{"abstract":"Listing a single office IP without \"/32\" opens the feature to the whole internet.","category":"Feature flag rollout bucketing","checks":8,"contract":"ip is dotted-quad IPv4 with octets 0..255 (else return None). Each cidr is \"a.b.c.d/n\" with 0 <= n <= 32, or a bare address meaning /32; malformed entries are skipped. An entry matches when the top n bits of ip and of its address agree (host bits of the entry are ignored). Return [True, index of first match] or [False, -1].","evaluation_group":"w2-feature-flag-rollout-bucketing-cidr-allowlist","failed_approach":"Defaulting to /24 still widens a single address to its neighbours.","family":"w2-feature-flag-rollout-bucketing-cidr-allowlist-bare-address","id":"FA-74166","implementations":{"attempt":{"sha256":"69418630331c454a7294dd9799a98c209a672d58e47cc9632a1e2da6b7fc85cf","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(ip, cidrs):\n    def parse(s):\n        parts = s.split('.')\n        if len(parts) != 4 or not all(p.isdigit() and int(p) <= 255 for p in parts):\n            return None\n        v = 0\n        for p in parts:\n            v = v * 256 + int(p)\n        return v\n    addr = parse(ip)\n    if addr is None:\n        return None\n    for i, c in enumerate(cidrs):\n        net, _, bits = c.partition('/')\n        bits = bits or '24'\n        base = parse(net)\n        if base is None or not bits.isdigit() or int(bits) > 32:\n            continue\n        n = int(bits)\n        mask = ((1 << n) - 1) << (32 - n)\n        if addr & mask == base & mask:\n            return [True, i]\n    return [False, -1]\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\nfixtures = [[('slash 24 matches inside the network', ['10.1.2.3', ['192.168.0.0/16', '10.1.2.0/24']], [True, 1]),\n  ('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),\n  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('network sample 1', ['10.1.2.0', ['8.8.8.0', '10.1.2.3/32', '10.0.0.0/8']], [True, 2]),\n  ('network sample 2', ['8.8.8.8', ['10.1.2.3/32']], [False, -1]),\n  ('network sample 3', ['10.1.2.0', ['1.0.0.256/8']], [False, -1])],\n [('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),\n  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),\n  ('network sample 35', ['172.16.5.4', ['8.8.8.0']], [False, -1]),\n  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1])],\n [('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),\n  ('network sample 11', ['10.1.2.3', ['192.168.1.0/24']], [False, -1]),\n  ('network sample 12', ['0.0.0.0', ['0.0.0.0/0', '172.16.0.0/12']], [True, 0])],\n [('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),\n  ('network sample 16', ['10.1.2.0', ['1.0.0.256/8']], [False, -1]),\n  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1]),\n  ('network sample 48', ['0.0.0.0', ['8.8.8.0', '192.168.1.0/24', '172.16.5.4/30']], [False, -1])],\n [('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),\n  ('prefix longer than 32 is skipped', ['10.0.0.1', ['10.0.0.0/33', '10.0.0.0/8']], [True, 1]),\n  ('network sample 14', ['172.16.5.4', ['10.0.0.0/33', '10.1.2.3/32', '8.8.8.0']], [False, -1]),\n  ('network sample 21', ['10.1.2.3', ['10.1.2.3', '192.168.1.0/24']], [True, 0]),\n  ('network sample 22', ['10.1.2.0', ['192.168.0.0/16', '10.0.0.0/8', '8.8.8.0']], [True, 1])]]\nfor label, args, expected in fixtures[N - 1]:\n    check(label, solve(*args), expected)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"8e8fc4ab5ed0e3f34c084440ed207c4c8e77b7db22a15458e59921d62a2b396e","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(ip, cidrs):\n    def parse(s):\n        parts = s.split('.')\n        if len(parts) != 4 or not all(p.isdigit() and int(p) <= 255 for p in parts):\n            return None\n        v = 0\n        for p in parts:\n            v = v * 256 + int(p)\n        return v\n    addr = parse(ip)\n    if addr is None:\n        return None\n    for i, c in enumerate(cidrs):\n        net, _, bits = c.partition('/')\n        bits = bits or '0'\n        base = parse(net)\n        if base is None or not bits.isdigit() or int(bits) > 32:\n            continue\n        n = int(bits)\n        mask = ((1 << n) - 1) << (32 - n)\n        if addr & mask == base & mask:\n            return [True, i]\n    return [False, -1]\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\nfixtures = [[('slash 24 matches inside the network', ['10.1.2.3', ['192.168.0.0/16', '10.1.2.0/24']], [True, 1]),\n  ('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),\n  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('network sample 1', ['10.1.2.0', ['8.8.8.0', '10.1.2.3/32', '10.0.0.0/8']], [True, 2]),\n  ('network sample 2', ['8.8.8.8', ['10.1.2.3/32']], [False, -1]),\n  ('network sample 3', ['10.1.2.0', ['1.0.0.256/8']], [False, -1])],\n [('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),\n  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),\n  ('network sample 35', ['172.16.5.4', ['8.8.8.0']], [False, -1]),\n  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1])],\n [('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),\n  ('network sample 11', ['10.1.2.3', ['192.168.1.0/24']], [False, -1]),\n  ('network sample 12', ['0.0.0.0', ['0.0.0.0/0', '172.16.0.0/12']], [True, 0])],\n [('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),\n  ('network sample 16', ['10.1.2.0', ['1.0.0.256/8']], [False, -1]),\n  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1]),\n  ('network sample 48', ['0.0.0.0', ['8.8.8.0', '192.168.1.0/24', '172.16.5.4/30']], [False, -1])],\n [('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),\n  ('prefix longer than 32 is skipped', ['10.0.0.1', ['10.0.0.0/33', '10.0.0.0/8']], [True, 1]),\n  ('network sample 14', ['172.16.5.4', ['10.0.0.0/33', '10.1.2.3/32', '8.8.8.0']], [False, -1]),\n  ('network sample 21', ['10.1.2.3', ['10.1.2.3', '192.168.1.0/24']], [True, 0]),\n  ('network sample 22', ['10.1.2.0', ['192.168.0.0/16', '10.0.0.0/8', '8.8.8.0']], [True, 1])]]\nfor label, args, expected in fixtures[N - 1]:\n    check(label, solve(*args), expected)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"846b75e5c9cb3082550258d97ef02d3d9838e94078ad53b830eb9ef936f3ee98","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\n\nN = 1\nobservations = []\ndef solve(ip, cidrs):\n    def parse(s):\n        parts = s.split('.')\n        if len(parts) != 4 or not all(p.isdigit() and int(p) <= 255 for p in parts):\n            return None\n        v = 0\n        for p in parts:\n            v = v * 256 + int(p)\n        return v\n    addr = parse(ip)\n    if addr is None:\n        return None\n    for i, c in enumerate(cidrs):\n        net, _, bits = c.partition('/')\n        bits = bits or '32'\n        base = parse(net)\n        if base is None or not bits.isdigit() or int(bits) > 32:\n            continue\n        n = int(bits)\n        mask = ((1 << n) - 1) << (32 - n)\n        if addr & mask == base & mask:\n            return [True, i]\n    return [False, -1]\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\nfixtures = [[('slash 24 matches inside the network', ['10.1.2.3', ['192.168.0.0/16', '10.1.2.0/24']], [True, 1]),\n  ('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),\n  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('network sample 1', ['10.1.2.0', ['8.8.8.0', '10.1.2.3/32', '10.0.0.0/8']], [True, 2]),\n  ('network sample 2', ['8.8.8.8', ['10.1.2.3/32']], [False, -1]),\n  ('network sample 3', ['10.1.2.0', ['1.0.0.256/8']], [False, -1])],\n [('slash 0 matches everything', ['8.8.8.8', ['0.0.0.0/0']], [True, 0]),\n  ('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),\n  ('network sample 35', ['172.16.5.4', ['8.8.8.0']], [False, -1]),\n  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1])],\n [('octet 256 in an entry is malformed', ['1.0.0.0', ['1.0.0.256/8']], [False, -1]),\n  ('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('network sample 6', ['172.16.5.4', ['192.168.0.0/16', '8.8.8.0', '10.1.2.77/24']], [False, -1]),\n  ('network sample 11', ['10.1.2.3', ['192.168.1.0/24']], [False, -1]),\n  ('network sample 12', ['0.0.0.0', ['0.0.0.0/0', '172.16.0.0/12']], [True, 0])],\n [('octet 255 is valid', ['192.168.0.255', ['192.168.0.255']], [True, 0]),\n  ('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),\n  ('network sample 16', ['10.1.2.0', ['1.0.0.256/8']], [False, -1]),\n  ('network sample 37', ['10.1.2.0', ['192.168.0.0/16', '172.16.0.0/12', '10.1.2.3']], [False, -1]),\n  ('network sample 48', ['0.0.0.0', ['8.8.8.0', '192.168.1.0/24', '172.16.5.4/30']], [False, -1])],\n [('bare address means host route', ['10.1.2.4', ['10.1.2.3']], [False, -1]),\n  ('entry with host bits still matches its network', ['10.1.2.9', ['10.1.2.77/24']], [True, 0]),\n  ('network address itself matches', ['10.1.2.0', ['10.1.2.0/24']], [True, 0]),\n  ('invalid ip returns None', ['10.0.0.300', ['0.0.0.0/0']], None),\n  ('prefix longer than 32 is skipped', ['10.0.0.1', ['10.0.0.0/33', '10.0.0.0/8']], [True, 1]),\n  ('network sample 14', ['172.16.5.4', ['10.0.0.0/33', '10.1.2.3/32', '8.8.8.0']], [False, -1]),\n  ('network sample 21', ['10.1.2.3', ['10.1.2.3', '192.168.1.0/24']], [True, 0]),\n  ('network sample 22', ['10.1.2.0', ['192.168.0.0/16', '10.0.0.0/8', '8.8.8.0']], [True, 1])]]\nfor label, args, expected in fixtures[N - 1]:\n    check(label, solve(*args), expected)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"A deterministic toy flag-evaluation model with a stipulated contract; it does not reproduce any vendor SDK byte for byte. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"w2-feature-flag-rollout-bucketing-cidr-allowlist-bare-address","generated_at":"2026-09-29T14:48:54.174193+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"Office and VPN allowlists gate internal features by source network.","repair":"Treat an entry without \"/n\" as a /32 host route.","root_cause":"A missing prefix length defaults to 0 instead of 32.","sha256":"f122d0c109c645407accef9a187d9e59ea85c7f7fb030c6b84afa19335e1f50a","title":"Network allowlist clause: A bare address allows every source · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verification":{"attempt":{"elapsed_ms":40.866,"exit_code":1,"observations":[{"actual":[true,1],"check":"slash 24 matches inside the network","expected":[true,1],"passed":true},{"actual":[true,0],"check":"slash 0 matches everything","expected":[true,0],"passed":true},{"actual":[false,-1],"check":"octet 256 in an entry is malformed","expected":[false,-1],"passed":true},{"actual":[true,0],"check":"octet 255 is valid","expected":[true,0],"passed":true},{"actual":[true,0],"check":"bare address means host route","expected":[false,-1],"passed":false},{"actual":[true,2],"check":"network sample 1","expected":[true,2],"passed":true},{"actual":[false,-1],"check":"network sample 2","expected":[false,-1],"passed":true},{"actual":[false,-1],"check":"network sample 3","expected":[false,-1],"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"slash 24 matches inside the network\", \"actual\": [true, 1], \"expected\": [true, 1], \"passed\": true}, {\"check\": \"slash 0 matches everything\", \"actual\": [true, 0], \"expected\": [true, 0], \"passed\": true}, {\"check\": \"octet 256 in an entry is malformed\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}, {\"check\": \"octet 255 is valid\", \"actual\": [true, 0], \"expected\": [true, 0], \"passed\": true}, {\"check\": \"bare address means host route\", \"actual\": [true, 0], \"expected\": [false, -1], \"passed\": false}, {\"check\": \"network sample 1\", \"actual\": [true, 2], \"expected\": [true, 2], \"passed\": true}, {\"check\": \"network sample 2\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}, {\"check\": \"network sample 3\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":43.772,"exit_code":1,"observations":[{"actual":[true,1],"check":"slash 24 matches inside the network","expected":[true,1],"passed":true},{"actual":[true,0],"check":"slash 0 matches everything","expected":[true,0],"passed":true},{"actual":[false,-1],"check":"octet 256 in an entry is malformed","expected":[false,-1],"passed":true},{"actual":[true,0],"check":"octet 255 is valid","expected":[true,0],"passed":true},{"actual":[true,0],"check":"bare address means host route","expected":[false,-1],"passed":false},{"actual":[true,0],"check":"network sample 1","expected":[true,2],"passed":false},{"actual":[false,-1],"check":"network sample 2","expected":[false,-1],"passed":true},{"actual":[false,-1],"check":"network sample 3","expected":[false,-1],"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"slash 24 matches inside the network\", \"actual\": [true, 1], \"expected\": [true, 1], \"passed\": true}, {\"check\": \"slash 0 matches everything\", \"actual\": [true, 0], \"expected\": [true, 0], \"passed\": true}, {\"check\": \"octet 256 in an entry is malformed\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}, {\"check\": \"octet 255 is valid\", \"actual\": [true, 0], \"expected\": [true, 0], \"passed\": true}, {\"check\": \"bare address means host route\", \"actual\": [true, 0], \"expected\": [false, -1], \"passed\": false}, {\"check\": \"network sample 1\", \"actual\": [true, 0], \"expected\": [true, 2], \"passed\": false}, {\"check\": \"network sample 2\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}, {\"check\": \"network sample 3\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}], \"passed\": false}\n"},"fixed":{"elapsed_ms":38.974,"exit_code":0,"observations":[{"actual":[true,1],"check":"slash 24 matches inside the network","expected":[true,1],"passed":true},{"actual":[true,0],"check":"slash 0 matches everything","expected":[true,0],"passed":true},{"actual":[false,-1],"check":"octet 256 in an entry is malformed","expected":[false,-1],"passed":true},{"actual":[true,0],"check":"octet 255 is valid","expected":[true,0],"passed":true},{"actual":[false,-1],"check":"bare address means host route","expected":[false,-1],"passed":true},{"actual":[true,2],"check":"network sample 1","expected":[true,2],"passed":true},{"actual":[false,-1],"check":"network sample 2","expected":[false,-1],"passed":true},{"actual":[false,-1],"check":"network sample 3","expected":[false,-1],"passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"slash 24 matches inside the network\", \"actual\": [true, 1], \"expected\": [true, 1], \"passed\": true}, {\"check\": \"slash 0 matches everything\", \"actual\": [true, 0], \"expected\": [true, 0], \"passed\": true}, {\"check\": \"octet 256 in an entry is malformed\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}, {\"check\": \"octet 255 is valid\", \"actual\": [true, 0], \"expected\": [true, 0], \"passed\": true}, {\"check\": \"bare address means host route\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}, {\"check\": \"network sample 1\", \"actual\": [true, 2], \"expected\": [true, 2], \"passed\": true}, {\"check\": \"network sample 2\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}, {\"check\": \"network sample 3\", \"actual\": [false, -1], \"expected\": [false, -1], \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}