{"abstract":"Validate a redirect port against an explicit bounded port policy: the explicit port allowlist branch emits an incorrect decision.","category":"HTTP redirects","checks":6,"contract":"Validate a redirect port against an explicit bounded port policy. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.","evaluation_group":"s3-http-redirects-explicit-port-policy","failed_approach":"The partial repair uses 'port in permitted' and still fails an explicit boundary or control.","family":"s3-http-redirects-explicit-port-policy-explicit-port-allowlist","id":"FA-28036","implementations":{"attempt":{"sha256":"e139f4165ef3dd72f957ac755784ab0dd35cc8981ca654a63516001dfb1b65d5","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nfrom urllib.parse import urlsplit, unquote, quote\nimport posixpath\nimport re\nN = 1\nobservations = []\ndef solve(request, port, scheme, permitted):\n    return {'request': request, 'decision': [(443 if scheme == 'https' else 80) if port is None else port, port == 0, port is not None and port > 65535, port is not None and port < 0, port in permitted]} \ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve('/requests/' + str(N) + '/0', None, 'https', [443]), {'request': '/requests/' + str(N) + '/0', 'decision': [443, False, False, False, True]})\ncheck('fixture 2', solve('/requests/' + str(N) + '/1', 0, 'https', [443]), {'request': '/requests/' + str(N) + '/1', 'decision': [0, True, False, False, False]})\ncheck('fixture 3', solve('/requests/' + str(N) + '/2', 65535, 'http', [65535]), {'request': '/requests/' + str(N) + '/2', 'decision': [65535, False, False, False, True]})\ncheck('fixture 4', solve('/requests/' + str(N) + '/3', 65536, 'http', [80]), {'request': '/requests/' + str(N) + '/3', 'decision': [65536, False, True, False, False]})\ncheck('fixture 5', solve('/requests/' + str(N) + '/4', -1, 'http', [-1]), {'request': '/requests/' + str(N) + '/4', 'decision': [-1, False, False, True, True]})\ncheck('fixture 6', solve('/requests/' + str(N) + '/5', 8443, 'https', [8443]), {'request': '/requests/' + str(N) + '/5', 'decision': [8443, False, False, False, True]})\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"9e378a7fd2f30fde2e3005733e40c7b99ac03f812b2e956c8da5170a820f685a","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nfrom urllib.parse import urlsplit, unquote, quote\nimport posixpath\nimport re\nN = 1\nobservations = []\ndef solve(request, port, scheme, permitted):\n    return {'request': request, 'decision': [(443 if scheme == 'https' else 80) if port is None else port, port == 0, port is not None and port > 65535, port is not None and port < 0, not port or port in permitted]} \ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve('/requests/' + str(N) + '/0', None, 'https', [443]), {'request': '/requests/' + str(N) + '/0', 'decision': [443, False, False, False, True]})\ncheck('fixture 2', solve('/requests/' + str(N) + '/1', 0, 'https', [443]), {'request': '/requests/' + str(N) + '/1', 'decision': [0, True, False, False, False]})\ncheck('fixture 3', solve('/requests/' + str(N) + '/2', 65535, 'http', [65535]), {'request': '/requests/' + str(N) + '/2', 'decision': [65535, False, False, False, True]})\ncheck('fixture 4', solve('/requests/' + str(N) + '/3', 65536, 'http', [80]), {'request': '/requests/' + str(N) + '/3', 'decision': [65536, False, True, False, False]})\ncheck('fixture 5', solve('/requests/' + str(N) + '/4', -1, 'http', [-1]), {'request': '/requests/' + str(N) + '/4', 'decision': [-1, False, False, True, True]})\ncheck('fixture 6', solve('/requests/' + str(N) + '/5', 8443, 'https', [8443]), {'request': '/requests/' + str(N) + '/5', 'decision': [8443, False, False, False, True]})\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"40385b168fc8301191803d371b1bd794b479241f9e2f2b8b6b79766715de2a09","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nfrom urllib.parse import urlsplit, unquote, quote\nimport posixpath\nimport re\nN = 1\nobservations = []\ndef solve(request, port, scheme, permitted):\n    return {'request': request, 'decision': [(443 if scheme == 'https' else 80) if port is None else port, port == 0, port is not None and port > 65535, port is not None and port < 0, port is None or port in permitted]} \ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve('/requests/' + str(N) + '/0', None, 'https', [443]), {'request': '/requests/' + str(N) + '/0', 'decision': [443, False, False, False, True]})\ncheck('fixture 2', solve('/requests/' + str(N) + '/1', 0, 'https', [443]), {'request': '/requests/' + str(N) + '/1', 'decision': [0, True, False, False, False]})\ncheck('fixture 3', solve('/requests/' + str(N) + '/2', 65535, 'http', [65535]), {'request': '/requests/' + str(N) + '/2', 'decision': [65535, False, False, False, True]})\ncheck('fixture 4', solve('/requests/' + str(N) + '/3', 65536, 'http', [80]), {'request': '/requests/' + str(N) + '/3', 'decision': [65536, False, True, False, False]})\ncheck('fixture 5', solve('/requests/' + str(N) + '/4', -1, 'http', [-1]), {'request': '/requests/' + str(N) + '/4', 'decision': [-1, False, False, True, True]})\ncheck('fixture 6', solve('/requests/' + str(N) + '/5', 8443, 'https', [8443]), {'request': '/requests/' + str(N) + '/5', 'decision': [8443, False, False, False, True]})\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"s3-http-redirects-explicit-port-policy-explicit-port-allowlist","generated_at":"2026-09-29T14:41:30.324600+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"Models a redirect controller decision before following a target or exposing a redirect result.","repair":"At this decision use 'port is None or port in permitted', preserving the other controller outputs.","root_cause":"The explicit-port-allowlist decision uses 'not port or port in permitted'; this violates the stipulated controller policy.","sha256":"a37976b0433e6cb49df264ad278ea2fbce7f830fbc70b35d97a629d6f33125f5","title":"Validate a redirect port against an explicit bounded port policy: explicit port allowlist · case 01","variant":1,"variant_policy":"N changes request correlation identity. Policy boundary fixtures are reused; numbered variants are not independent examples.","verification":{"attempt":{"elapsed_ms":41.165,"exit_code":1,"observations":[{"actual":{"decision":[443,false,false,false,false],"request":"/requests/1/0"},"check":"fixture 1","expected":{"decision":[443,false,false,false,true],"request":"/requests/1/0"},"passed":false},{"actual":{"decision":[0,true,false,false,false],"request":"/requests/1/1"},"check":"fixture 2","expected":{"decision":[0,true,false,false,false],"request":"/requests/1/1"},"passed":true},{"actual":{"decision":[65535,false,false,false,true],"request":"/requests/1/2"},"check":"fixture 3","expected":{"decision":[65535,false,false,false,true],"request":"/requests/1/2"},"passed":true},{"actual":{"decision":[65536,false,true,false,false],"request":"/requests/1/3"},"check":"fixture 4","expected":{"decision":[65536,false,true,false,false],"request":"/requests/1/3"},"passed":true},{"actual":{"decision":[-1,false,false,true,true],"request":"/requests/1/4"},"check":"fixture 5","expected":{"decision":[-1,false,false,true,true],"request":"/requests/1/4"},"passed":true},{"actual":{"decision":[8443,false,false,false,true],"request":"/requests/1/5"},"check":"fixture 6","expected":{"decision":[8443,false,false,false,true],"request":"/requests/1/5"},"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": {\"request\": \"/requests/1/0\", \"decision\": [443, false, false, false, false]}, \"expected\": {\"request\": \"/requests/1/0\", \"decision\": [443, false, false, false, true]}, \"passed\": false}, {\"check\": \"fixture 2\", \"actual\": {\"request\": \"/requests/1/1\", \"decision\": [0, true, false, false, false]}, \"expected\": {\"request\": \"/requests/1/1\", \"decision\": [0, true, false, false, false]}, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": {\"request\": \"/requests/1/2\", \"decision\": [65535, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/2\", \"decision\": [65535, false, false, false, true]}, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": {\"request\": \"/requests/1/3\", \"decision\": [65536, false, true, false, false]}, \"expected\": {\"request\": \"/requests/1/3\", \"decision\": [65536, false, true, false, false]}, \"passed\": true}, {\"check\": \"fixture 5\", \"actual\": {\"request\": \"/requests/1/4\", \"decision\": [-1, false, false, true, true]}, \"expected\": {\"request\": \"/requests/1/4\", \"decision\": [-1, false, false, true, true]}, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": {\"request\": \"/requests/1/5\", \"decision\": [8443, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/5\", \"decision\": [8443, false, false, false, true]}, \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":38.837,"exit_code":1,"observations":[{"actual":{"decision":[443,false,false,false,true],"request":"/requests/1/0"},"check":"fixture 1","expected":{"decision":[443,false,false,false,true],"request":"/requests/1/0"},"passed":true},{"actual":{"decision":[0,true,false,false,true],"request":"/requests/1/1"},"check":"fixture 2","expected":{"decision":[0,true,false,false,false],"request":"/requests/1/1"},"passed":false},{"actual":{"decision":[65535,false,false,false,true],"request":"/requests/1/2"},"check":"fixture 3","expected":{"decision":[65535,false,false,false,true],"request":"/requests/1/2"},"passed":true},{"actual":{"decision":[65536,false,true,false,false],"request":"/requests/1/3"},"check":"fixture 4","expected":{"decision":[65536,false,true,false,false],"request":"/requests/1/3"},"passed":true},{"actual":{"decision":[-1,false,false,true,true],"request":"/requests/1/4"},"check":"fixture 5","expected":{"decision":[-1,false,false,true,true],"request":"/requests/1/4"},"passed":true},{"actual":{"decision":[8443,false,false,false,true],"request":"/requests/1/5"},"check":"fixture 6","expected":{"decision":[8443,false,false,false,true],"request":"/requests/1/5"},"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": {\"request\": \"/requests/1/0\", \"decision\": [443, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/0\", \"decision\": [443, false, false, false, true]}, \"passed\": true}, {\"check\": \"fixture 2\", \"actual\": {\"request\": \"/requests/1/1\", \"decision\": [0, true, false, false, true]}, \"expected\": {\"request\": \"/requests/1/1\", \"decision\": [0, true, false, false, false]}, \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": {\"request\": \"/requests/1/2\", \"decision\": [65535, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/2\", \"decision\": [65535, false, false, false, true]}, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": {\"request\": \"/requests/1/3\", \"decision\": [65536, false, true, false, false]}, \"expected\": {\"request\": \"/requests/1/3\", \"decision\": [65536, false, true, false, false]}, \"passed\": true}, {\"check\": \"fixture 5\", \"actual\": {\"request\": \"/requests/1/4\", \"decision\": [-1, false, false, true, true]}, \"expected\": {\"request\": \"/requests/1/4\", \"decision\": [-1, false, false, true, true]}, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": {\"request\": \"/requests/1/5\", \"decision\": [8443, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/5\", \"decision\": [8443, false, false, false, true]}, \"passed\": true}], \"passed\": false}\n"},"fixed":{"elapsed_ms":39.432,"exit_code":0,"observations":[{"actual":{"decision":[443,false,false,false,true],"request":"/requests/1/0"},"check":"fixture 1","expected":{"decision":[443,false,false,false,true],"request":"/requests/1/0"},"passed":true},{"actual":{"decision":[0,true,false,false,false],"request":"/requests/1/1"},"check":"fixture 2","expected":{"decision":[0,true,false,false,false],"request":"/requests/1/1"},"passed":true},{"actual":{"decision":[65535,false,false,false,true],"request":"/requests/1/2"},"check":"fixture 3","expected":{"decision":[65535,false,false,false,true],"request":"/requests/1/2"},"passed":true},{"actual":{"decision":[65536,false,true,false,false],"request":"/requests/1/3"},"check":"fixture 4","expected":{"decision":[65536,false,true,false,false],"request":"/requests/1/3"},"passed":true},{"actual":{"decision":[-1,false,false,true,true],"request":"/requests/1/4"},"check":"fixture 5","expected":{"decision":[-1,false,false,true,true],"request":"/requests/1/4"},"passed":true},{"actual":{"decision":[8443,false,false,false,true],"request":"/requests/1/5"},"check":"fixture 6","expected":{"decision":[8443,false,false,false,true],"request":"/requests/1/5"},"passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": {\"request\": \"/requests/1/0\", \"decision\": [443, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/0\", \"decision\": [443, false, false, false, true]}, \"passed\": true}, {\"check\": \"fixture 2\", \"actual\": {\"request\": \"/requests/1/1\", \"decision\": [0, true, false, false, false]}, \"expected\": {\"request\": \"/requests/1/1\", \"decision\": [0, true, false, false, false]}, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": {\"request\": \"/requests/1/2\", \"decision\": [65535, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/2\", \"decision\": [65535, false, false, false, true]}, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": {\"request\": \"/requests/1/3\", \"decision\": [65536, false, true, false, false]}, \"expected\": {\"request\": \"/requests/1/3\", \"decision\": [65536, false, true, false, false]}, \"passed\": true}, {\"check\": \"fixture 5\", \"actual\": {\"request\": \"/requests/1/4\", \"decision\": [-1, false, false, true, true]}, \"expected\": {\"request\": \"/requests/1/4\", \"decision\": [-1, false, false, true, true]}, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": {\"request\": \"/requests/1/5\", \"decision\": [8443, false, false, false, true]}, \"expected\": {\"request\": \"/requests/1/5\", \"decision\": [8443, false, false, false, true]}, \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}