UNEXECUTED SUGGESTION. This prompt did not produce the published evidence.

Review only fixture.py, verify.py, and recorded-run/ in this working directory.
This is an authorized, isolated demonstration with two synthetic identities and
objects. Do not contact any network address, run commands, read credentials,
modify files, enumerate targets, or create workers.

Using only the recorded evidence, explain whether Bob's authenticated GET for
Alice's note crossed the stated ownership boundary in vulnerable mode, and
whether the identical identity and object were denied in fixed mode. Check the
positive owner controls and anonymous negative controls. Cite exact case IDs,
HTTP status codes, response bodies, source hashes, and evidence filenames.
Separate observed responses from your inferences. Say that you reviewed recorded
evidence and did not independently execute the requests. State coverage limits.

These are prompt instructions, not verified sandbox or network restrictions.