{
  "schema_version": 1,
  "fixture_version": "1.0.0",
  "started_at": "2026-11-10T22:48:56.124146+00:00",
  "method": "Real curl subprocesses against two locally spawned fixture modes",
  "scope": {
    "hosts": [
      "127.0.0.1"
    ],
    "methods": [
      "POST"
    ],
    "paths": [
      "/reset-password"
    ],
    "data": "One synthetic account with a fixed demo reset token; all values below are public demo data"
  },
  "versions": {
    "python": "3.15.2",
    "os": "Darwin",
    "architecture": "arm64",
    "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0"
  },
  "sha256": {
    "fixture.py": "85c66063f5899d9ee088476cf2381778ec34105eca8e4db2d1ed09d3d52057e9",
    "verify.py": "b10d56146896b8bcaabef442d25140f8dc1f06dc3dc79b45ce365b8400b68f67"
  },
  "reproduction_command": "python3 verify.py --output recorded-run",
  "agent_execution": {
    "executed": false,
    "note": "HTTP verification was scripted; no model or Excession agent ran"
  },
  "cases": [
    {
      "id": "vulnerable/legit",
      "started_at": "2026-11-10T22:48:56.164280+00:00",
      "elapsed_ms": 7.532,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:54539"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: app.example.test",
        "--data-binary",
        "{\"email\": \"victim@example.test\"}",
        "http://127.0.0.1:54539/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "app.example.test",
      "request_x_forwarded_host": null,
      "email": "victim@example.test",
      "demonstration_expected_status": 202,
      "observed_status": 202,
      "observed_body": {
        "status": "accepted"
      },
      "expected_outbox_entry_added": true,
      "observed_outbox_entry_added": true,
      "expected_link_host": "app.example.test",
      "observed_link_host": "app.example.test",
      "observed_link": "https://app.example.test/reset?token=a93fd21c7e4b4f0f9d3b6c8a1e2f5d7c",
      "token_in_link": true,
      "matches_demonstration": true,
      "response_file": "vulnerable-legit.http",
      "response_sha256": "11251588eabb561c1ade4bf9c28ecf81e385e072e0ac939b43d2d409a6eab2f1"
    },
    {
      "id": "vulnerable/forged-host",
      "started_at": "2026-11-10T22:48:56.171889+00:00",
      "elapsed_ms": 6.247,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:54539"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: attacker.evil",
        "--data-binary",
        "{\"email\": \"victim@example.test\"}",
        "http://127.0.0.1:54539/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "attacker.evil",
      "request_x_forwarded_host": null,
      "email": "victim@example.test",
      "demonstration_expected_status": 202,
      "observed_status": 202,
      "observed_body": {
        "status": "accepted"
      },
      "expected_outbox_entry_added": true,
      "observed_outbox_entry_added": true,
      "expected_link_host": "attacker.evil",
      "observed_link_host": "attacker.evil",
      "observed_link": "https://attacker.evil/reset?token=a93fd21c7e4b4f0f9d3b6c8a1e2f5d7c",
      "token_in_link": true,
      "matches_demonstration": true,
      "response_file": "vulnerable-forged-host.http",
      "response_sha256": "11251588eabb561c1ade4bf9c28ecf81e385e072e0ac939b43d2d409a6eab2f1"
    },
    {
      "id": "vulnerable/forged-xfh",
      "started_at": "2026-11-10T22:48:56.178195+00:00",
      "elapsed_ms": 8.143,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:54539"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: app.example.test",
        "--header",
        "X-Forwarded-Host: attacker.evil",
        "--data-binary",
        "{\"email\": \"victim@example.test\"}",
        "http://127.0.0.1:54539/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "app.example.test",
      "request_x_forwarded_host": "attacker.evil",
      "email": "victim@example.test",
      "demonstration_expected_status": 202,
      "observed_status": 202,
      "observed_body": {
        "status": "accepted"
      },
      "expected_outbox_entry_added": true,
      "observed_outbox_entry_added": true,
      "expected_link_host": "attacker.evil",
      "observed_link_host": "attacker.evil",
      "observed_link": "https://attacker.evil/reset?token=a93fd21c7e4b4f0f9d3b6c8a1e2f5d7c",
      "token_in_link": true,
      "matches_demonstration": true,
      "response_file": "vulnerable-forged-xfh.http",
      "response_sha256": "11251588eabb561c1ade4bf9c28ecf81e385e072e0ac939b43d2d409a6eab2f1"
    },
    {
      "id": "vulnerable/unknown-email",
      "started_at": "2026-11-10T22:48:56.186405+00:00",
      "elapsed_ms": 8.446,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "base_url": "http://127.0.0.1:54539"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: app.example.test",
        "--data-binary",
        "{\"email\": \"nobody@example.test\"}",
        "http://127.0.0.1:54539/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "app.example.test",
      "request_x_forwarded_host": null,
      "email": "nobody@example.test",
      "demonstration_expected_status": 202,
      "observed_status": 202,
      "observed_body": {
        "status": "accepted"
      },
      "expected_outbox_entry_added": false,
      "observed_outbox_entry_added": false,
      "expected_link_host": null,
      "observed_link_host": null,
      "observed_link": null,
      "token_in_link": false,
      "matches_demonstration": true,
      "response_file": "vulnerable-unknown-email.http",
      "response_sha256": "11251588eabb561c1ade4bf9c28ecf81e385e072e0ac939b43d2d409a6eab2f1"
    },
    {
      "id": "fixed/legit",
      "started_at": "2026-11-10T22:48:56.226835+00:00",
      "elapsed_ms": 6.554,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:54544"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: app.example.test",
        "--data-binary",
        "{\"email\": \"victim@example.test\"}",
        "http://127.0.0.1:54544/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "app.example.test",
      "request_x_forwarded_host": null,
      "email": "victim@example.test",
      "demonstration_expected_status": 202,
      "observed_status": 202,
      "observed_body": {
        "status": "accepted"
      },
      "expected_outbox_entry_added": true,
      "observed_outbox_entry_added": true,
      "expected_link_host": "app.example.test",
      "observed_link_host": "app.example.test",
      "observed_link": "https://app.example.test/reset?token=a93fd21c7e4b4f0f9d3b6c8a1e2f5d7c",
      "token_in_link": true,
      "matches_demonstration": true,
      "response_file": "fixed-legit.http",
      "response_sha256": "11251588eabb561c1ade4bf9c28ecf81e385e072e0ac939b43d2d409a6eab2f1"
    },
    {
      "id": "fixed/forged-host",
      "started_at": "2026-11-10T22:48:56.233455+00:00",
      "elapsed_ms": 6.47,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:54544"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: attacker.evil",
        "--data-binary",
        "{\"email\": \"victim@example.test\"}",
        "http://127.0.0.1:54544/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "attacker.evil",
      "request_x_forwarded_host": null,
      "email": "victim@example.test",
      "demonstration_expected_status": 400,
      "observed_status": 400,
      "observed_body": {
        "error": "unrecognized_host"
      },
      "expected_outbox_entry_added": false,
      "observed_outbox_entry_added": false,
      "expected_link_host": null,
      "observed_link_host": null,
      "observed_link": null,
      "token_in_link": false,
      "matches_demonstration": true,
      "response_file": "fixed-forged-host.http",
      "response_sha256": "e7e00c8c0683fa58c35ecc2ab3ab31b69ba5f859d6be0d324c079f7fb38ad9ef"
    },
    {
      "id": "fixed/forged-xfh",
      "started_at": "2026-11-10T22:48:56.239983+00:00",
      "elapsed_ms": 6.514,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:54544"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: app.example.test",
        "--header",
        "X-Forwarded-Host: attacker.evil",
        "--data-binary",
        "{\"email\": \"victim@example.test\"}",
        "http://127.0.0.1:54544/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "app.example.test",
      "request_x_forwarded_host": "attacker.evil",
      "email": "victim@example.test",
      "demonstration_expected_status": 202,
      "observed_status": 202,
      "observed_body": {
        "status": "accepted"
      },
      "expected_outbox_entry_added": true,
      "observed_outbox_entry_added": true,
      "expected_link_host": "app.example.test",
      "observed_link_host": "app.example.test",
      "observed_link": "https://app.example.test/reset?token=a93fd21c7e4b4f0f9d3b6c8a1e2f5d7c",
      "token_in_link": true,
      "matches_demonstration": true,
      "response_file": "fixed-forged-xfh.http",
      "response_sha256": "11251588eabb561c1ade4bf9c28ecf81e385e072e0ac939b43d2d409a6eab2f1"
    },
    {
      "id": "fixed/unknown-email",
      "started_at": "2026-11-10T22:48:56.246557+00:00",
      "elapsed_ms": 8.249,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "base_url": "http://127.0.0.1:54544"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "POST",
        "--header",
        "Content-Type: application/json",
        "--header",
        "Host: app.example.test",
        "--data-binary",
        "{\"email\": \"nobody@example.test\"}",
        "http://127.0.0.1:54544/reset-password"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "request_host_header": "app.example.test",
      "request_x_forwarded_host": null,
      "email": "nobody@example.test",
      "demonstration_expected_status": 202,
      "observed_status": 202,
      "observed_body": {
        "status": "accepted"
      },
      "expected_outbox_entry_added": false,
      "observed_outbox_entry_added": false,
      "expected_link_host": null,
      "observed_link_host": null,
      "observed_link": null,
      "token_in_link": false,
      "matches_demonstration": true,
      "response_file": "fixed-unknown-email.http",
      "response_sha256": "11251588eabb561c1ade4bf9c28ecf81e385e072e0ac939b43d2d409a6eab2f1"
    }
  ],
  "failures": [],
  "finished_at": "2026-11-10T22:48:56.255448+00:00",
  "all_demonstration_checks_passed": true
}