tool: multi_tool_call
side_effect: read
expect_tools:
  - decode_oidc_jwt_claims
  - simulate_oidc_trust_match
  - query_cloudtrail_web_identity
tool_order: any
tool_call_match_mode: any
expected_tool_calls:
  - name: decode_oidc_jwt_claims
    argument_invariants:
      - path: $.tokens
        type: array
        length_gte: 2
        length_lte: 2
      - path: $.compare_mode
        equals: side_by_side
  - name: simulate_oidc_trust_match
    argument_invariants:
      - path: $.role_arn
        equals: arn:aws:iam::111122223333:role/prod-deployer
      - path: $.issuer
        equals: https://token.actions.githubusercontent.com
      - path: $.subject
        equals: repo:acme/ml-platform:ref:refs/heads/feature/tmp-debug
      - path: $.audience
        equals: sts.amazonaws.com
      - path: $.match_fields
        type: array
        length_gte: 3
  - name: query_cloudtrail_web_identity
    argument_invariants:
      - path: $.role_arn
        equals: arn:aws:iam::111122223333:role/prod-deployer
      - path: $.identity_provider
        equals: token.actions.githubusercontent.com
      - path: $.lookback_minutes
        type: number
        gte: 30
        lte: 1440
      - path: $.include_fields
        type: array
        length_gte: 3
