{"abstract":"Cors preflight max age is capped by browser policy.","category":"WebSocket and browser transport policies","checks":4,"contract":"Bounded offline decision model: cors preflight max age is capped by browser policy. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.","evaluation_group":"xh-cors-preflight-max-age-is-capped-by-browser-policy","failed_approach":"The attempted repair uses `min(advertised,cap)` and still violates a separate fixture.","family":"xh-cors-preflight-max-age-is-capped-by-browser-policy","id":"FA-7696","implementations":{"attempt":{"sha256":"3d47ad7879b48ea9d6915266022ea5d7f87776138cf21a0d2d869f4d38b4346b","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(advertised, cap):\n    return min(advertised,cap)\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve(1000, 600), 600)\", \"check('fixture 2', solve(-1, 600), 0)\", \"check('fixture 3', solve(10, 600), 10)\", \"check('fixture 4', solve(0, 600), 0)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"470fe19ac6746aa7dd5e6d5bae54a8578a03f4bedc20a04927a9d4279e889971","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(advertised, cap):\n    return advertised\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve(1000, 600), 600)\", \"check('fixture 2', solve(-1, 600), 0)\", \"check('fixture 3', solve(10, 600), 10)\", \"check('fixture 4', solve(0, 600), 0)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"d07d5f92248e322a7629795a6fe2b40e5acef8d2b41dcf60dfbefb861b1cfdc0","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(advertised, cap):\n    return max(0,min(advertised,cap))\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve(1000, 600), 600)\", \"check('fixture 2', solve(-1, 600), 0)\", \"check('fixture 3', solve(10, 600), 10)\", \"check('fixture 4', solve(0, 600), 0)\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xh-cors-preflight-max-age-is-capped-by-browser-policy","generated_at":"2026-09-29T14:38:14.422410+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"This deterministic websocket and browser transport policies model isolates the cors-preflight-max-age-is-capped-by-browser-policy policy at a network component boundary.","repair":"Apply the explicit cors-preflight-max-age-is-capped-by-browser-policy contract, including the tested boundary and negative cases.","root_cause":"The faulty implementation uses `advertised` for the cors-preflight-max-age-is-capped-by-browser-policy decision.","sha256":"f0daa6734d8724646d948e93a970760d4f00faf869238ffaf6012dd40b014526","title":"Cors preflight max age is capped by browser policy · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verification":{"attempt":{"elapsed_ms":39.354,"exit_code":1,"observations":[{"actual":-1,"check":"fixture 2","expected":0,"passed":false},{"actual":10,"check":"fixture 3","expected":10,"passed":true},{"actual":0,"check":"fixture 4","expected":0,"passed":true},{"actual":600,"check":"fixture 1","expected":600,"passed":true}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": -1, \"expected\": 0, \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": 10, \"expected\": 10, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": 0, \"expected\": 0, \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": 600, \"expected\": 600, \"passed\": true}], \"passed\": false}\n"},"broken":{"elapsed_ms":39.882,"exit_code":1,"observations":[{"actual":-1,"check":"fixture 2","expected":0,"passed":false},{"actual":10,"check":"fixture 3","expected":10,"passed":true},{"actual":0,"check":"fixture 4","expected":0,"passed":true},{"actual":1000,"check":"fixture 1","expected":600,"passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": -1, \"expected\": 0, \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": 10, \"expected\": 10, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": 0, \"expected\": 0, \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": 1000, \"expected\": 600, \"passed\": false}], \"passed\": false}\n"},"fixed":{"elapsed_ms":42.393,"exit_code":0,"observations":[{"actual":0,"check":"fixture 2","expected":0,"passed":true},{"actual":10,"check":"fixture 3","expected":10,"passed":true},{"actual":0,"check":"fixture 4","expected":0,"passed":true},{"actual":600,"check":"fixture 1","expected":600,"passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": 0, \"expected\": 0, \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": 10, \"expected\": 10, \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": 0, \"expected\": 0, \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": 600, \"expected\": 600, \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}