FA-7106 / Network routing / Open access

Wildcard host route covers subdomains but not apex · case 01

Wildcard host route covers subdomains but not apex.

Verified by executionVariant 1 · 4 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The faulty implementation uses `host.endswith(suffix)` for the wildcard-host-route-covers-subdomains-but-not-apex decision.

VERIFIED REPAIR

Apply the explicit wildcard-host-route-covers-subdomains-but-not-apex contract, including the tested boundary and negative cases.

Unsuccessful approach: The attempted repair uses `host == suffix or host.endswith("."+suffix)` and still violates a separate fixture.

Case contract

Bounded offline decision model: wildcard host route covers subdomains but not apex. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.

Why this case matters

This deterministic network routing model isolates the wildcard-host-route-covers-subdomains-but-not-apex policy at a network component boundary.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(host, suffix):
    return host.endswith(suffix)
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('a.example.com', 'example.com'), True)", "check('fixture 2', solve('example.com', 'example.com'), False)", "check('fixture 3', solve('badexample.com', 'example.com'), False)", "check('fixture 4', solve('a.b.example.com', 'example.com'), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`True`	`False`	Failed
fixture 3	`True`	`False`	Failed
fixture 4	`True`	`True`	Passed
fixture 1	`True`	`True`	Passed

SHA-256 / 94b7f6930fa46fd264411a63206ea5166fb1a0907292ff7ae37b2923daa7ddc9

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(host, suffix):
    return host == suffix or host.endswith("."+suffix)
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('a.example.com', 'example.com'), True)", "check('fixture 2', solve('example.com', 'example.com'), False)", "check('fixture 3', solve('badexample.com', 'example.com'), False)", "check('fixture 4', solve('a.b.example.com', 'example.com'), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`True`	`False`	Failed
fixture 3	`False`	`False`	Passed
fixture 4	`True`	`True`	Passed
fixture 1	`True`	`True`	Passed

SHA-256 / 0a4c8afb0713164e95a17f86829fbc9c0789214e516144748b3b0daa46b40bf4

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(host, suffix):
    return host.endswith("."+suffix) and host != suffix
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('a.example.com', 'example.com'), True)", "check('fixture 2', solve('example.com', 'example.com'), False)", "check('fixture 3', solve('badexample.com', 'example.com'), False)", "check('fixture 4', solve('a.b.example.com', 'example.com'), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`False`	`False`	Passed
fixture 3	`False`	`False`	Passed
fixture 4	`True`	`True`	Passed
fixture 1	`True`	`True`	Passed

SHA-256 / 4e7a7ab516205eaa0f4b6c2c3c553a1dcf4226798ad8e01359564f46c43ae1ca

Verification & scope

Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:08.474004+00:00.

Case digest / 6ea906a86b6bd3c7afb3fa4a5840f65454581cbf75ce5d45086b1616a0ee41a1