FA-28631 / HTTP redirects / Open access
Translate a redirect between internal and public application mounts: relative output authority safety · case 01
Translate a redirect between internal and public application mounts: the relative output authority safety branch emits an incorrect decision.
ROOT CAUSE
The relative-output-authority-safety decision uses 'external'; this violates the stipulated controller policy.
VERIFIED REPAIR
At this decision use "('/' + external.lstrip('/')) if external else '/'", preserving the other controller outputs.
Unsuccessful approach: The partial repair uses "external.lstrip('/')" and still fails an explicit boundary or control.
Case contract
Translate a redirect between internal and public application mounts. The explicit fixture inputs and outputs define a bounded offline policy; request identity must accompany the decision.
Why this case matters
Models a redirect controller decision before following a target or exposing a redirect result.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, path, internal, external, query, trailing, absolute):
return {'request': request, 'decision': [path == internal or path.startswith(internal.rstrip('/')+'/'), path[len(internal):] if path == internal or path.startswith(internal.rstrip('/')+'/') else path, external or '/', ('?' + query) if query else '', path+'/' if trailing and not path.endswith('/') else path, 'absolute' if absolute else 'relative', path[1:] if internal == '/' else path, external.rstrip('/') + '/' + path.lstrip('/'), external, path.startswith(internal.rstrip('/')+'/') or path == internal]}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/app/a', '/app', '/public', 'x=1', False, False), {'request': '/requests/' + str(N) + '/0', 'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '/apple/a', '/app', '/public', '', False, False), {'request': '/requests/' + str(N) + '/1', 'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/app', '/app', '/public', 'q=', True, False), {'request': '/requests/' + str(N) + '/2', 'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/app/a/app', '/app', '/v2', 'k=1&k=2', True, True), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/', '/', '/edge', '', False, True), {'request': '/requests/' + str(N) + '/4', 'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True]})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/app/a', '/app', '', 'x=2', False, True), {'request': '/requests/' + str(N) + '/5', 'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '/', True]})
check('fixture 7', solve('/requests/' + str(N) + '/6', '/app/a/', '/app', '/public/', '', True, False), {'request': '/requests/' + str(N) + '/6', 'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True], 'request': '/requests/1/0'} | {'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False], 'request': '/requests/1/1'} | {'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True], 'request': '/requests/1/2'} | {'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True], 'request': '/requests/1/3'} | {'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True], 'request': '/requests/1/4'} | {'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '', True], 'request': '/requests/1/5'} | {'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '/', True], 'request': '/requests/1/5'} | Failed |
| fixture 7 | {'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True], 'request': '/requests/1/6'} | {'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True], 'request': '/requests/1/6'} | Passed |
SHA-256 / 192ab4876797952afa01d4b6dddc0e71c175483b85c408aa3131a826ae04887d
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, path, internal, external, query, trailing, absolute):
return {'request': request, 'decision': [path == internal or path.startswith(internal.rstrip('/')+'/'), path[len(internal):] if path == internal or path.startswith(internal.rstrip('/')+'/') else path, external or '/', ('?' + query) if query else '', path+'/' if trailing and not path.endswith('/') else path, 'absolute' if absolute else 'relative', path[1:] if internal == '/' else path, external.rstrip('/') + '/' + path.lstrip('/'), external.lstrip('/'), path.startswith(internal.rstrip('/')+'/') or path == internal]}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/app/a', '/app', '/public', 'x=1', False, False), {'request': '/requests/' + str(N) + '/0', 'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '/apple/a', '/app', '/public', '', False, False), {'request': '/requests/' + str(N) + '/1', 'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/app', '/app', '/public', 'q=', True, False), {'request': '/requests/' + str(N) + '/2', 'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/app/a/app', '/app', '/v2', 'k=1&k=2', True, True), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/', '/', '/edge', '', False, True), {'request': '/requests/' + str(N) + '/4', 'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True]})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/app/a', '/app', '', 'x=2', False, True), {'request': '/requests/' + str(N) + '/5', 'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '/', True]})
check('fixture 7', solve('/requests/' + str(N) + '/6', '/app/a/', '/app', '/public/', '', True, False), {'request': '/requests/' + str(N) + '/6', 'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', 'public', True], 'request': '/requests/1/0'} | {'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True], 'request': '/requests/1/0'} | Failed |
| fixture 2 | {'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', 'public', False], 'request': '/requests/1/1'} | {'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False], 'request': '/requests/1/1'} | Failed |
| fixture 3 | {'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', 'public', True], 'request': '/requests/1/2'} | {'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True], 'request': '/requests/1/2'} | Failed |
| fixture 4 | {'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', 'v2', True], 'request': '/requests/1/3'} | {'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True], 'request': '/requests/1/3'} | Failed |
| fixture 5 | {'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', 'edge', True], 'request': '/requests/1/4'} | {'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True], 'request': '/requests/1/4'} | Failed |
| fixture 6 | {'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '', True], 'request': '/requests/1/5'} | {'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '/', True], 'request': '/requests/1/5'} | Failed |
| fixture 7 | {'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', 'public/', True], 'request': '/requests/1/6'} | {'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True], 'request': '/requests/1/6'} | Failed |
SHA-256 / 184d58c5a7617cfd7b088faadab87a84063951cc089079b7274d2040802f65f2
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
from urllib.parse import urlsplit, unquote, quote
import posixpath
import re
N = 1
observations = []
def solve(request, path, internal, external, query, trailing, absolute):
return {'request': request, 'decision': [path == internal or path.startswith(internal.rstrip('/')+'/'), path[len(internal):] if path == internal or path.startswith(internal.rstrip('/')+'/') else path, external or '/', ('?' + query) if query else '', path+'/' if trailing and not path.endswith('/') else path, 'absolute' if absolute else 'relative', path[1:] if internal == '/' else path, external.rstrip('/') + '/' + path.lstrip('/'), ('/' + external.lstrip('/')) if external else '/', path.startswith(internal.rstrip('/')+'/') or path == internal]}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('/requests/' + str(N) + '/0', '/app/a', '/app', '/public', 'x=1', False, False), {'request': '/requests/' + str(N) + '/0', 'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True]})
check('fixture 2', solve('/requests/' + str(N) + '/1', '/apple/a', '/app', '/public', '', False, False), {'request': '/requests/' + str(N) + '/1', 'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False]})
check('fixture 3', solve('/requests/' + str(N) + '/2', '/app', '/app', '/public', 'q=', True, False), {'request': '/requests/' + str(N) + '/2', 'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True]})
check('fixture 4', solve('/requests/' + str(N) + '/3', '/app/a/app', '/app', '/v2', 'k=1&k=2', True, True), {'request': '/requests/' + str(N) + '/3', 'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True]})
check('fixture 5', solve('/requests/' + str(N) + '/4', '/', '/', '/edge', '', False, True), {'request': '/requests/' + str(N) + '/4', 'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True]})
check('fixture 6', solve('/requests/' + str(N) + '/5', '/app/a', '/app', '', 'x=2', False, True), {'request': '/requests/' + str(N) + '/5', 'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '/', True]})
check('fixture 7', solve('/requests/' + str(N) + '/6', '/app/a/', '/app', '/public/', '', True, False), {'request': '/requests/' + str(N) + '/6', 'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True]})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True], 'request': '/requests/1/0'} | {'decision': [True, '/a', '/public', '?x=1', '/app/a', 'relative', '/app/a', '/public/app/a', '/public', True], 'request': '/requests/1/0'} | Passed |
| fixture 2 | {'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False], 'request': '/requests/1/1'} | {'decision': [False, '/apple/a', '/public', '', '/apple/a', 'relative', '/apple/a', '/public/apple/a', '/public', False], 'request': '/requests/1/1'} | Passed |
| fixture 3 | {'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True], 'request': '/requests/1/2'} | {'decision': [True, '', '/public', '?q=', '/app/', 'relative', '/app', '/public/app', '/public', True], 'request': '/requests/1/2'} | Passed |
| fixture 4 | {'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True], 'request': '/requests/1/3'} | {'decision': [True, '/a/app', '/v2', '?k=1&k=2', '/app/a/app/', 'absolute', '/app/a/app', '/v2/app/a/app', '/v2', True], 'request': '/requests/1/3'} | Passed |
| fixture 5 | {'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True], 'request': '/requests/1/4'} | {'decision': [True, '', '/edge', '', '/', 'absolute', '', '/edge/', '/edge', True], 'request': '/requests/1/4'} | Passed |
| fixture 6 | {'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '/', True], 'request': '/requests/1/5'} | {'decision': [True, '/a', '/', '?x=2', '/app/a', 'absolute', '/app/a', '/app/a', '/', True], 'request': '/requests/1/5'} | Passed |
| fixture 7 | {'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True], 'request': '/requests/1/6'} | {'decision': [True, '/a/', '/public/', '', '/app/a/', 'relative', '/app/a/', '/public/app/a/', '/public/', True], 'request': '/requests/1/6'} | Passed |
SHA-256 / df8325e429fac4dabdd3165559af920b21c496e4205e422e7081901d80104ecd
Verification & scope
Stipulated offline redirect policy, not a complete HTTP, browser, URL, cache, or security implementation. Numbered variants vary request correlation identity. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:41:35.676594+00:00.
Case digest / 2d764c3e91253fc326aaa248a1280e97b356565bbb586232ea9cf4bddd0898de