{
  "schema_version": 1,
  "fixture_version": "1.0.0",
  "started_at": "2026-11-10T22:50:57.387105+00:00",
  "method": "Real curl subprocesses against a locally spawned preview endpoint, which itself fetches a locally spawned target or metadata server",
  "scope": {
    "hosts": [
      "127.0.0.1"
    ],
    "methods": [
      "GET"
    ],
    "paths": [
      "/preview",
      "/article",
      "/redirect",
      "/latest/meta-data/secret"
    ],
    "data": "One synthetic metadata secret and one synthetic public article; no external hosts, no real credentials"
  },
  "versions": {
    "python": "3.15.2",
    "os": "Darwin",
    "architecture": "arm64",
    "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0"
  },
  "sha256": {
    "fixture.py": "8c9b944bf53fb5ec4dc1f987d97c57a42124e8ac346c157fbe5bd397bb4640c4",
    "verify.py": "06aeb5d2d369b33947d495135d2293c072480f71099f714141dd256038d7c1fb"
  },
  "reproduction_command": "python3 verify.py --output recorded-run",
  "agent_execution": {
    "executed": false,
    "note": "HTTP verification was scripted; no model or Excession agent ran"
  },
  "cases": [
    {
      "id": "vulnerable/legit",
      "started_at": "2026-11-10T22:50:57.513014+00:00",
      "elapsed_ms": 15.8,
      "mode": "vulnerable",
      "requested_url": "http://target.test:55473/article",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55474/preview?url=http%3A%2F%2Ftarget.test%3A55473%2Farticle"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": false,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "<html><title>Public Article</title><body>Ordinary public content.</body></html>",
        "mode": "vulnerable",
        "reason": null,
        "requested_host": "target.test",
        "requested_url": "http://target.test:55473/article",
        "resolved_ip": null,
        "secret_leaked": false,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": false,
      "response_file": "vulnerable-legit.http",
      "response_sha256": "59c55081d1937d865c5d70372a1b4b77f80acb996e44a245c951f56853538a38"
    },
    {
      "id": "vulnerable/literal",
      "started_at": "2026-11-10T22:50:57.528896+00:00",
      "elapsed_ms": 12.377,
      "mode": "vulnerable",
      "requested_url": "http://127.0.0.1:55472/latest/meta-data/secret",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55474/preview?url=http%3A%2F%2F127.0.0.1%3A55472%2Flatest%2Fmeta-data%2Fsecret"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": true,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "{\"credential\": \"synthetic-metadata-secret-7f3c9e21\"}",
        "mode": "vulnerable",
        "reason": null,
        "requested_host": "127.0.0.1",
        "requested_url": "http://127.0.0.1:55472/latest/meta-data/secret",
        "resolved_ip": null,
        "secret_leaked": true,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": true,
      "response_file": "vulnerable-literal.http",
      "response_sha256": "81e18d589b735f15a1657d9ed387b3f181de58bdb0cacf276e686e35186d861f"
    },
    {
      "id": "vulnerable/encoded",
      "started_at": "2026-11-10T22:50:57.541330+00:00",
      "elapsed_ms": 12.813,
      "mode": "vulnerable",
      "requested_url": "http://2130706433:55472/latest/meta-data/secret",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55474/preview?url=http%3A%2F%2F2130706433%3A55472%2Flatest%2Fmeta-data%2Fsecret"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": true,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "{\"credential\": \"synthetic-metadata-secret-7f3c9e21\"}",
        "mode": "vulnerable",
        "reason": null,
        "requested_host": "2130706433",
        "requested_url": "http://2130706433:55472/latest/meta-data/secret",
        "resolved_ip": null,
        "secret_leaked": true,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": true,
      "response_file": "vulnerable-encoded.http",
      "response_sha256": "2b02a8a558a49305d7078db635b004febc45fc73812fcc776440bc07834e5cfa"
    },
    {
      "id": "vulnerable/redirect",
      "started_at": "2026-11-10T22:50:57.554208+00:00",
      "elapsed_ms": 11.939,
      "mode": "vulnerable",
      "requested_url": "http://target.test:55473/redirect",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55474/preview?url=http%3A%2F%2Ftarget.test%3A55473%2Fredirect"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": true,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "{\"credential\": \"synthetic-metadata-secret-7f3c9e21\"}",
        "mode": "vulnerable",
        "reason": null,
        "requested_host": "target.test",
        "requested_url": "http://target.test:55473/redirect",
        "resolved_ip": null,
        "secret_leaked": true,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": true,
      "response_file": "vulnerable-redirect.http",
      "response_sha256": "35c58141fa76983a793ecc80bf371f46491092e9025de62b7e466f83915de401"
    },
    {
      "id": "naive/legit",
      "started_at": "2026-11-10T22:50:57.604904+00:00",
      "elapsed_ms": 14.893,
      "mode": "naive",
      "requested_url": "http://target.test:55473/article",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55485/preview?url=http%3A%2F%2Ftarget.test%3A55473%2Farticle"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": false,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "<html><title>Public Article</title><body>Ordinary public content.</body></html>",
        "mode": "naive",
        "reason": null,
        "requested_host": "target.test",
        "requested_url": "http://target.test:55473/article",
        "resolved_ip": null,
        "secret_leaked": false,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": false,
      "response_file": "naive-legit.http",
      "response_sha256": "f96f1b87a308c46f870001c1ced6feaecee59abbd71a79260ae316223affd476"
    },
    {
      "id": "naive/literal",
      "started_at": "2026-11-10T22:50:57.619851+00:00",
      "elapsed_ms": 6.614,
      "mode": "naive",
      "requested_url": "http://127.0.0.1:55472/latest/meta-data/secret",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55485/preview?url=http%3A%2F%2F127.0.0.1%3A55472%2Flatest%2Fmeta-data%2Fsecret"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 403,
      "expected_secret_leaked": false,
      "observed_preview_status": 403,
      "observed_body": {
        "blocked": true,
        "mode": "naive",
        "reason": "denylisted_host",
        "requested_host": "127.0.0.1",
        "requested_url": "http://127.0.0.1:55472/latest/meta-data/secret",
        "resolved_ip": null,
        "secret_leaked": false,
        "upstream_status": null
      },
      "matches_demonstration": true,
      "attack_succeeded": false,
      "response_file": "naive-literal.http",
      "response_sha256": "9de2dd8becf5a60ff9fe5423650991af3e48038ddaa98aa870d875bf4853afa4"
    },
    {
      "id": "naive/encoded",
      "started_at": "2026-11-10T22:50:57.626514+00:00",
      "elapsed_ms": 11.5,
      "mode": "naive",
      "requested_url": "http://2130706433:55472/latest/meta-data/secret",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55485/preview?url=http%3A%2F%2F2130706433%3A55472%2Flatest%2Fmeta-data%2Fsecret"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": true,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "{\"credential\": \"synthetic-metadata-secret-7f3c9e21\"}",
        "mode": "naive",
        "reason": null,
        "requested_host": "2130706433",
        "requested_url": "http://2130706433:55472/latest/meta-data/secret",
        "resolved_ip": null,
        "secret_leaked": true,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": true,
      "response_file": "naive-encoded.http",
      "response_sha256": "a99b3a90fd17b8f41a31479056b9aeaf811621d7ed2d3f459728e3934b132561"
    },
    {
      "id": "naive/redirect",
      "started_at": "2026-11-10T22:50:57.638063+00:00",
      "elapsed_ms": 11.467,
      "mode": "naive",
      "requested_url": "http://target.test:55473/redirect",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55485/preview?url=http%3A%2F%2Ftarget.test%3A55473%2Fredirect"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": true,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "{\"credential\": \"synthetic-metadata-secret-7f3c9e21\"}",
        "mode": "naive",
        "reason": null,
        "requested_host": "target.test",
        "requested_url": "http://target.test:55473/redirect",
        "resolved_ip": null,
        "secret_leaked": true,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": true,
      "response_file": "naive-redirect.http",
      "response_sha256": "d6ee3ac4ed3c4214d71cd68c2b2f3f7736598df11a5a586de3c4353bb37be7e1"
    },
    {
      "id": "strict/legit",
      "started_at": "2026-11-10T22:50:57.688011+00:00",
      "elapsed_ms": 14.728,
      "mode": "strict",
      "requested_url": "http://target.test:55473/article",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55494/preview?url=http%3A%2F%2Ftarget.test%3A55473%2Farticle"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": false,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "<html><title>Public Article</title><body>Ordinary public content.</body></html>",
        "mode": "strict",
        "reason": null,
        "requested_host": "target.test",
        "requested_url": "http://target.test:55473/article",
        "resolved_ip": "127.0.0.1",
        "secret_leaked": false,
        "upstream_status": 200
      },
      "matches_demonstration": true,
      "attack_succeeded": false,
      "response_file": "strict-legit.http",
      "response_sha256": "839e76148781b5bf2c2748c10d62c3765479d88d74df50e279299768c3a47048"
    },
    {
      "id": "strict/literal",
      "started_at": "2026-11-10T22:50:57.702796+00:00",
      "elapsed_ms": 6.742,
      "mode": "strict",
      "requested_url": "http://127.0.0.1:55472/latest/meta-data/secret",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55494/preview?url=http%3A%2F%2F127.0.0.1%3A55472%2Flatest%2Fmeta-data%2Fsecret"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 403,
      "expected_secret_leaked": false,
      "observed_preview_status": 403,
      "observed_body": {
        "blocked": true,
        "mode": "strict",
        "reason": "destination_not_allowlisted",
        "requested_host": "127.0.0.1",
        "requested_url": "http://127.0.0.1:55472/latest/meta-data/secret",
        "resolved_ip": "127.0.0.1",
        "secret_leaked": false,
        "upstream_status": null
      },
      "matches_demonstration": true,
      "attack_succeeded": false,
      "response_file": "strict-literal.http",
      "response_sha256": "39c23ab88cf8acb84370aec44b32113ff6e056f05d23f6f3489cec83c24211cf"
    },
    {
      "id": "strict/encoded",
      "started_at": "2026-11-10T22:50:57.709586+00:00",
      "elapsed_ms": 7.712,
      "mode": "strict",
      "requested_url": "http://2130706433:55472/latest/meta-data/secret",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55494/preview?url=http%3A%2F%2F2130706433%3A55472%2Flatest%2Fmeta-data%2Fsecret"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 403,
      "expected_secret_leaked": false,
      "observed_preview_status": 403,
      "observed_body": {
        "blocked": true,
        "mode": "strict",
        "reason": "destination_not_allowlisted",
        "requested_host": "2130706433",
        "requested_url": "http://2130706433:55472/latest/meta-data/secret",
        "resolved_ip": "127.0.0.1",
        "secret_leaked": false,
        "upstream_status": null
      },
      "matches_demonstration": true,
      "attack_succeeded": false,
      "response_file": "strict-encoded.http",
      "response_sha256": "453ea03d28d3731cccf867170653cceb002507082f24a463b69aad41e150292a"
    },
    {
      "id": "strict/redirect",
      "started_at": "2026-11-10T22:50:57.717344+00:00",
      "elapsed_ms": 10.768,
      "mode": "strict",
      "requested_url": "http://target.test:55473/redirect",
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--request",
        "GET",
        "http://127.0.0.1:55494/preview?url=http%3A%2F%2Ftarget.test%3A55473%2Fredirect"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "expected_preview_status": 200,
      "expected_secret_leaked": false,
      "observed_preview_status": 200,
      "observed_body": {
        "blocked": false,
        "body_preview": "",
        "mode": "strict",
        "reason": null,
        "requested_host": "target.test",
        "requested_url": "http://target.test:55473/redirect",
        "resolved_ip": "127.0.0.1",
        "secret_leaked": false,
        "upstream_status": 302
      },
      "matches_demonstration": true,
      "attack_succeeded": false,
      "response_file": "strict-redirect.http",
      "response_sha256": "1f83c377cd210bff449c72469ebb92c489061b50253d19c5e4d4e8f11b5728ce"
    }
  ],
  "failures": [],
  "finished_at": "2026-11-10T22:50:57.730126+00:00",
  "all_demonstration_checks_passed": true
}