{"abstract":"Forwarded protocol is accepted only from trusted peer.","category":"Proxy forwarding","checks":4,"contract":"Bounded offline decision model: forwarded protocol is accepted only from trusted peer. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.","contract_signature":"tls, forwarded, trusted","evaluation_group":"xh-forwarded-protocol-is-accepted-only-from-trusted-peer","failed_approach":"The attempted repair uses `'https' if tls else 'http'` and still violates a separate fixture.","family":"xh-forwarded-protocol-is-accepted-only-from-trusted-peer","id":"FA-6986","implementations":{"attempt":{"sha256":"14ebab16f06dc9d6948edcc8d08bda44dc9a19ee52d207480fd64af1c256bfd0","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(tls, forwarded, trusted):\n    return 'https' if tls else 'http'\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve(False, 'https', False), 'http')\", \"check('fixture 2', solve(False, 'https', True), 'https')\", \"check('fixture 3', solve(True, 'other', True), 'https')\", \"check('fixture 4', solve(False, None, True), 'http')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"f57c7c6c23bc7444491866140d32bc88f591ba47ddb0bb1a67b6e504e6272549","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(tls, forwarded, trusted):\n    return forwarded or ('https' if tls else 'http')\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve(False, 'https', False), 'http')\", \"check('fixture 2', solve(False, 'https', True), 'https')\", \"check('fixture 3', solve(True, 'other', True), 'https')\", \"check('fixture 4', solve(False, None, True), 'http')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xh-forwarded-protocol-is-accepted-only-from-trusted-peer","generated_at":"2026-09-29T14:38:07.204601+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"This deterministic proxy forwarding model isolates the forwarded-protocol-is-accepted-only-from-trusted-peer policy at a network component boundary.","root_cause":"The faulty implementation uses `forwarded or ('https' if tls else 'http')` for the forwarded-protocol-is-accepted-only-from-trusted-peer decision.","sha256":"59bee8ece4074d39a357256ab1ff5c7ee6b0181c1ba2971ee6b10422cf949127","title":"Forwarded protocol is accepted only from trusted peer · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verified":true,"visibility":"public","verification":{"attempt":{"elapsed_ms":31.93,"exit_code":1,"observations":[{"actual":"http","check":"fixture 2","expected":"https","passed":false},{"actual":"https","check":"fixture 3","expected":"https","passed":true},{"actual":"http","check":"fixture 4","expected":"http","passed":true},{"actual":"http","check":"fixture 1","expected":"http","passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"http\", \"expected\": \"https\", \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": \"https\", \"expected\": \"https\", \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": \"http\", \"expected\": \"http\", \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": \"http\", \"expected\": \"http\", \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":36.202,"exit_code":1,"observations":[{"actual":"https","check":"fixture 2","expected":"https","passed":true},{"actual":"other","check":"fixture 3","expected":"https","passed":false},{"actual":"http","check":"fixture 4","expected":"http","passed":true},{"actual":"https","check":"fixture 1","expected":"http","passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"https\", \"expected\": \"https\", \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": \"other\", \"expected\": \"https\", \"passed\": false}, {\"check\": \"fixture 4\", \"actual\": \"http\", \"expected\": \"http\", \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": \"https\", \"expected\": \"http\", \"passed\": false}], \"passed\": false}\n"}},"member_only":{"stages":["fixed"],"fields":["implementations.fixed","verification.fixed","harness","repair"],"note":"The verified repair, its recorded checks, the repair description, and the scoring harness are available to members."}}