[MOCK-02] Add deterministic auth, tenant, command, telemetry, webhook, and failure scenarios

[jaavid]

Background

CoreLink is one product across multiple implementation repositories. This work is owned by mock-server under EPIC-05.

Problem

MOCK-02 previously depended on the vague phrase accepted contracts, which did not identify which normative contract slices are required for each deterministic scenario or distinguish scenario implementation from Beta support claims.

Goal

Provide deterministic auth, tenant, command, telemetry, webhook and failure scenarios with immutable contract provenance and repeatable conformance evidence.

Parent

• Primary Product Epic: EPIC-05
• Backlog ID: MOCK-02

Scope

• Implement deterministic positive, denied, malformed, retry/replay and recovery scenarios for supported developer journeys.
• Pin each scenario to version-identifiable normative API/event schemas.
• Cover tenant isolation, authorization/scope denial and safe synthetic data handling.
• Make scenarios reproducible in local/CI environments without hidden external state.
• Retain conformance evidence suitable for SDK/CLI/MCP Beta gates.

Out of Scope

• Hand-written behavior that diverges from normative contracts.
• Presenting a scenario as supported before the corresponding contract slice is accepted/version-identifiable.
• Treating mock behavior as runtime Product Acceptance.

Acceptance Criteria

• Auth/tenant positive and denial scenarios map to the accepted identity/security contract boundary.
• Device/command/telemetry scenarios map to exact API-02 contract revisions where applicable.
• Event/webhook retry/replay/failure scenarios map to exact API-03/API-04 revisions where applicable.
• Cross-tenant and insufficient-scope requests fail closed deterministically.
• Scenarios are reproducible from documented inputs and contain no sensitive production data.
• Scenario provenance identifies immutable contract/version inputs.
• Retained conformance evidence is linked and EPIC-05 exit criteria are measurably advanced.

Dependencies and acceptance state

• Execution prerequisite: MOCK-01 baseline mock/conformance architecture.
• Contract inputs: accepted, version-identifiable API-02/API-03/API-04 slices are required only for the scenarios that claim support for those surfaces; draft scenarios may exist if explicitly classified as draft.
• Blocks: MOCK-03 package/CI conformance, TS/PY/JAVA SDK conformance, CLI-02, MCP-02 and DOCS-04 runnable examples.
• Current dependency state: See the CoreLink Product organization Project.

Planning Metadata

• Type: Feature
• Priority snapshot: P0
• Product milestone snapshot: Beta
• Domain snapshots: devex, api
• Area snapshot: backend
• Complexity: L
• Created in status: Triage
• Current status and DRI: See the CoreLink Product organization Project.
• Intended repository labels: type:feature

Definition of Done

• Acceptance criteria demonstrated.
• Supported scenarios map to accepted/version-identifiable contracts.
• Required deterministic/conformance checks pass.
• Security and tenancy boundaries are covered.
• Scenario provenance and synthetic-data rules are documented.
• Downstream SDK/CLI/MCP consumers can execute the supported scenario set.
• Pull request(s), contract versions and retained evidence are linked.