S1–S5 compose into the 20-minute discovery-call arc; S6–S8 are pull-outs. Each row lists the state a scenario needs (health-grid green covers most) and what it mutates (what reset will clean).

​
The fixture content underneath

Domains: api-design, secure-coding, company-policy. Enforced corpus at start-of-demo: 14 statements (6 + 8) — the number statements_considered should show on every ACME check.

​
Design constraints that keep S5 deterministic

These took real iteration; do not “simplify” them away:
  • The demo diffs are routes-only — an openapi.yaml hunk in the diff reliably distracted every model tested. The base spec documents the refunds endpoint up front (“spec first; the violating PR implements it wrong”).
  • The endpoint is POST /payments/:id/refunds — the earlier /refunds/:id shape drew plural-noun false positives from the models.
  • The violated statement is error-responses-must-use-problem-json because it is diff-evident; a diff can never prove a missing OpenAPI entry (that is S7’s job, with whole-repo evidence).