{"abstract":"Evaluate configured destination-host permissions with label boundaries: the label depth report branch emits an incorrect decision.","category":"HTTP redirects","checks":7,"contract":"Evaluate configured destination-host permissions with label boundaries. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.","contract_signature":"request, host, allowed, subdomains, source_host, blocked","evaluation_group":"s3-http-redirects-host-policy","failed_approach":"The partial repair uses \"len(set(host.rstrip('.').split('.')))\" and still fails an explicit boundary or control.","family":"s3-http-redirects-host-policy-label-depth-report","id":"FA-28566","implementations":{"attempt":{"sha256":"120a1c86c63d32fb574a1adc00afce0cff19328c5e288518a798f6fd783bc133","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nfrom urllib.parse import urlsplit, unquote, quote\nimport posixpath\nimport re\nN = 1\nobservations = []\ndef solve(request, host, allowed, subdomains, source_host, blocked):\n    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), len(set(host.rstrip('.').split('.'))), host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} \ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})\ncheck('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})\ncheck('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})\ncheck('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})\ncheck('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})\ncheck('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})\ncheck('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"2e56cbf95c2290eaff3056176e486e3d91fdcd986692028ff01b0d54ebaf3349","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nfrom urllib.parse import urlsplit, unquote, quote\nimport posixpath\nimport re\nN = 1\nobservations = []\ndef solve(request, host, allowed, subdomains, source_host, blocked):\n    return {'request': request, 'decision': [host.lower().rstrip('.'), any(host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a) for a in allowed), any(host.lower().rstrip('.') == a or (subdomains and host.lower().rstrip('.').endswith('.'+a)) for a in allowed), host.lower().rstrip('.') not in blocked, bool(allowed), host.count('.')+1, host.lower().rstrip('.') == source_host.lower().rstrip('.'), host.lower().rstrip('.').split('.')[1:], [x for x in blocked if x == host.lower().rstrip('.') ], max((a for a in allowed if host.lower().rstrip('.') == a or host.lower().rstrip('.').endswith('.'+a)), key=len, default=None)]} \ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\ncheck('fixture 1', solve('/requests/' + str(N) + '/0', 'api.example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/0', 'decision': ['api.example.test', True, True, True, True, 3, False, ['example', 'test'], [], 'example.test']})\ncheck('fixture 2', solve('/requests/' + str(N) + '/1', 'evil-example.test', ['example.test'], True, 'example.test', []), {'request': '/requests/' + str(N) + '/1', 'decision': ['evil-example.test', False, False, True, True, 2, False, ['test'], [], None]})\ncheck('fixture 3', solve('/requests/' + str(N) + '/2', 'example.test', ['example.test'], False, 'example.test', ['example.test']), {'request': '/requests/' + str(N) + '/2', 'decision': ['example.test', True, True, False, True, 2, True, ['test'], ['example.test'], 'example.test']})\ncheck('fixture 4', solve('/requests/' + str(N) + '/3', 'EXAMPLE.TEST.', ['example.test'], False, 'other.test', []), {'request': '/requests/' + str(N) + '/3', 'decision': ['example.test', True, True, True, True, 2, False, ['test'], [], 'example.test']})\ncheck('fixture 5', solve('/requests/' + str(N) + '/4', 'a.b.example.test', ['example.test'], False, 'example.test', []), {'request': '/requests/' + str(N) + '/4', 'decision': ['a.b.example.test', True, False, True, True, 4, False, ['b', 'example', 'test'], [], 'example.test']})\ncheck('fixture 6', solve('/requests/' + str(N) + '/5', 'other.test', [], True, 'other.test', ['unrelated.test']), {'request': '/requests/' + str(N) + '/5', 'decision': ['other.test', False, False, True, False, 2, True, ['test'], [], None]})\ncheck('fixture 7', solve('/requests/' + str(N) + '/6', 'example.example.test', ['example.test'], True, 'EXAMPLE.EXAMPLE.TEST.', []), {'request': '/requests/' + str(N) + '/6', 'decision': ['example.example.test', True, True, True, True, 3, True, ['example', 'test'], [], 'example.test']})\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"s3-http-redirects-host-policy-label-depth-report","generated_at":"2026-09-29T14:41:35.176621+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"Models a redirect controller decision before following a target or exposing a redirect result.","root_cause":"The label-depth-report decision uses \"host.count('.')+1\"; this violates the stipulated controller policy.","sha256":"a0aa04668e1de31ba553871516e10c8bc74b11d96fc3e66693aba040977932b0","title":"Evaluate configured destination-host permissions with label boundaries: label depth report · case 01","variant":1,"variant_policy":"N changes request correlation identity. Policy boundary fixtures are reused; numbered variants are not independent examples.","verified":true,"visibility":"public","verification":{"attempt":{"elapsed_ms":37.82,"exit_code":1,"observations":[{"actual":{"decision":["api.example.test",true,true,true,true,3,false,["example","test"],[],"example.test"],"request":"/requests/1/0"},"check":"fixture 1","expected":{"decision":["api.example.test",true,true,true,true,3,false,["example","test"],[],"example.test"],"request":"/requests/1/0"},"passed":true},{"actual":{"decision":["evil-example.test",false,false,true,true,2,false,["test"],[],null],"request":"/requests/1/1"},"check":"fixture 2","expected":{"decision":["evil-example.test",false,false,true,true,2,false,["test"],[],null],"request":"/requests/1/1"},"passed":true},{"actual":{"decision":["example.test",true,true,false,true,2,true,["test"],["example.test"],"example.test"],"request":"/requests/1/2"},"check":"fixture 3","expected":{"decision":["example.test",true,true,false,true,2,true,["test"],["example.test"],"example.test"],"request":"/requests/1/2"},"passed":true},{"actual":{"decision":["example.test",true,true,true,true,2,false,["test"],[],"example.test"],"request":"/requests/1/3"},"check":"fixture 4","expected":{"decision":["example.test",true,true,true,true,2,false,["test"],[],"example.test"],"request":"/requests/1/3"},"passed":true},{"actual":{"decision":["a.b.example.test",true,false,true,true,4,false,["b","example","test"],[],"example.test"],"request":"/requests/1/4"},"check":"fixture 5","expected":{"decision":["a.b.example.test",true,false,true,true,4,false,["b","example","test"],[],"example.test"],"request":"/requests/1/4"},"passed":true},{"actual":{"decision":["other.test",false,false,true,false,2,true,["test"],[],null],"request":"/requests/1/5"},"check":"fixture 6","expected":{"decision":["other.test",false,false,true,false,2,true,["test"],[],null],"request":"/requests/1/5"},"passed":true},{"actual":{"decision":["example.example.test",true,true,true,true,2,true,["example","test"],[],"example.test"],"request":"/requests/1/6"},"check":"fixture 7","expected":{"decision":["example.example.test",true,true,true,true,3,true,["example","test"],[],"example.test"],"request":"/requests/1/6"},"passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": {\"request\": \"/requests/1/0\", \"decision\": [\"api.example.test\", true, true, true, true, 3, false, [\"example\", \"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/0\", \"decision\": [\"api.example.test\", true, true, true, true, 3, false, [\"example\", \"test\"], [], \"example.test\"]}, \"passed\": true}, {\"check\": \"fixture 2\", \"actual\": {\"request\": \"/requests/1/1\", \"decision\": [\"evil-example.test\", false, false, true, true, 2, false, [\"test\"], [], null]}, \"expected\": {\"request\": \"/requests/1/1\", \"decision\": [\"evil-example.test\", false, false, true, true, 2, false, [\"test\"], [], null]}, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": {\"request\": \"/requests/1/2\", \"decision\": [\"example.test\", true, true, false, true, 2, true, [\"test\"], [\"example.test\"], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/2\", \"decision\": [\"example.test\", true, true, false, true, 2, true, [\"test\"], [\"example.test\"], \"example.test\"]}, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": {\"request\": \"/requests/1/3\", \"decision\": [\"example.test\", true, true, true, true, 2, false, [\"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/3\", \"decision\": [\"example.test\", true, true, true, true, 2, false, [\"test\"], [], \"example.test\"]}, \"passed\": true}, {\"check\": \"fixture 5\", \"actual\": {\"request\": \"/requests/1/4\", \"decision\": [\"a.b.example.test\", true, false, true, true, 4, false, [\"b\", \"example\", \"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/4\", \"decision\": [\"a.b.example.test\", true, false, true, true, 4, false, [\"b\", \"example\", \"test\"], [], \"example.test\"]}, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": {\"request\": \"/requests/1/5\", \"decision\": [\"other.test\", false, false, true, false, 2, true, [\"test\"], [], null]}, \"expected\": {\"request\": \"/requests/1/5\", \"decision\": [\"other.test\", false, false, true, false, 2, true, [\"test\"], [], null]}, \"passed\": true}, {\"check\": \"fixture 7\", \"actual\": {\"request\": \"/requests/1/6\", \"decision\": [\"example.example.test\", true, true, true, true, 2, true, [\"example\", \"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/6\", \"decision\": [\"example.example.test\", true, true, true, true, 3, true, [\"example\", \"test\"], [], \"example.test\"]}, \"passed\": false}], \"passed\": false}\n"},"broken":{"elapsed_ms":36.41,"exit_code":1,"observations":[{"actual":{"decision":["api.example.test",true,true,true,true,3,false,["example","test"],[],"example.test"],"request":"/requests/1/0"},"check":"fixture 1","expected":{"decision":["api.example.test",true,true,true,true,3,false,["example","test"],[],"example.test"],"request":"/requests/1/0"},"passed":true},{"actual":{"decision":["evil-example.test",false,false,true,true,2,false,["test"],[],null],"request":"/requests/1/1"},"check":"fixture 2","expected":{"decision":["evil-example.test",false,false,true,true,2,false,["test"],[],null],"request":"/requests/1/1"},"passed":true},{"actual":{"decision":["example.test",true,true,false,true,2,true,["test"],["example.test"],"example.test"],"request":"/requests/1/2"},"check":"fixture 3","expected":{"decision":["example.test",true,true,false,true,2,true,["test"],["example.test"],"example.test"],"request":"/requests/1/2"},"passed":true},{"actual":{"decision":["example.test",true,true,true,true,3,false,["test"],[],"example.test"],"request":"/requests/1/3"},"check":"fixture 4","expected":{"decision":["example.test",true,true,true,true,2,false,["test"],[],"example.test"],"request":"/requests/1/3"},"passed":false},{"actual":{"decision":["a.b.example.test",true,false,true,true,4,false,["b","example","test"],[],"example.test"],"request":"/requests/1/4"},"check":"fixture 5","expected":{"decision":["a.b.example.test",true,false,true,true,4,false,["b","example","test"],[],"example.test"],"request":"/requests/1/4"},"passed":true},{"actual":{"decision":["other.test",false,false,true,false,2,true,["test"],[],null],"request":"/requests/1/5"},"check":"fixture 6","expected":{"decision":["other.test",false,false,true,false,2,true,["test"],[],null],"request":"/requests/1/5"},"passed":true},{"actual":{"decision":["example.example.test",true,true,true,true,3,true,["example","test"],[],"example.test"],"request":"/requests/1/6"},"check":"fixture 7","expected":{"decision":["example.example.test",true,true,true,true,3,true,["example","test"],[],"example.test"],"request":"/requests/1/6"},"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 1\", \"actual\": {\"request\": \"/requests/1/0\", \"decision\": [\"api.example.test\", true, true, true, true, 3, false, [\"example\", \"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/0\", \"decision\": [\"api.example.test\", true, true, true, true, 3, false, [\"example\", \"test\"], [], \"example.test\"]}, \"passed\": true}, {\"check\": \"fixture 2\", \"actual\": {\"request\": \"/requests/1/1\", \"decision\": [\"evil-example.test\", false, false, true, true, 2, false, [\"test\"], [], null]}, \"expected\": {\"request\": \"/requests/1/1\", \"decision\": [\"evil-example.test\", false, false, true, true, 2, false, [\"test\"], [], null]}, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": {\"request\": \"/requests/1/2\", \"decision\": [\"example.test\", true, true, false, true, 2, true, [\"test\"], [\"example.test\"], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/2\", \"decision\": [\"example.test\", true, true, false, true, 2, true, [\"test\"], [\"example.test\"], \"example.test\"]}, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": {\"request\": \"/requests/1/3\", \"decision\": [\"example.test\", true, true, true, true, 3, false, [\"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/3\", \"decision\": [\"example.test\", true, true, true, true, 2, false, [\"test\"], [], \"example.test\"]}, \"passed\": false}, {\"check\": \"fixture 5\", \"actual\": {\"request\": \"/requests/1/4\", \"decision\": [\"a.b.example.test\", true, false, true, true, 4, false, [\"b\", \"example\", \"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/4\", \"decision\": [\"a.b.example.test\", true, false, true, true, 4, false, [\"b\", \"example\", \"test\"], [], \"example.test\"]}, \"passed\": true}, {\"check\": \"fixture 6\", \"actual\": {\"request\": \"/requests/1/5\", \"decision\": [\"other.test\", false, false, true, false, 2, true, [\"test\"], [], null]}, \"expected\": {\"request\": \"/requests/1/5\", \"decision\": [\"other.test\", false, false, true, false, 2, true, [\"test\"], [], null]}, \"passed\": true}, {\"check\": \"fixture 7\", \"actual\": {\"request\": \"/requests/1/6\", \"decision\": [\"example.example.test\", true, true, true, true, 3, true, [\"example\", \"test\"], [], \"example.test\"]}, \"expected\": {\"request\": \"/requests/1/6\", \"decision\": [\"example.example.test\", true, true, true, true, 3, true, [\"example\", \"test\"], [], \"example.test\"]}, \"passed\": true}], \"passed\": false}\n"}},"member_only":{"stages":["fixed"],"fields":["implementations.fixed","verification.fixed","harness","repair"],"note":"The verified repair, its recorded checks, the repair description, and the scoring harness are available to members."}}