccepted: true,
-  acceptedValue: 0,
-  hasRejected: true,
-  rejectedValue: 0,
-  hasOutcomes: true,
-  outcomesValue: {},
-  fullDataWithSuccess: '{\n' +
-    '  "success": true,\n' +
-    '  "accepted": 0,\n' +
-    '  "rejected": 0,\n' +
-    '  "outcomes": {},\n' +
-    '  "errors": []\n' +
-    '}'
+[AccessControl] 🔍 PARSED RESPONSE DATA: {
+  correlationId: 'f47f75d0-f98c-4f33-834c-1fb71807d14f',
+  status: 200,
+  responseDataType: 'object',
+  responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
+  responseData: '{\n  "success": true,\n  "accepted": 1,\n  "rejected": 0,\n  "outcomes": {}\n}'
+}
+[AccessControl] Raw response received: {
+  "success": true,
+  "accepted": 1,
+  "rejected": 0,
+  "outcomes": {}
 }
 
-stderr | src/services/__tests__/access-control.proof-response-validation.test.ts > Proof Submission Response Validation > JSON Deep Clone Fix (Cloudflare Workers Edge Case) > should handle response with nested outcomes object
+stderr | src/services/__tests__/access-control.service.test.ts > AccessControlApiService > submitProofs > should handle wrapped response with invalid data structure
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'af8f9fe9-2667-4bda-b9fe-e79ab4eda6f5',
+  correlationId: '2ed76f41-6cb3-4cad-a2e5-25ed120a131f',
   status: 200,
-  statusText: undefined,
-  headers: {},
-  responseTextLength: 278,
-  responseTextPreview: '{"success":true,"data":{"accepted":3,"rejected":2,"outcomes":{"success":1,"failed":1,"blocked":1,"error":2},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Invalid signature"}}]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T02:03:18.404Z"}}',
-  fullResponseText: '{"success":true,"data":{"accepted":3,"rejected":2,"outcomes":{"success":1,"failed":1,"blocked":1,"error":2},"errors":[{"proof_index":0,"error":{"code":"validation_error","message":"Invalid signature"}}]},"metadata":{"requestId":"test-id","timestamp":"2025-11-25T02:03:18.404Z"}}'
+  statusText: '',
+  headers: { 'content-type': 'application/json' },
+  responseTextLength: 52,
+  responseTextPreview: '{"success":true,"data":{"message":"Invalid format"}}',
+  fullResponseText: '{"success":true,"data":{"message":"Invalid format"}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'af8f9fe9-2667-4bda-b9fe-e79ab4eda6f5',
+  correlationId: '2ed76f41-6cb3-4cad-a2e5-25ed120a131f',
   status: 200,
   responseDataType: 'object',
-  responseDataKeys: [ 'success', 'data', 'metadata' ],
-  responseData: '{\n' +
-    '  "success": true,\n' +
-    '  "data": {\n' +
-    '    "accepted": 3,\n' +
-    '    "rejected": 2,\n' +
-    '    "outcomes": {\n' +
-    '      "success": 1,\n' +
-    '      "failed": 1,\n' +
-    '      "blocked": 1,\n' +
-    '      "error": 2\n' +
-    '    },\n' +
-    '    "errors": [\n' +
-    '      {\n' +
-    '        "proof_index": 0,\n' +
-    '        "error": {\n' +
-    '          "code": "validation_error",\n' +
-    '          "message": "Invalid signature"\n' +
-    '        }\n' +
-    '      }\n' +
-    '    ]\n' +
-    '  },\n' +
-    '  "metadata": {\n' +
-    '    "requestId": "test-id",\n' +
-    '    "timestamp": "2025-11-25T02:03:18.404Z"\n' +
-    '  }\n' +
-    '}'
+  responseDataKeys: [ 'success', 'data' ],
+  responseData: '{\n  "success": true,\n  "data": {\n    "message": "Invalid format"\n  }\n}'
 }
 [AccessControl] Raw response received: {
   "success": true,
   "data": {
-    "accepted": 3,
-    "rejected": 2,
-    "outcomes": {
-      "success": 1,
-      "failed": 1,
-      "blocked": 1,
-      "error": 2
-    },
-    "errors": [
-      {
-        "proof_index": 0,
-        "error": {
-          "code": "validation_error",
-          "message": "Invalid signature"
-        }
-      }
-    ]
-  },
-  "metadata": {
-    "requestId": "test-id",
-    "timestamp": "2025-11-25T02:03:18.404Z"
+    "message": "Invalid format"
   }
 }
 [AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone): {
-  correlationId: 'af8f9fe9-2667-4bda-b9fe-e79ab4eda6f5',
-  dataKeys: [ 'accepted', 'rejected', 'outcomes', 'errors' ],
-  hasAccepted: true,
-  hasRejected: true,
-  hasOutcomes: true,
-  hasErrors: true,
-  acceptedType: 'number',
-  acceptedValue: 3,
-  rejectedType: 'number',
-  rejectedValue: 2,
-  outcomesType: 'object',
-  outcomesValue: { success: 1, failed: 1, blocked: 1, error: 2 },
-  errorsType: 'object',
-  errorsIsArray: true,
-  fullData: '{\n' +
-    '  "accepted": 3,\n' +
-    '  "rejected": 2,\n' +
-    '  "outcomes": {\n' +
-    '    "success": 1,\n' +
-    '    "failed": 1,\n' +
-    '    "blocked": 1,\n' +
-    '    "error": 2\n' +
-    '  },\n' +
-    '  "errors": [\n' +
-    '    {\n' +
-    '      "proof_index": 0,\n' +
-    '      "error": {\n' +
-    '        "code": "validation_error",\n' +
-    '        "message": "Invalid signature"\n' +
-    '      }\n' +
-    '    }\n' +
-    '  ]\n' +
-    '}'
-}
-[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
-  correlationId: 'af8f9fe9-2667-4bda-b9fe-e79ab4eda6f5',
-  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
-  hasSuccess: true,
-  successValue: true,
-  hasAccepted: true,
-  acceptedValue: 3,
-  hasRejected: true,
-  rejectedValue: 2,
-  hasOutcomes: true,
-  outcomesValue: { success: 1, failed: 1, blocked: 1, error: 2 },
-  fullDataWithSuccess: '{\n' +
-    '  "success": true,\n' +
-    '  "accepted": 3,\n' +
-    '  "rejected": 2,\n' +
-    '  "outcomes": {\n' +
-    '    "success": 1,\n' +
-    '    "failed": 1,\n' +
-    '    "blocked": 1,\n' +
-    '    "error": 2\n' +
-    '  },\n' +
-    '  "errors": [\n' +
-    '    {\n' +
-    '      "proof_index": 0,\n' +
-    '      "error": {\n' +
-    '        "code": "validation_error",\n' +
-    '        "message": "Invalid signature"\n' +
-    '      }\n' +
-    '    }\n' +
-    '  ]\n' +
-    '}'
+  correlationId: '2ed76f41-6cb3-4cad-a2e5-25ed120a131f',
+  dataKeys: [ 'message' ],
+  hasAccepted: false,
+  hasRejected: false,
+  hasOutcomes: false,
+  hasErrors: false,
+  acceptedType: 'undefined',
+  acceptedValue: undefined,
+  rejectedType: 'undefined',
+  rejectedValue: undefined,
+  outcomesType: 'undefined',
+  outcomesValue: undefined,
+  errorsType: 'undefined',
+  errorsIsArray: false,
+  fullData: '{\n  "message": "Invalid format"\n}'
+}
+[AccessControl] 🔍 VALIDATING DATA WITH SUCCESS: {
+  correlationId: '2ed76f41-6cb3-4cad-a2e5-25ed120a131f',
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected' ],
+  hasSuccess: true,
+  successValue: true,
+  hasAccepted: true,
+  acceptedValue: undefined,
+  hasRejected: true,
+  rejectedValue: undefined,
+  hasOutcomes: false,
+  outcomesValue: undefined,
+  fullDataWithSuccess: '{\n  "success": true\n}'
+}
+[AccessControl] ❌ MISSING REQUIRED FIELDS AFTER CONSTRUCTION: {
+  correlationId: '2ed76f41-6cb3-4cad-a2e5-25ed120a131f',
+  hasAccepted: true,
+  acceptedType: 'undefined',
+  acceptedValue: undefined,
+  hasRejected: true,
+  rejectedType: 'undefined',
+  rejectedValue: undefined,
+  dataWithSuccessKeys: [ 'success', 'accepted', 'rejected' ],
+  fullDataWithSuccess: '{\n  "success": true\n}',
+  dataToValidateKeys: [ 'message' ],
+  fullDataToValidate: '{\n  "message": "Invalid format"\n}',
+  originalResponseData: '{\n  "success": true,\n  "data": {\n    "message": "Invalid format"\n  }\n}'
 }
 
- ✓ src/services/__tests__/access-control.service.test.ts (23 tests) 52ms
- ✓ src/__tests__/services/tool-protection.service.test.ts (49 tests) 17ms
- ✓ src/__tests__/cache/tool-protection-cache.test.ts (49 tests) 158ms
- ✓ src/services/__tests__/access-control.proof-response-validation.test.ts (12 tests) 32ms
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
-[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
-
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should prefer Redis over KV when both are configured
-[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
-
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should fall back to memory when Redis connection fails
-[StorageService] Failed to connect to Redis, falling back to memory: Redis package not available
-
-stderr | src/services/__tests__/storage.service.test.ts > StorageService > createStorageProviders > should use KV namespace when provided
-[StorageService] Failed to initialize KV, falling back to memory: Failed to import Cloudflare storage providers: Cannot find package '@kya-os/mcp-i-cloudflare/providers/storage' imported from '/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/storage.service.ts'
-
-stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
-[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
- ✓ src/services/__tests__/storage.service.test.ts (17 tests) 34ms
-    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:252:7
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
-
-stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
-[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
-    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:257:9
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
-
- ✓ src/services/__tests__/proof-verifier.integration.test.ts (13 tests | 1 skipped) 119ms
+ ✓ src/services/__tests__/access-control.service.test.ts (23 tests) 25ms
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when no protection required
 [MCP-I] Checking tool protection: {
   tool: 'unprotectedTool',
@@ -1631,8 +1613,8 @@ stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   tool: 'protectedTool',
   requiredScopes: [ 'files:write' ],
   agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_dn7ju0_midxlua6',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_dn7ju0_midxlua6'
+  resumeToken: 'resume_g6quf0_mie32tfw',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_g6quf0_mie32tfw'
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when protection required and delegation provided
@@ -1660,6 +1642,7 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   requiredScopes: [ 'files:write' ]
 }
 
+ ✓ src/delegation/__tests__/vc-verifier.test.ts (35 tests) 49ms
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should allow tool execution when protection required and consentProof provided
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
@@ -1686,6 +1669,7 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
@@ -1694,51 +1678,48 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
+[MCP-I] ❌ Delegation verification FAILED {
+  tool: 'protectedTool',
+  agentDid: 'did:key:zmock123...',
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
+  reason: 'Delegation token expired',
   hasDelegationToken: true,
   hasConsentProof: false,
+  errorCode: undefined,
+  errorMessage: undefined,
+  requiredScopes: [ 'files:write' ]
+}
   requiredScopes: [ 'files:write' ]
 }
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation verification fails
-[MCP-I] ❌ Delegation verification FAILED {
+
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation has wrong scopes
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation has wrong scopes
+[MCP-I] ❌ Delegation verification FAILED {
 [MCP-I] Checking tool protection: {
+  tool: 'protectedTool',
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
 }
-  tool: 'protectedTool',
-  agentDid: 'did:key:zmock123...',
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation has wrong scopes
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
-  reason: 'Delegation token expired',
   tool: 'protectedTool',
-  errorCode: undefined,
-  errorMessage: undefined,
-  requiredScopes: [ 'files:write' ]
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
-}
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
-}
-
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should block tool execution when delegation has wrong scopes
-[MCP-I] ❌ Delegation verification FAILED {
-  tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   reason: 'Insufficient scopes',
+}
   errorCode: undefined,
+
   errorMessage: undefined,
   requiredScopes: [ 'files:write' ]
 }
 
- ✓ src/__tests__/runtime/base.test.ts (55 tests) 12ms
- ✓ src/delegation/__tests__/vc-verifier.test.ts (35 tests) 427ms
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should handle API errors during verification gracefully
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
@@ -1796,85 +1777,61 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
 }
 
 stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should reject delegation when user_identifier does not match session userDid
-[MCP-I] 🔒 SECURITY: User identifier validation FAILED {
-  tool: 'protectedTool',
-  agentDid: 'did:key:zmock123...',
-  delegationUserIdentifier: 'did:key:zUserB987654...',
-  sessionUserDid: 'did:key:zUserA123456...',
-  sessionId: 'session123...',
-  reason: 'user_identifier_mismatch',
-  severity: 'high'
-}
-
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should accept delegation when user_identifier matches session userDid
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
+[MCP-I] 🔒 SECURITY: User identifier validation FAILED {
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should accept delegation when user_identifier matches session userDid
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
+  tool: 'protectedTool',
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
+  agentDid: 'did:key:zmock123...',
+  delegationUserIdentifier: 'did:key:zUserB987654...',
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
+  sessionUserDid: 'did:key:zUserA123456...',
+  sessionId: 'session123...',
+}
+  reason: 'user_identifier_mismatch',
+  severity: 'high'
+
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should accept delegation when user_identifier matches session userDid
 [MCP-I] ✅ User identifier validation PASSED {
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
-[MCP-I] ⚠️ Delegation has user_identifier but session missing userDid {
-  tool: 'protectedTool',
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-  delegationUserIdentifier: 'did:key:zUserA123456...',
-  agentDid: 'did:key:zmock123...',
   userDid: 'did:key:zUserA123456...',
   sessionId: 'session123...'
-  sessionId: 'session123...'
 }
 [MCP-I] ✅ Delegation verification SUCCEEDED {
-}
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should not create proof when tool execution is blocked
   delegationId: 'test-delegation-id',
   credentialScopes: [ 'files:write' ],
   requiredScopes: [ 'files:write' ]
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
 }
-  requiredScopes: [ 'files:write' ],
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing user_identifier gracefully (backward compatibility)
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-  agentDid: 'did:key:zmock123...',
   hasDelegation: true
 }
-  resumeToken: 'resume_dn8065_midxluah',
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing user_identifier gracefully (backward compatibility)
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_dn8065_midxluah'
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
-}
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include tool name in error
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegationToken: true,
-  tool: 'protectedTool',
-  requiredScopes: [ 'files:write' ],
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_dn8065_midxluah',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_dn8065_midxluah'
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing user_identifier gracefully (backward compatibility)
@@ -1882,144 +1839,156 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   delegationId: 'test-delegation-id',
-}
   credentialScopes: [ 'files:write' ],
   requiredScopes: [ 'files:write' ]
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include required scopes in error
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: true
 }
 
-  requiredScopes: [ 'files:write', 'files:read' ],
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_dn80p3_midxluai',
 [MCP-I] 🔐 Verifying delegation token with AccessControlApiService {
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite%2Cfiles%3Aread&session_id=session123&agent_did=&resume_token=resume_dn80p3_midxluai'
-}
-
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
+[MCP-I] ⚠️ Delegation has user_identifier but session missing userDid {
   hasDelegationToken: true,
   hasConsentProof: false,
   requiredScopes: [ 'files:write' ]
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include consent URL in error
-}
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
   tool: 'protectedTool',
-  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+}
 
+  delegationUserIdentifier: 'did:key:zUserA123456...',
+  sessionId: 'session123...'
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > user_identifier validation > should handle missing session userDid gracefully
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_dn80p3_midxluai',
 [MCP-I] ✅ Delegation verification SUCCEEDED {
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_dn80p3_midxluai'
+}
+
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   delegationId: 'test-delegation-id',
-}
   credentialScopes: [ 'files:write' ],
   requiredScopes: [ 'files:write' ]
-
 }
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include resume token in error
 
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
-  tool: 'protectedTool',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should create proof after successful tool execution
 [MCP-I] Checking tool protection: {
   tool: 'unprotectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
-  requiredScopes: [ 'files:write' ],
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should create proof after successful tool execution
 [MCP-I] Tool protection check passed (no delegation required) {
-  agentDid: 'did:key:zmock123...',
   tool: 'unprotectedTool',
   agentDid: 'did:key:zmock123...',
   reason: 'Tool not configured to require delegation'
 }
 
-  resumeToken: 'resume_dn80p3_midxluai',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_dn80p3_midxluai'
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should not create proof when tool execution is blocked
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
-}
   hasDelegation: false
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > processToolCall with tool protection > should not create proof when tool execution is blocked
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_g6qtp6_mie32tg4',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_g6qtp6_mie32tg4'
+}
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include tool name in error
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include tool name in error
   hasDelegation: false
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include intercepted call context in error
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
 }
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
   tool: 'protectedTool',
+
   requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_g6qtob_mie32tg5',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_g6qtob_mie32tg5'
+}
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include required scopes in error
-  agentDid: 'did:key:zmock123...',
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
-  resumeToken: 'resume_tty7xe_midxluai',
   agentDid: 'did:key:zmock123...',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_tty7xe_midxluai'
-}
   hasDelegation: false
-
 }
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle empty required scopes array
 
-stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include consent URL in error
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include required scopes in error
 [MCP-I] BLOCKED: Tool requires delegation but none provided {
   tool: 'protectedTool',
+stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include consent URL in error
 [MCP-I] Checking tool protection: {
-  tool: 'protectedTool',
+  requiredScopes: [ 'files:write', 'files:read' ],
   agentDid: 'did:key:zmock123...',
-  requiredScopes: [],
+  tool: 'protectedTool',
+  resumeToken: 'resume_g6qtob_mie32tg5',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite%2Cfiles%3Aread&session_id=session123&agent_did=&resume_token=resume_g6qtob_mie32tg5'
   agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_dn80qt_midxluak',
+}
   hasDelegation: false
 }
 
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=&session_id=session123&agent_did=&resume_token=resume_dn80qt_midxluak'
+
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include resume token in error
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include consent URL in error
+  agentDid: 'did:key:zmock123...',
+  hasDelegation: false
+}
+
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [ 'files:write' ],
   agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_g6qtob_mie32tg5',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_g6qtob_mie32tg5'
 }
-  hasDelegation: false
+
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include resume token in error
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_g6qtob_mie32tg5',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_g6qtob_mie32tg5'
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include intercepted call context in error
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > DelegationRequiredError details > should include intercepted call context in error
 [MCP-I] Checking tool protection: {
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
+  tool: 'protectedTool',
   hasDelegation: false
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_mg0_mie32tg5',
+}
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=session123&agent_did=&resume_token=resume_mg0_mie32tg5'
 }
 
 
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle multiple required scopes
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > audit logging > should log tool protection check when audit enabled
 [MCP-I] Checking tool protection: {
   tool: 'testTool',
-  tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
 }
@@ -2028,7 +1997,6 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
 [MCP-I] Tool protection check passed (no delegation required) {
   tool: 'testTool',
   agentDid: 'did:key:zmock123...',
-  requiredScopes: [ 'scope1', 'scope2', 'scope3' ],
   reason: 'Tool not configured to require delegation'
 }
 
@@ -2039,29 +2007,17 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   hasDelegation: false
 }
 
-  agentDid: 'did:key:zmock123...',
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > tool protection service integration > should use agent DID from identity for protection check
 [MCP-I] Checking tool protection: {
   tool: 'testTool',
   agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_dn80qt_midxluak',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=scope1%2Cscope2%2Cscope3&session_id=session123&agent_did=&resume_token=resume_dn80qt_midxluak'
-}
-
-stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle session without id
   hasDelegation: false
-[MCP-I] BLOCKED: Tool requires delegation but none provided {
 }
-  tool: 'protectedTool',
 
-  requiredScopes: [ 'files:write' ],
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > tool protection service integration > should use agent DID from identity for protection check
 [MCP-I] Tool protection check passed (no delegation required) {
-  agentDid: 'did:key:zmock123...',
-  resumeToken: 'resume_qpa15j_midxluak',
   tool: 'testTool',
   agentDid: 'did:key:zmock123...',
-  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=&agent_did=&resume_token=resume_qpa15j_midxluak'
   reason: 'Tool not configured to require delegation'
 }
 
@@ -2079,13 +2035,29 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   hasDelegation: false
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle empty required scopes array
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_g6qt3n_mie32tg8',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=&session_id=session123&agent_did=&resume_token=resume_g6qt3n_mie32tg8'
+}
+
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle multiple required scopes
 [MCP-I] Checking tool protection: {
-}
   tool: 'protectedTool',
   agentDid: 'did:key:zmock123...',
   hasDelegation: false
+}
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle multiple required scopes
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [ 'scope1', 'scope2', 'scope3' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_g6qt3n_mie32tg8',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=scope1%2Cscope2%2Cscope3&session_id=session123&agent_did=&resume_token=resume_g6qt3n_mie32tg8'
 }
 
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle session without id
@@ -2095,6 +2067,15 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
   hasDelegation: false
 }
 
+stderr | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle session without id
+[MCP-I] BLOCKED: Tool requires delegation but none provided {
+  tool: 'protectedTool',
+  requiredScopes: [ 'files:write' ],
+  agentDid: 'did:key:zmock123...',
+  resumeToken: 'resume_34osox_mie32tg8',
+  consentUrl: 'https://kya.vouched.id/bouncer/consent?tool=protectedTool&scopes=files%3Awrite&session_id=&agent_did=&resume_token=resume_34osox_mie32tg8'
+}
+
 stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntimeBase - Tool Protection Enforcement > edge cases > should handle handler errors independently of protection
 [MCP-I] Checking tool protection: {
   tool: 'errorTool',
@@ -2111,7 +2092,7 @@ stdout | src/__tests__/runtime/tool-protection-enforcement.test.ts > MCPIRuntime
 
 stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Submission Flow > should submit proof end-to-end
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'b0757e1e-53f0-4144-b6fa-be15e227a789',
+  correlationId: '21f5c657-4a2d-4c29-a993-83645b4c4aa8',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -2120,7 +2101,7 @@ stderr | src/services/__tests__/access-control.integration.test.ts > AccessContr
   fullResponseText: '{"success":true,"accepted":1,"rejected":0,"outcomes":{"success":1,"failed":0,"blocked":0,"error":0}}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'b0757e1e-53f0-4144-b6fa-be15e227a789',
+  correlationId: '21f5c657-4a2d-4c29-a993-83645b4c4aa8',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes' ],
@@ -2150,7 +2131,7 @@ stderr | src/services/__tests__/access-control.integration.test.ts > AccessContr
 
 stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Submission Flow > should handle proof submission with errors
 [AccessControl] 🔍 RAW API RESPONSE (before parsing): {
-  correlationId: 'e61391a3-0c82-4bb5-9850-5d0b24483ebc',
+  correlationId: 'b485e7b1-a702-490a-9211-113cd960c835',
   status: 200,
   statusText: '',
   headers: { 'content-type': 'application/json' },
@@ -2159,7 +2140,7 @@ stderr | src/services/__tests__/access-control.integration.test.ts > AccessContr
   fullResponseText: '{"success":true,"accepted":0,"rejected":1,"outcomes":{"success":0,"failed":1,"blocked":0,"error":0},"errors":[{"proof_index":0,"error":{"code":"invalid_signature","message":"Invalid JWS signature"}}]}'
 }
 [AccessControl] 🔍 PARSED RESPONSE DATA: {
-  correlationId: 'e61391a3-0c82-4bb5-9850-5d0b24483ebc',
+  correlationId: 'b485e7b1-a702-490a-9211-113cd960c835',
   status: 200,
   responseDataType: 'object',
   responseDataKeys: [ 'success', 'accepted', 'rejected', 'outcomes', 'errors' ],
@@ -2208,10 +2189,43 @@ stderr | src/services/__tests__/access-control.integration.test.ts > AccessContr
 stderr | src/services/__tests__/access-control.integration.test.ts > AccessControlApiService Integration > Proof Verification Flow > should verify proof using ProofVerifier
 [CryptoService] Key ID mismatch
 
- ✓ src/__tests__/runtime/tool-protection-enforcement.test.ts (29 tests) 19ms
- ✓ src/__tests__/runtime/route-interception.test.ts (21 tests) 26ms
- ✓ src/delegation/__tests__/vc-issuer.test.ts (21 tests) 244ms
+ ✓ src/__tests__/runtime/tool-protection-enforcement.test.ts (29 tests) 18ms
+ ✓ src/__tests__/runtime/base.test.ts (55 tests) 21ms
+stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
+[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
+    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:252:7
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
+
+ ✓ src/__tests__/runtime/route-interception.test.ts (21 tests) 37ms
+stderr | src/services/__tests__/proof-verifier.integration.test.ts > ProofVerifier Integration - Real DID Resolution > did:web Resolution (HTTP) > should handle HTTP errors gracefully
+[ProofVerifier] Failed to fetch public key from DID: Error: Failed to resolve did:web:nonexistent-domain-that-does-not-exist-12345.com: fetch failed
+    at Object.resolveDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:143:19)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at ProofVerifier.fetchPublicKeyFromDID (/Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/proof-verifier.ts:348:22)
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.integration.test.ts:257:9
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
+
+ ✓ src/services/__tests__/proof-verifier.integration.test.ts (13 tests | 1 skipped) 51ms
+ ✓ src/delegation/__tests__/vc-issuer.test.ts (21 tests) 73ms
+ ✓ src/__tests__/cache/tool-protection-cache.test.ts (49 tests) 161ms
+stderr | src/services/__tests__/proof-verifier.test.ts > ProofVerifier Security > Signature Verification > should handle signature verification errors gracefully
+[CryptoService] Ed25519 verification error: Error: Crypto error
+    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.test.ts:328:9
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
+    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
+    at new Promise (<anonymous>)
+    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
+    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
+    at processTicksAndRejections (node:internal/process/task_queues:103:5)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
+
  ✓ src/services/__tests__/access-control.integration.test.ts (9 tests) 127ms
+ ✓ src/services/__tests__/proof-verifier.test.ts (21 tests) 10ms
 stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyEd25519 > should return false on verification error
 [CryptoService] Ed25519 verification error: Error: Verification failed
     at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/crypto.service.test.ts:62:9
@@ -2369,213 +2383,233 @@ stderr | src/services/__tests__/crypto.service.test.ts > CryptoService > verifyJ
     at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
     at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
 
- ✓ src/services/__tests__/crypto.service.test.ts (34 tests) 10ms
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 0,
-  protectedTools: [],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 1000,
-  cacheExpiresAt: '2025-11-25T02:03:20.103Z'
-}
+ ✓ src/services/__tests__/crypto.service.test.ts (34 tests) 17ms
+stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zzlTmsym8amRj3DNMhOo3twOxAu3u59U6","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389100,"timestampFormatted":"2025-11-25T04:36:29.100Z"}
 
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle typical e-commerce tool protection config
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 4,
-  protectedTools: [ 'add_to_cart', 'checkout' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.104Z'
-}
+stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
+[AUDIT] {"event":"tool_executed","data":{"tool":"greetingTool","sessionId":"e90bb267e09d4eb43fedc8545d1f057f","timestamp":1764045389100},"timestamp":1764045389100,"timestampFormatted":"2025-11-25T04:36:29.100Z"}
 
-stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle concurrent requests
-stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle API rate limiting gracefully
+stdout | src/__tests__/integration.test.ts > Integration Tests > Session expiry handling > should handle expired sessions correctly
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:znW8FxVXFbPX9FsXhtuRN3bCCyrVEHCRG","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389107,"timestampFormatted":"2025-11-25T04:36:29.107Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zSocCoOPg5WZ5JH_TlazzQJILBgH935zv","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389107,"timestampFormatted":"2025-11-25T04:36:29.107Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
+[AUDIT] {"event":"keys_rotated","data":{"oldDid":"did:key:zSocCoOPg5WZ5JH_TlazzQJILBgH935zv","newDid":"did:key:zQU9nAMfD2b7GKr4TLiMPEqKFwJOA9T2T","timestamp":1764045389107},"timestamp":1764045389107,"timestampFormatted":"2025-11-25T04:36:29.107Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Well-known endpoints > should provide identity discovery endpoints
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zp7mczVDzQq4erx-Qkm3DbT08liM9qp_1","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389107,"timestampFormatted":"2025-11-25T04:36:29.107Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Nonce replay protection > should prevent nonce reuse
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zBEJ1wpIgd8j_7TTJww0nJYe-stmKdaDp","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389108,"timestampFormatted":"2025-11-25T04:36:29.108Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle network errors gracefully
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zbs439gV8WaC5q-Dca6qYzameq-ul4PX1","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389108,"timestampFormatted":"2025-11-25T04:36:29.108Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle malformed DID documents
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:z_-oLIt-mQgj64UFtmqWpvjq0LH9m23Wn","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389108,"timestampFormatted":"2025-11-25T04:36:29.108Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should provide debug information in development
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zQG1rWVkElk5gpgPd5IBGjpk6QwF8GaZw","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389108,"timestampFormatted":"2025-11-25T04:36:29.108Z"}
+
+stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should be disabled in production
+[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zioIzymBXdI1Lr6twXTIvEP4nMbrUL06g","environment":"development","userDidGeneration":"disabled"},"timestamp":1764045389108,"timestampFormatted":"2025-11-25T04:36:29.108Z"}
+
+ ✓ src/__tests__/runtime/proof-client-did.test.ts (17 tests) 6ms
+ ✓ src/__tests__/integration.test.ts (9 tests) 9ms
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should allow unprotected tool calls
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-[ToolProtectionService] API fetch failed, using fallback config {
-  protectedTools: [ 'tool1' ],
+  protectedTools: [],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.105Z'
-}
-[ToolProtectionService] Config loaded from API {
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-  error: 'Failed to fetch bouncer config: 429 Too Many Requests - Rate limit exceeded'
+  cacheExpiresAt: '2025-11-25T04:41:29.115Z'
 }
 
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.105Z'
-}
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  protectedTools: [ 'checkout' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.105Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.116Z'
 }
 
- ✓ src/__tests__/services/agentshield-integration.test.ts (30 tests) 1116ms
-       ✓ should respect cache TTL  1101ms
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should parse oauthProvider from camelCase field
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'read_repos', 'send_email' ],
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
+[ToolProtectionService] Protection check {
+  tool: 'checkout',
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.641Z'
+  found: true,
+  isWildcard: false,
+  requiresDelegation: true,
+  availableTools: [ 'checkout' ]
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should parse oauthProvider from snake_case field
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should fetch tool protection config from AgentShield
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'read_repos' ],
+  protectedTools: [ 'protected_tool' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.643Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.117Z'
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should prefer camelCase over snake_case when both present
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should cache tool protection config
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'read_repos' ],
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.643Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.118Z'
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should handle missing oauthProvider field (backward compatible)
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'read_repos' ],
-  agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.644Z'
-}
+stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should use fallback config when API fails
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should parse oauthProvider from array format with camelCase
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'read_repos', 'send_email' ],
+stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle tool protection service errors gracefully
+[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.644Z'
+  error: 'Network error',
+  cacheKey: 'config:tool-protections:test-project'
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should parse oauthProvider from array format with snake_case
+stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle network timeouts
+[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
+
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should share cache across multiple service instances
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'read_repos' ],
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.644Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.119Z'
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should prefer camelCase over snake_case in array format
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'read_repos' ],
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.645Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.119Z'
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should parse oauthProvider from object format with camelCase
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'read_repos', 'send_email' ],
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.645Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.119Z'
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should parse oauthProvider from object format with snake_case
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'read_repos' ],
+  toolCount: 3,
+  protectedTools: [ 'add_to_cart', 'checkout' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.645Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.120Z'
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should prefer camelCase over snake_case in object format
-[ToolProtectionService] Config loaded from API {
-  source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'read_repos' ],
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
+[ToolProtectionService] Protection check {
+  tool: 'add_to_cart',
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.645Z'
+  found: true,
+  isWildcard: false,
+  requiresDelegation: true,
+  availableTools: [ 'search_products', 'add_to_cart', 'checkout' ]
 }
 
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Caching > should cache oauthProvider field correctly
+stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Concurrent operations > should handle concurrent cache operations
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'read_repos' ],
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.645Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.120Z'
 }
-
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > oauthProvider field inclusion > should include oauthProvider in returned ToolProtection objects when present
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'tool_with_provider', 'tool_without_provider' ],
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.646Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.120Z'
 }
-
-stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > oauthProvider field inclusion > should handle empty string oauthProvider gracefully
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool_with_empty_provider' ],
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project-123',
+  projectId: 'test-project',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:19.646Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.120Z'
 }
 
- ✓ src/__tests__/services/tool-protection-oauth-provider.test.ts (14 tests) 6ms
- ✓ src/delegation/__tests__/cascading-revocation.test.ts (23 tests) 14ms
+ ✓ src/__tests__/integration/full-flow.test.ts (21 tests) 11ms
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify gmail → google mapping works
+[ProviderResolver] Inferred provider "google" from scopes
+
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify calendar → google mapping works
+[ProviderResolver] Inferred provider "google" from scopes
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle empty scopes array
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
+
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify outlook → microsoft mapping works
+[ProviderResolver] Inferred provider "microsoft" from scopes
+
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle ambiguous scopes (multiple providers inferred)
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle unknown scope prefixes
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle scopes without colons
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle inferred provider not in registry
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "google" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Fallback behavior (Priority 3 - configuredProvider) > should use configuredProvider when oauthProvider not specified
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Provider name case sensitivity > should handle provider names case-insensitively in inference
+[ProviderResolver] Inferred provider "github" from scopes
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "google" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Multiple scopes with same provider > should handle multiple scopes from same provider
+[ProviderResolver] Inferred provider "github" from scopes
+
+
+stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > configuredProvider behavior (Priority 3) > should use configuredProvider when tool has no oauthProvider
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
+stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > configuredProvider behavior (Priority 3) > should prefer scope-inferred provider over configuredProvider
+[ProviderResolver] Inferred provider "google" from scopes
+
 stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if API request fails
- ✓ src/delegation/__tests__/delegation-graph.test.ts (28 tests) 7ms
 [RemoteConfig] API returned 404: Not Found
 
 stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error handling > should return null if API throws error
@@ -2607,7 +2641,70 @@ stderr | src/config/__tests__/remote-config.spec.ts > fetchRemoteConfig > Error
     at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
     at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
 
- ✓ src/config/__tests__/remote-config.spec.ts (9 tests) 17ms
+ ✓ src/__tests__/services/provider-resolver-edge-cases.test.ts (25 tests | 1 skipped) 7ms
+ ✓ src/config/__tests__/remote-config.spec.ts (9 tests) 9ms
+ ✓ src/delegation/__tests__/cascading-revocation.test.ts (23 tests) 8ms
+ ✓ src/__tests__/providers/memory.test.ts (34 tests) 11ms
+ ✓ src/__tests__/runtime/base-extensions.test.ts (38 tests) 13ms
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Phase 1 tools (no oauthProvider) > should work with Phase 1 tools that don't specify oauthProvider
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'phase1_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:29.198Z'
+}
+
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools array)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'old_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:29.202Z'
+}
+
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools object)
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'old_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:29.202Z'
+}
+
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > snake_case field names > should still support snake_case field names
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'tool_with_snake_case' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:29.202Z'
+}
+stderr | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > No Regressions > Phase 1 OAuth flow > should still work with Phase 1 OAuth flow (no oauthProvider)
+
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Mixed Phase 1 and Phase 2 tools > should handle mix of Phase 1 and Phase 2 tools in same project
+
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 2,
+  protectedTools: [ 'phase1_tool', 'phase2_tool' ],
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:29.203Z'
+}
+
+ ✓ src/__tests__/regression/phase2-regression.test.ts (12 tests) 7ms
 stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > error handling > should handle storage.get errors gracefully
 [UserDidManager] Storage.get failed, generating new DID: Error: Storage error
     at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/__tests__/identity/user-did-manager.test.ts:187:67
@@ -2640,334 +2737,243 @@ stderr | src/__tests__/identity/user-did-manager.test.ts > UserDidManager > erro
     at processTicksAndRejections (node:internal/process/task_queues:103:5)
     at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:20
 
- ✓ src/__tests__/identity/user-did-manager.test.ts (17 tests) 16ms
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle empty scopes array
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle ambiguous scopes (multiple providers inferred)
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle unknown scope prefixes
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify gmail → google mapping works
-[ProviderResolver] Inferred provider "google" from scopes
-
-
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify calendar → google mapping works
-[ProviderResolver] Inferred provider "google" from scopes
-
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should verify outlook → microsoft mapping works
-[ProviderResolver] Inferred provider "microsoft" from scopes
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle scopes without colons
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Scope inference edge cases (Priority 2) > should handle inferred provider not in registry
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "google" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stderr | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Fallback behavior (Priority 3) > should use first configured provider when oauthProvider not specified
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Provider name case sensitivity > should handle provider names case-insensitively in inference
-[ProviderResolver] Inferred provider "github" from scopes
-
-stdout | src/__tests__/services/provider-resolver-edge-cases.test.ts > ProviderResolver - Edge Cases > Multiple scopes with same provider > should handle multiple scopes from same provider
-[ProviderResolver] Inferred provider "github" from scopes
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:z8Xdp-axN3zU9GmCG5LGfsdZLtE3F4DL0","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200304,"timestampFormatted":"2025-11-25T02:03:20.304Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Full handshake and tool execution flow > should complete full authentication and tool execution cycle
-[AUDIT] {"event":"tool_executed","data":{"tool":"greetingTool","sessionId":"b65e33431798a6e337b3e9a5105ecea2","timestamp":1764036200304},"timestamp":1764036200304,"timestampFormatted":"2025-11-25T02:03:20.304Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Session expiry handling > should handle expired sessions correctly
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:z9c-J7N1-_M37saSMwyua-UMc1mm7M7t4","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200308,"timestampFormatted":"2025-11-25T02:03:20.308Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zpho3f1zoie21ALskDupul9kRpNfTwSrf","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200308,"timestampFormatted":"2025-11-25T02:03:20.308Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Key rotation flow > should handle key rotation and maintain functionality
-[AUDIT] {"event":"keys_rotated","data":{"oldDid":"did:key:zpho3f1zoie21ALskDupul9kRpNfTwSrf","newDid":"did:key:zItjqP4O5vmfsEEFBB7dSDhFFWHs6vVOy","timestamp":1764036200308},"timestamp":1764036200308,"timestampFormatted":"2025-11-25T02:03:20.308Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Well-known endpoints > should provide identity discovery endpoints
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zW_Tw4RCaHv0YuOXrtJAV-3p9WIruL_ex","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200310,"timestampFormatted":"2025-11-25T02:03:20.310Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Nonce replay protection > should prevent nonce reuse
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zabmMWzbVTuhvY9lXJA52n_Oaq2GKn1JF","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200311,"timestampFormatted":"2025-11-25T02:03:20.311Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle network errors gracefully
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zYFbJRcSqNL0Igwnt41BmYTXCf3aJJycy","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200311,"timestampFormatted":"2025-11-25T02:03:20.311Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Error handling > should handle malformed DID documents
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zwCRcxASWeJSETmKu7oiUK28xtMni4N85","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200311,"timestampFormatted":"2025-11-25T02:03:20.311Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should provide debug information in development
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zMR7xNtisyHVcHgwhaQaE_bVz5lRouB9M","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200311,"timestampFormatted":"2025-11-25T02:03:20.311Z"}
-
-stdout | src/__tests__/integration.test.ts > Integration Tests > Debug endpoint > should be disabled in production
-[AUDIT] {"event":"runtime_initialized","data":{"did":"did:key:zjbz8BUiYI17Kg8ojojYlSlZXrOjn36S2","environment":"development","userDidGeneration":"disabled"},"timestamp":1764036200311,"timestampFormatted":"2025-11-25T02:03:20.311Z"}
-
-stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should use fallback config when API fails
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network error' }
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should allow unprotected tool calls
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should parse oauthProvider from camelCase field
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [],
+  toolCount: 2,
+  protectedTools: [ 'read_repos', 'send_email' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-
-  projectId: 'test-project',
-stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle tool protection service errors gracefully
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-[ToolProtectionService] API fetch failed, no fallback, failing closed (deny-all) {
-  cacheExpiresAt: '2025-11-25T02:08:20.309Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.213Z'
 }
-  agentDid: 'did:key:z6MkhaXgBZDv...',
 
-  error: 'Network error',
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should parse oauthProvider from snake_case field
 [ToolProtectionService] Config loaded from API {
-  cacheKey: 'config:tool-protections:test-project'
   source: 'api',
   toolCount: 1,
-}
-  protectedTools: [ 'checkout' ],
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-
-  projectId: 'test-project',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.310Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.215Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Tool protection enforcement flow > should intercept protected tool calls without delegation
-stderr | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Error handling in full flow > should handle network timeouts
-[ToolProtectionService] Protection check {
-  tool: 'checkout',
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should prefer camelCase over snake_case when both present
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  found: true,
-  isWildcard: false,
-  requiresDelegation: true,
-  availableTools: [ 'checkout' ]
+  projectId: 'test-project-123',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:29.215Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should fetch tool protection config from AgentShield
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > New endpoint format (toolProtections object) > should handle missing oauthProvider field (backward compatible)
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'protected_tool' ],
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-[ToolProtectionService] API fetch failed, using fallback config { agentDid: 'did:key:z6MkhaXgBZDv...', error: 'Network timeout' }
-  cacheExpiresAt: '2025-11-25T02:08:20.310Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.216Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > AgentShield integration flow > should cache tool protection config
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should parse oauthProvider from array format with camelCase
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
-
+  toolCount: 2,
+  protectedTools: [ 'read_repos', 'send_email' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.312Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.216Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should share cache across multiple service instances
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should parse oauthProvider from array format with snake_case
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.313Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.217Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools array) > should prefer camelCase over snake_case in array format
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.313Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.217Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Cache integration in full flow > should clear cache when needed
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should parse oauthProvider from object format with camelCase
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  toolCount: 2,
+  protectedTools: [ 'read_repos', 'send_email' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.313Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.217Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should parse oauthProvider from object format with snake_case
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 3,
-  protectedTools: [ 'add_to_cart', 'checkout' ],
+  toolCount: 1,
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'none',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.314Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.217Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Real-world e-commerce scenario > should handle complete e-commerce flow with tool protection
-[ToolProtectionService] Protection check {
-  tool: 'add_to_cart',
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Old endpoint format (tools object) > should prefer camelCase over snake_case in object format
+[ToolProtectionService] Config loaded from API {
+  source: 'api',
+  toolCount: 1,
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  found: true,
-  isWildcard: false,
-  requiresDelegation: true,
-  availableTools: [ 'search_products', 'add_to_cart', 'checkout' ]
+  projectId: 'none',
+  cacheTtlMs: 300000,
+  cacheExpiresAt: '2025-11-25T04:41:29.217Z'
 }
 
-stdout | src/__tests__/integration/full-flow.test.ts > Full Flow Integration > Concurrent operations > should handle concurrent cache operations
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > Caching > should cache oauthProvider field correctly
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  protectedTools: [ 'read_repos' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.314Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.217Z'
 }
+
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > oauthProvider field inclusion > should include oauthProvider in returned ToolProtection objects when present
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  toolCount: 2,
+  protectedTools: [ 'tool_with_provider', 'tool_without_provider' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.314Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.218Z'
 }
+
+stdout | src/__tests__/services/tool-protection-oauth-provider.test.ts > ToolProtectionService - oauthProvider Parsing > oauthProvider field inclusion > should handle empty string oauthProvider gracefully
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool1' ],
+  protectedTools: [ 'tool_with_empty_provider' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'test-project',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.314Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.218Z'
 }
 
- ✓ src/__tests__/services/provider-resolver-edge-cases.test.ts (19 tests | 1 skipped) 6ms
- ✓ src/__tests__/integration.test.ts (9 tests) 8ms
- ✓ src/__tests__/integration/full-flow.test.ts (21 tests) 10ms
- ✓ src/__tests__/providers/memory.test.ts (34 tests) 11ms
-stderr | src/services/__tests__/proof-verifier.test.ts > ProofVerifier Security > Signature Verification > should handle signature verification errors gracefully
-[CryptoService] Ed25519 verification error: Error: Crypto error
-    at /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core/src/services/__tests__/proof-verifier.test.ts:328:9
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:157:11
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:753:26
-    at file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1636:20
-    at new Promise (<anonymous>)
-    at runWithTimeout (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1602:10)
-    at runTest (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1309:12)
-    at processTicksAndRejections (node:internal/process/task_queues:103:5)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-    at runSuite (file:///Users/dylanhobbs/Documents/@kya-os/xmcp-i/node_modules/.pnpm/@vitest+runner@4.0.5/node_modules/@vitest/runner/dist/index.js:1468:8)
-
- ✓ src/services/__tests__/proof-verifier.test.ts (21 tests) 36ms
+ ✓ src/__tests__/identity/user-did-manager.test.ts (17 tests) 8ms
+ ✓ src/__tests__/services/tool-protection-oauth-provider.test.ts (14 tests) 6ms
+stderr | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should fall back to configuredProvider for ambiguous scopes
 stdout | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should infer provider from github scope prefix
 [ProviderResolver] Inferred provider "github" from scopes
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
+
 
 stdout | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should infer provider from gmail scope prefix (maps to google)
 [ProviderResolver] Inferred provider "google" from scopes
 
-stderr | src/services/__tests__/provider-resolver.test.ts > ProviderResolver > resolveProvider - Priority 2: Scope inference > should return null for ambiguous scopes
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
+ ✓ src/services/__tests__/provider-resolver.test.ts (8 tests) 7ms
+ ✓ src/compliance/__tests__/schema-verifier.test.ts (30 tests) 4ms
+ ✓ src/__tests__/runtime/delegation-flow.test.ts (4 tests) 3ms
+ ✓ src/delegation/__tests__/bitstring.test.ts (30 tests) 4ms
+ ✓ src/delegation/__tests__/delegation-graph.test.ts (28 tests) 5ms
+ ✓ src/delegation/storage/__tests__/memory-graph-storage.test.ts (27 tests) 4ms
+ ✓ src/__tests__/providers/base.test.ts (14 tests) 10ms
+stderr | src/services/__tests__/provider-resolution.integration.test.ts > Provider Resolution Integration > Backward compatibility > should work with Phase 1 tools (no oauthProvider field)
+[ProviderResolver] Tool does not specify oauthProvider. Using project-configured provider "github" as fallback. Consider explicitly setting oauthProvider in tool protection config.
 
- ✓ src/services/__tests__/provider-resolver.test.ts (8 tests) 8ms
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Phase 1 tools (no oauthProvider) > should work with Phase 1 tools that don't specify oauthProvider
+ ✓ src/services/__tests__/provider-resolution.integration.test.ts (6 tests) 4ms
+ ✓ src/services/__tests__/batch-delegation.service.test.ts (11 tests) 4ms
+ ✓ src/services/__tests__/oauth-provider-registry.test.ts (9 tests) 4ms
+ ✓ src/__tests__/config/provider-runtime-config.test.ts (9 tests) 2ms
+ ✓ src/delegation/__tests__/utils.test.ts (28 tests) 3ms
+ ✓ src/__tests__/runtime/audit-logger.test.ts (9 tests) 2ms
+ ✓ src/delegation/storage/__tests__/memory-statuslist-storage.test.ts (14 tests) 2ms
+ ✓ src/utils/__tests__/did-helpers.test.ts (11 tests) 2ms
+ ✓ src/delegation/__tests__/audience-validator.test.ts (5 tests) 1ms
+ ↓ src/__tests__/delegation-e2e.test.ts (14 tests | 14 skipped)
+ ✓ src/__tests__/index.test.ts (4 tests) 2ms
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Caching Integration > should respect cache TTL
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'phase1_tool' ],
+  toolCount: 0,
+  protectedTools: [],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
-  cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.406Z'
+  projectId: 'test-project-123',
+  cacheTtlMs: 1000,
+  cacheExpiresAt: '2025-11-25T04:36:30.992Z'
 }
 
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools array)
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle typical e-commerce tool protection config
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 1,
-  protectedTools: [ 'old_tool' ],
+  toolCount: 4,
+  protectedTools: [ 'add_to_cart', 'checkout' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.438Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.993Z'
 }
 
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > Old API endpoint format > should still support old endpoint format (tools object)
+stderr | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle API rate limiting gracefully
+[ToolProtectionService] API fetch failed, using fallback config {
+  agentDid: 'did:key:z6MkhaXgBZDv...',
+  error: 'Failed to fetch bouncer config: 429 Too Many Requests - Rate limit exceeded'
+}
+
+stdout | src/__tests__/services/agentshield-integration.test.ts > AgentShield Integration > Real-world Scenarios > should handle concurrent requests
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'old_tool' ],
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
-  projectId: 'none',
+  projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.439Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.993Z'
 }
-stderr | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > No Regressions > Phase 1 OAuth flow > should still work with Phase 1 OAuth flow (no oauthProvider)
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
-
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Backward Compatibility > snake_case field names > should still support snake_case field names
 [ToolProtectionService] Config loaded from API {
   source: 'api',
   toolCount: 1,
-  protectedTools: [ 'tool_with_snake_case' ],
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.439Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.993Z'
 }
-
-stdout | src/__tests__/regression/phase2-regression.test.ts > Phase 2 Regression Tests > Mixed Phase 1 and Phase 2 tools > should handle mix of Phase 1 and Phase 2 tools in same project
 [ToolProtectionService] Config loaded from API {
   source: 'api',
-  toolCount: 2,
-  protectedTools: [ 'phase1_tool', 'phase2_tool' ],
+  toolCount: 1,
+  protectedTools: [ 'tool1' ],
   agentDid: 'did:key:z6MkhaXgBZDv...',
   projectId: 'test-project-123',
   cacheTtlMs: 300000,
-  cacheExpiresAt: '2025-11-25T02:08:20.439Z'
+  cacheExpiresAt: '2025-11-25T04:41:29.993Z'
 }
 
- ✓ src/__tests__/regression/phase2-regression.test.ts (12 tests) 35ms
- ✓ src/__tests__/runtime/proof-client-did.test.ts (17 tests) 21ms
- ✓ src/__tests__/runtime/base-extensions.test.ts (38 tests) 23ms
-stderr | src/services/__tests__/provider-resolution.integration.test.ts > Provider Resolution Integration > Backward compatibility > should work with Phase 1 tools (no oauthProvider field)
-[ProviderResolver] Tool does not specify oauthProvider. Using first configured provider "github" as fallback. This is deprecated - configure oauthProvider in AgentShield dashboard for Phase 2+.
-
- ✓ src/services/__tests__/provider-resolution.integration.test.ts (6 tests) 3ms
- ✓ src/delegation/__tests__/bitstring.test.ts (30 tests) 26ms
- ✓ src/__tests__/providers/base.test.ts (14 tests) 5ms
- ✓ src/delegation/storage/__tests__/memory-graph-storage.test.ts (27 tests) 4ms
- ✓ src/services/__tests__/batch-delegation.service.test.ts (11 tests) 3ms
- ✓ src/compliance/__tests__/schema-verifier.test.ts (30 tests) 4ms
- ✓ src/__tests__/runtime/audit-logger.test.ts (9 tests) 2ms
- ✓ src/__tests__/runtime/delegation-flow.test.ts (4 tests) 3ms
- ✓ src/services/__tests__/oauth-provider-registry.test.ts (9 tests) 3ms
- ✓ src/delegation/__tests__/utils.test.ts (28 tests) 3ms
- ✓ src/delegation/storage/__tests__/memory-statuslist-storage.test.ts (14 tests) 5ms
- ✓ src/utils/__tests__/did-helpers.test.ts (11 tests) 4ms
- ✓ src/__tests__/config/provider-runtime-config.test.ts (9 tests) 2ms
- ✓ src/delegation/__tests__/audience-validator.test.ts (5 tests) 1ms
- ↓ src/__tests__/delegation-e2e.test.ts (14 tests | 14 skipped)
- ✓ src/__tests__/index.test.ts (4 tests) 2ms
+ ✓ src/__tests__/services/agentshield-integration.test.ts (30 tests) 1111ms
+       ✓ should respect cache TTL  1102ms
 
  Test Files  43 passed | 1 skipped (44)
-      Tests  876 passed | 16 skipped (892)
-   Start at  20:03:15
-   Duration  5.44s (transform 10.64s, setup 0ms, collect 18.02s, tests 2.69s, environment 15ms, prepare 2.18s)
+      Tests  882 passed | 16 skipped (898)
+   Start at  22:36:28
+   Duration  1.39s (transform 2.13s, setup 0ms, collect 3.30s, tests 1.92s, environment 3ms, prepare 294ms)