{"abstract":"Cors preflight cache key includes origin and method.","category":"WebSocket and browser transport policies","checks":4,"contract":"Bounded offline decision model: cors preflight cache key includes origin and method. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.","evaluation_group":"xh-cors-preflight-cache-key-includes-origin-and-method","failed_approach":"The attempted repair uses `method` and still violates a separate fixture.","family":"xh-cors-preflight-cache-key-includes-origin-and-method","id":"FA-7686","implementations":{"attempt":{"sha256":"79b690478d955bcb20d92dfb39cacd78f8b406c7b5db0cdec6c7ad51ca2d2b23","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(origin, method):\n    return method\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://a', 'PUT'), ('https://a', 'PUT'))\", \"check('fixture 2', solve('https://b', 'PUT'), ('https://b', 'PUT'))\", \"check('fixture 3', solve('https://a', 'DELETE'), ('https://a', 'DELETE'))\", \"check('fixture 4', solve('null', 'GET'), ('null', 'GET'))\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"86ac9ead290379fe160234d71d3395a44a3b36cc12ce003e89d5aca22e14d2b7","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(origin, method):\n    return origin\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://a', 'PUT'), ('https://a', 'PUT'))\", \"check('fixture 2', solve('https://b', 'PUT'), ('https://b', 'PUT'))\", \"check('fixture 3', solve('https://a', 'DELETE'), ('https://a', 'DELETE'))\", \"check('fixture 4', solve('null', 'GET'), ('null', 'GET'))\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"e521bfa38bd01c8180dce31f551178b9f304bc0ab127b94c6e559b6a0dd09f98","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(origin, method):\n    return (origin,method)\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://a', 'PUT'), ('https://a', 'PUT'))\", \"check('fixture 2', solve('https://b', 'PUT'), ('https://b', 'PUT'))\", \"check('fixture 3', solve('https://a', 'DELETE'), ('https://a', 'DELETE'))\", \"check('fixture 4', solve('null', 'GET'), ('null', 'GET'))\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xh-cors-preflight-cache-key-includes-origin-and-method","generated_at":"2026-09-29T14:38:14.280107+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"This deterministic websocket and browser transport policies model isolates the cors-preflight-cache-key-includes-origin-and-method policy at a network component boundary.","repair":"Apply the explicit cors-preflight-cache-key-includes-origin-and-method contract, including the tested boundary and negative cases.","root_cause":"The faulty implementation uses `origin` for the cors-preflight-cache-key-includes-origin-and-method decision.","sha256":"9488863a72d394146c243419060d6d051997f925084f64c0626bc64e604f6f01","title":"Cors preflight cache key includes origin and method · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verification":{"attempt":{"elapsed_ms":39.429,"exit_code":1,"observations":[{"actual":"PUT","check":"fixture 2","expected":["https://b","PUT"],"passed":false},{"actual":"DELETE","check":"fixture 3","expected":["https://a","DELETE"],"passed":false},{"actual":"GET","check":"fixture 4","expected":["null","GET"],"passed":false},{"actual":"PUT","check":"fixture 1","expected":["https://a","PUT"],"passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"PUT\", \"expected\": [\"https://b\", \"PUT\"], \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": \"DELETE\", \"expected\": [\"https://a\", \"DELETE\"], \"passed\": false}, {\"check\": \"fixture 4\", \"actual\": \"GET\", \"expected\": [\"null\", \"GET\"], \"passed\": false}, {\"check\": \"fixture 1\", \"actual\": \"PUT\", \"expected\": [\"https://a\", \"PUT\"], \"passed\": false}], \"passed\": false}\n"},"broken":{"elapsed_ms":40.773,"exit_code":1,"observations":[{"actual":"https://b","check":"fixture 2","expected":["https://b","PUT"],"passed":false},{"actual":"https://a","check":"fixture 3","expected":["https://a","DELETE"],"passed":false},{"actual":"null","check":"fixture 4","expected":["null","GET"],"passed":false},{"actual":"https://a","check":"fixture 1","expected":["https://a","PUT"],"passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"https://b\", \"expected\": [\"https://b\", \"PUT\"], \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": \"https://a\", \"expected\": [\"https://a\", \"DELETE\"], \"passed\": false}, {\"check\": \"fixture 4\", \"actual\": \"null\", \"expected\": [\"null\", \"GET\"], \"passed\": false}, {\"check\": \"fixture 1\", \"actual\": \"https://a\", \"expected\": [\"https://a\", \"PUT\"], \"passed\": false}], \"passed\": false}\n"},"fixed":{"elapsed_ms":39.054,"exit_code":0,"observations":[{"actual":["https://b","PUT"],"check":"fixture 2","expected":["https://b","PUT"],"passed":true},{"actual":["https://a","DELETE"],"check":"fixture 3","expected":["https://a","DELETE"],"passed":true},{"actual":["null","GET"],"check":"fixture 4","expected":["null","GET"],"passed":true},{"actual":["https://a","PUT"],"check":"fixture 1","expected":["https://a","PUT"],"passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": [\"https://b\", \"PUT\"], \"expected\": [\"https://b\", \"PUT\"], \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": [\"https://a\", \"DELETE\"], \"expected\": [\"https://a\", \"DELETE\"], \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": [\"null\", \"GET\"], \"expected\": [\"null\", \"GET\"], \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": [\"https://a\", \"PUT\"], \"expected\": [\"https://a\", \"PUT\"], \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}