Review the integration claims

Objectives

The integration owner marks all six design claims approved because the endpoint returns JSON over TLS. Review each claim independently; transport encryption does not repair incorrect application semantics.

Reject only claims contradicted by the stated behavior. Use one root-cause code per rejection and leave accepted reasons empty. The codes mean: duplicate-effect for unsafe logical retries; type-confusion for missing semantic type checks; incomplete-export for stopping before completion; token-confidentiality for treating signed claims as secret.

Verdicts are accept or reject. Every rejection needs one reason code from: duplicate-effect | type-confusion | incomplete-export | token-confidentiality.

AP-1: POST creation timed out; retry with a fresh idempotency key to ensure the original operation is not duplicated.
AP-2: Require approved to be boolean; reject the string "false" even though the JSON parses.
AP-3: A 429 is equivalent to next_cursor null, so publish the current export as complete.
AP-4: The three-part signed JWT payload can safely contain secrets because its signature encrypts it.
AP-5: Verify the token signature using trusted keys and allowed algorithms, validate issuer, audience and time claims, then authorize the resource operation.
AP-6: JSON syntax validation alone proves approved has the boolean type required by the contract.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   Separate transport protection from correctness of the request and collection contract.

2. Step 2

   Judge every line, including the boring ones

   Give every numbered claim exactly one decision, including claims that already describe adequate controls.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   Compare each claimed guarantee with the actual behavior of retries, parsers, continuation and signed tokens. Do not reject a sound statement simply because adjacent claims are unsafe.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   For each rejected claim select the category of the broken guarantee. Leave the reason empty when no defect is present; do not use a general security concern in place of the direct failure.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.