{"abstract":"Dns glue is accepted only within delegated zone.","category":"DNS resolution","checks":4,"contract":"Given name, zone, type_, nameservers, dns glue is accepted only within delegated zone. Return the protocol decision or transformed value; fields are validated and fixtures state boundary outcomes.","evaluation_group":"xh-dns-glue-is-accepted-only-within-delegated-zone","failed_approach":"The attempted repair uses `name.endswith(zone) and type_ in (\"A\",\"AAAA\")` and still violates a separate fixture.","family":"xh-dns-glue-is-accepted-only-within-delegated-zone","id":"FA-7391","implementations":{"attempt":{"sha256":"a2d78900b0ccde94dc2045f14b77de4a5e9bb05dde3a459cc88bb2e4edac5c26","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(name, zone, type_, nameservers):\n    return name.endswith(zone) and type_ in (\"A\",\"AAAA\")\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('ns.child', 'child', 'A', ['ns.child']), True)\", \"check('fixture 2', solve('ns.evil', 'child', 'A', ['ns.evil']), False)\", \"check('fixture 3', solve('badchild', 'child', 'A', ['badchild']), False)\", \"check('fixture 4', solve('ns.child', 'child', 'TXT', ['ns.child']), False)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"958ada2d844c5e97ab9059a188cc0f2ead1f770b37795648ae3bc9ba7e9b1020","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(name, zone, type_, nameservers):\n    return name in nameservers\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('ns.child', 'child', 'A', ['ns.child']), True)\", \"check('fixture 2', solve('ns.evil', 'child', 'A', ['ns.evil']), False)\", \"check('fixture 3', solve('badchild', 'child', 'A', ['badchild']), False)\", \"check('fixture 4', solve('ns.child', 'child', 'TXT', ['ns.child']), False)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"76cf585c0ed55f1d15079d7269e935cba66b7f4e9bd1f18661c5e545aaa9cf49","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(name, zone, type_, nameservers):\n    return name in nameservers and type_ in (\"A\",\"AAAA\") and (name == zone or name.endswith(\".\"+zone))\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('ns.child', 'child', 'A', ['ns.child']), True)\", \"check('fixture 2', solve('ns.evil', 'child', 'A', ['ns.evil']), False)\", \"check('fixture 3', solve('badchild', 'child', 'A', ['badchild']), False)\", \"check('fixture 4', solve('ns.child', 'child', 'TXT', ['ns.child']), False)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xh-dns-glue-is-accepted-only-within-delegated-zone","generated_at":"2026-09-29T14:38:11.444752+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"This deterministic dns resolution model isolates the dns-glue-is-accepted-only-within-delegated-zone policy at a network component boundary.","repair":"Apply the explicit dns-glue-is-accepted-only-within-delegated-zone contract, including the tested boundary and negative cases.","root_cause":"The faulty implementation uses `name in nameservers` for the dns-glue-is-accepted-only-within-delegated-zone decision.","sha256":"3c7510c55fce651251a946aecb4b3d8451bb5e0e870f2467f4fe5da5ab77798f","title":"Dns glue is accepted only within delegated zone · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verification":{"attempt":{"elapsed_ms":55.887,"exit_code":1,"observations":[{"actual":false,"check":"fixture 2","expected":false,"passed":true},{"actual":true,"check":"fixture 3","expected":false,"passed":false},{"actual":false,"check":"fixture 4","expected":false,"passed":true},{"actual":true,"check":"fixture 1","expected":true,"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": true, \"expected\": false, \"passed\": false}, {\"check\": \"fixture 4\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": true, \"expected\": true, \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":50.85,"exit_code":1,"observations":[{"actual":true,"check":"fixture 2","expected":false,"passed":false},{"actual":true,"check":"fixture 3","expected":false,"passed":false},{"actual":true,"check":"fixture 4","expected":false,"passed":false},{"actual":true,"check":"fixture 1","expected":true,"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": true, \"expected\": false, \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": true, \"expected\": false, \"passed\": false}, {\"check\": \"fixture 4\", \"actual\": true, \"expected\": false, \"passed\": false}, {\"check\": \"fixture 1\", \"actual\": true, \"expected\": true, \"passed\": true}], \"passed\": false}\n"},"fixed":{"elapsed_ms":47.779,"exit_code":0,"observations":[{"actual":false,"check":"fixture 2","expected":false,"passed":true},{"actual":false,"check":"fixture 3","expected":false,"passed":true},{"actual":false,"check":"fixture 4","expected":false,"passed":true},{"actual":true,"check":"fixture 1","expected":true,"passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": false, \"expected\": false, \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": true, \"expected\": true, \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}