{"abstract":"Cors origin wildcard is incompatible with credentialed response.","category":"WebSocket and browser transport policies","checks":4,"contract":"Bounded offline decision model: cors origin wildcard is incompatible with credentialed response. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.","contract_signature":"origin, credentials","evaluation_group":"xh-cors-origin-wildcard-is-incompatible-with-credentialed-response","failed_approach":"The attempted repair uses `origin != \"*\"` and still violates a separate fixture.","family":"xh-cors-origin-wildcard-is-incompatible-with-credentialed-response","id":"FA-7666","implementations":{"attempt":{"sha256":"ef9d7b8e47f12829e94506805c77e2690437b6174e296611c551afd6a2dde7b5","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(origin, credentials):\n    return origin != \"*\"\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('*', True), False)\", \"check('fixture 2', solve('*', False), True)\", \"check('fixture 3', solve('https://a', True), True)\", \"check('fixture 4', solve('https://a', False), True)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"fa1e9269eb21da2e64fcba74622a3d5dd5db636221bb5f0e87b0bb519a53f670","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(origin, credentials):\n    return True\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('*', True), False)\", \"check('fixture 2', solve('*', False), True)\", \"check('fixture 3', solve('https://a', True), True)\", \"check('fixture 4', solve('https://a', False), True)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xh-cors-origin-wildcard-is-incompatible-with-credentialed-response","generated_at":"2026-09-29T14:38:14.160801+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"This deterministic websocket and browser transport policies model isolates the cors-origin-wildcard-is-incompatible-with-credentialed-response policy at a network component boundary.","root_cause":"The faulty implementation uses `True` for the cors-origin-wildcard-is-incompatible-with-credentialed-response decision.","sha256":"21b0f85f79b2edbc4c4694637f0041a3baf7a137548ff2c5400b675ad7da5f5d","title":"Cors origin wildcard is incompatible with credentialed response · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verified":true,"visibility":"public","verification":{"attempt":{"elapsed_ms":38.393,"exit_code":1,"observations":[{"actual":false,"check":"fixture 2","expected":true,"passed":false},{"actual":true,"check":"fixture 3","expected":true,"passed":true},{"actual":true,"check":"fixture 4","expected":true,"passed":true},{"actual":false,"check":"fixture 1","expected":false,"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": false, \"expected\": true, \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": false, \"expected\": false, \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":38.094,"exit_code":1,"observations":[{"actual":true,"check":"fixture 2","expected":true,"passed":true},{"actual":true,"check":"fixture 3","expected":true,"passed":true},{"actual":true,"check":"fixture 4","expected":true,"passed":true},{"actual":true,"check":"fixture 1","expected":false,"passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": true, \"expected\": true, \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": true, \"expected\": false, \"passed\": false}], \"passed\": false}\n"}},"member_only":{"stages":["fixed"],"fields":["implementations.fixed","verification.fixed","harness","repair"],"note":"The verified repair, its recorded checks, the repair description, and the scoring harness are available to members."}}