{
  "page_id": "P22",
  "checked_at_utc": "2026-10-25T14:30:52.867341+00:00",
  "runtime": {
    "name": "CPython",
    "version": "3.12.14",
    "expected_version": "3.12.14",
    "matches_pin": true,
    "release_source_commit": "2abcf904b8dac8c999d2b3aac76681abb333798a",
    "expected_release_source_commit": "2abcf904b8dac8c999d2b3aac76681abb333798a",
    "embedded_build_commit": "Not exposed by this binary",
    "executable_sha256": "811e2679c20fd2c7413f7c5ca28ce903065eea8dadb8660f1b9379a28959a480"
  },
  "source": "data/examples/url-fetch-policy-boundaries/fetch_policy.py",
  "source_sha256": "99b30b8f5f23f280b4086218a37dfd7db8f3dce66865f57b6ad1abf29aef5a1f",
  "harness_sha256": "2aec4456305118de777472b6f8e86377d277eab56e8609821df4a8eb7d8bbb93",
  "runner": "data/examples/url-boundary-tests/run_local.py",
  "command": "PYTHONDONTWRITEBYTECODE=1 python3 data/examples/url-boundary-tests/run_local.py --output local-test-results",
  "network": {
    "scope": "Temporary local fixture server only; audit hook rejects all other connections and DNS",
    "actual_bind_address_and_port": "Intentionally not published",
    "local_connections": 14,
    "numeric_local_resolution": 0,
    "nonfixture_attempts": 0,
    "system_dns_attempts": 0,
    "zero_attempt_assertions": "Passed after reading measured counters"
  },
  "strict_classifier": [
    {
      "category": "private_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "loopback_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "link_local_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "multicast_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "reserved_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "unspecified_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "shared_address_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "documentation_ipv4",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "private_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "loopback_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "deprecated_site_local_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "well_known_nat64_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "link_local_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "multicast_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "unspecified_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "documentation_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "ipv4_mapped_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    },
    {
      "category": "transition_ipv6",
      "outcome": "refused",
      "reason": "Resolved address prohibited"
    }
  ],
  "nat64_limit": {
    "scope": "Classifier-only; no NAT64 or DNS64 network executed",
    "well_known_prefix": "64:ff9b::/96",
    "example_is_reserved": true,
    "example_in_reserved_zero_slash8": true,
    "operator_assigned_prefixes": "Not detected or decoded; internal IPv4 destinations may remain unrecognized"
  },
  "fixture_policy_tests": [
    {
      "case": "allowed_fixture",
      "outcome": "returned",
      "message": "16 body bytes",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/ok",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 200,
          "location": null,
          "response_bytes": 79
        }
      ]
    },
    {
      "case": "allowed_redirect",
      "outcome": "returned",
      "message": "16 body bytes",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        },
        {
          "host": "next.example.test",
          "port": 80
        }
      ],
      "request_count": 2,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        },
        {
          "checked_numeric_address": "198.51.100.20",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/redirect",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 302,
          "location": "http://next.example.test/ok",
          "response_bytes": 118
        },
        {
          "hop": 1,
          "scheme": "http",
          "host": "next.example.test",
          "port": 80,
          "path": "/ok",
          "checked_address": "198.51.100.20",
          "resolved_count": 1,
          "status": 200,
          "location": null,
          "response_bytes": 79
        }
      ]
    },
    {
      "case": "one_resolution_no_hidden_lookup",
      "outcome": "returned",
      "message": "16 body bytes",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/ok",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 200,
          "location": null,
          "response_bytes": 79
        }
      ],
      "unconsumed_second_answer": "Loopback representative; never consulted"
    },
    {
      "case": "rebind_on_next_hop",
      "outcome": "Refused",
      "message": "Resolved address prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        },
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/same-host",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 302,
          "location": "http://example.test/ok",
          "response_bytes": 113
        }
      ]
    },
    {
      "case": "mixed_answer_refused",
      "outcome": "Refused",
      "message": "Resolved address prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "empty_answer_refused",
      "outcome": "Refused",
      "message": "Empty address answer",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "outside_redirect_refused",
      "outcome": "Refused",
      "message": "Scheme, host or port prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/outside",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 302,
          "location": "http://outside.invalid/ok",
          "response_bytes": 116
        }
      ]
    },
    {
      "case": "relative_redirect_refused",
      "outcome": "Refused",
      "message": "Scheme, host or port prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/relative",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 302,
          "location": "/ok",
          "response_bytes": 94
        }
      ]
    },
    {
      "case": "hop_limit",
      "outcome": "Refused",
      "message": "Redirect hop limit",
      "limits": {
        "max_hops": 2,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        },
        {
          "host": "example.test",
          "port": 80
        },
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 3,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        },
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        },
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/loop",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 302,
          "location": "http://example.test/loop",
          "response_bytes": 115
        },
        {
          "hop": 1,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/loop",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 302,
          "location": "http://example.test/loop",
          "response_bytes": 115
        },
        {
          "hop": 2,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/loop",
          "checked_address": "192.0.2.10",
          "resolved_count": 1,
          "status": 302,
          "location": "http://example.test/loop",
          "response_bytes": 115
        }
      ]
    },
    {
      "case": "size_limit",
      "outcome": "Refused",
      "message": "Total response size limit",
      "limits": {
        "max_hops": 3,
        "max_bytes": 128,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/large",
          "checked_address": "192.0.2.10",
          "resolved_count": 1
        }
      ]
    },
    {
      "case": "total_deadline",
      "outcome": "TimeoutError",
      "message": "",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 0.05
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/slow",
          "checked_address": "192.0.2.10",
          "resolved_count": 1
        }
      ]
    },
    {
      "case": "transfer_coding_refused",
      "outcome": "Refused",
      "message": "Transfer coding unsupported",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/coding",
          "checked_address": "192.0.2.10",
          "resolved_count": 1
        }
      ]
    },
    {
      "case": "duplicate_header_refused",
      "outcome": "Refused",
      "message": "Duplicate response header",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [
        {
          "host": "example.test",
          "port": 80
        }
      ],
      "request_count": 1,
      "checked_connections": [
        {
          "checked_numeric_address": "192.0.2.10",
          "numeric_only_flag": true,
          "transport": "Explicit fixture-only local mapping"
        }
      ],
      "hops": [
        {
          "hop": 0,
          "scheme": "http",
          "host": "example.test",
          "port": 80,
          "path": "/duplicate",
          "checked_address": "192.0.2.10",
          "resolved_count": 1
        }
      ]
    },
    {
      "case": "scheme_refused",
      "outcome": "Refused",
      "message": "Scheme, host or port prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "host_refused",
      "outcome": "Refused",
      "message": "Scheme, host or port prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "port_refused",
      "outcome": "Refused",
      "message": "Scheme, host or port prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "userinfo_refused",
      "outcome": "Refused",
      "message": "Credentials prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "backslash_refused",
      "outcome": "Refused",
      "message": "URL contains unsupported characters",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "control_refused",
      "outcome": "Refused",
      "message": "URL contains unsupported characters",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "bad_percent_refused",
      "outcome": "Refused",
      "message": "Malformed percent escape",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "empty_query_refused",
      "outcome": "Refused",
      "message": "Query and fragment delimiters prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "nonempty_query_refused",
      "outcome": "Refused",
      "message": "Query and fragment delimiters prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "empty_fragment_refused",
      "outcome": "Refused",
      "message": "Query and fragment delimiters prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    },
    {
      "case": "nonempty_fragment_refused",
      "outcome": "Refused",
      "message": "Query and fragment delimiters prohibited",
      "limits": {
        "max_hops": 3,
        "max_bytes": 65536,
        "total_seconds": 2.0
      },
      "resolver_calls": [],
      "request_count": 0,
      "checked_connections": [],
      "hops": []
    }
  ],
  "fixture_boundary": {
    "strict_gate": "The unmodified classifier rejects documentation ranges, including both addresses used below.",
    "test_only_grant": "Exactly 192.0.2.10 and 198.51.100.20 were granted inside this published local test runner, after strict-classifier tests.",
    "test_only_mapping": "The connector was given the checked numeric address and AI_NUMERICHOST; an explicit local-test adapter mapped it to the temporary local server.",
    "not_demonstrated": [
      "Public DNS or public-network connections",
      "HTTPS certificate/SNI behavior",
      "Production deployment security review"
    ]
  },
  "summary": {
    "strict_refusals": 18,
    "fixture_cases": 24,
    "failed": 0
  }
}