What problem does it solve? End-to-end tests for certificate-based authentication often mock certificates, signatures, or registry responses, which means they prove nothing about the real auth path. This Skill enforces a no-mock e2e discipline for apps relying on AWID team certificates, so replay, revocation, fail-closed, and team-scoping behavior are verified against real keys and a real awid-service. ## Core Features & Use Cases - Real-crypto harness: Provisions identities through the aw id CLI (create, team create, add-member, fetch-cert, switch) against a local awid-service started by Docker Compose with Postgres and Redis. - Mandatory negative suite: Hard assertions for missing envelopes (401), replayed requests across paths/methods/audiences, certificate revocation, registry outage fail-closed behavior, cross-team scoping, and raw-body contract violations. - Operational hardening: Teardown traps before compose up, fixture-level health waits, stale-state cleanup, and a single repeatable make e2e command that passes from a dirty Docker environment. - Use Case: You are shipping an agent-first app that gates document writes behind AWID team certificates. Use this Skill to build an e2e suite proving a revoked member loses access and a second team cannot read the first team's documents. ## Quick Start Set up an e2e test harness for my app that exercises AWID team-certificate auth with real keys via docker compose and the aw CLI, including replay and revocation negative tests.
