FA-7391 / DNS resolution / Open access

Dns glue is accepted only within delegated zone · case 01

Dns glue is accepted only within delegated zone.

Verified by executionVariant 1 · 4 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The faulty implementation uses `name in nameservers` for the dns-glue-is-accepted-only-within-delegated-zone decision.

VERIFIED REPAIR

Apply the explicit dns-glue-is-accepted-only-within-delegated-zone contract, including the tested boundary and negative cases.

Unsuccessful approach: The attempted repair uses `name.endswith(zone) and type_ in ("A","AAAA")` and still violates a separate fixture.

Case contract

Given name, zone, type_, nameservers, dns glue is accepted only within delegated zone. Return the protocol decision or transformed value; fields are validated and fixtures state boundary outcomes.

Why this case matters

This deterministic dns resolution model isolates the dns-glue-is-accepted-only-within-delegated-zone policy at a network component boundary.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(name, zone, type_, nameservers):
    return name in nameservers
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('ns.child', 'child', 'A', ['ns.child']), True)", "check('fixture 2', solve('ns.evil', 'child', 'A', ['ns.evil']), False)", "check('fixture 3', solve('badchild', 'child', 'A', ['badchild']), False)", "check('fixture 4', solve('ns.child', 'child', 'TXT', ['ns.child']), False)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`True`	`False`	Failed
fixture 3	`True`	`False`	Failed
fixture 4	`True`	`False`	Failed
fixture 1	`True`	`True`	Passed

SHA-256 / 958ada2d844c5e97ab9059a188cc0f2ead1f770b37795648ae3bc9ba7e9b1020

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(name, zone, type_, nameservers):
    return name.endswith(zone) and type_ in ("A","AAAA")
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('ns.child', 'child', 'A', ['ns.child']), True)", "check('fixture 2', solve('ns.evil', 'child', 'A', ['ns.evil']), False)", "check('fixture 3', solve('badchild', 'child', 'A', ['badchild']), False)", "check('fixture 4', solve('ns.child', 'child', 'TXT', ['ns.child']), False)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`False`	`False`	Passed
fixture 3	`True`	`False`	Failed
fixture 4	`False`	`False`	Passed
fixture 1	`True`	`True`	Passed

SHA-256 / a2d78900b0ccde94dc2045f14b77de4a5e9bb05dde3a459cc88bb2e4edac5c26

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(name, zone, type_, nameservers):
    return name in nameservers and type_ in ("A","AAAA") and (name == zone or name.endswith("."+zone))
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('ns.child', 'child', 'A', ['ns.child']), True)", "check('fixture 2', solve('ns.evil', 'child', 'A', ['ns.evil']), False)", "check('fixture 3', solve('badchild', 'child', 'A', ['badchild']), False)", "check('fixture 4', solve('ns.child', 'child', 'TXT', ['ns.child']), False)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`False`	`False`	Passed
fixture 3	`False`	`False`	Passed
fixture 4	`False`	`False`	Passed
fixture 1	`True`	`True`	Passed

SHA-256 / 76cf585c0ed55f1d15079d7269e935cba66b7f4e9bd1f18661c5e545aaa9cf49

Verification & scope

Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:11.444752+00:00.

Case digest / 3c7510c55fce651251a946aecb4b3d8451bb5e0e870f2467f4fe5da5ab77798f