{
  "schema_version": 1,
  "fixture_version": "1.0.0",
  "started_at": "2026-11-10T22:47:12.337403+00:00",
  "method": "In-process timing, curl controls, and a stdlib http.client timing attack against fixture.py on 127.0.0.1",
  "parameters": {
    "artificial_delay_ms_per_matching_byte": 2.0,
    "samples_per_candidate": 25,
    "positions_attacked": 4,
    "alphabet": "0123456789abcdef",
    "synthetic_token": "4b0266e94967baa9",
    "padding_char": "z"
  },
  "versions": {
    "python": "3.15.2",
    "os": "Darwin",
    "architecture": "arm64",
    "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0"
  },
  "sha256": {
    "fixture.py": "b268af7c7541d7de29b67528ca018e7da24d31488c83e9205028ae7e158ac4f4",
    "verify.py": "ee495fa2a3c39871b437609dd681d4cd55166224857099003067dc37ccc58f6a"
  },
  "reproduction_command": "python3 verify.py --output recorded-run",
  "agent_execution": {
    "executed": false,
    "note": "Scripted; no model or Excession agent ran"
  },
  "checks": [
    {
      "id": "inprocess/python_loop-last-vs-first-ratio",
      "expected": "> 1.5 (positive control: method can see a real early-return effect)",
      "observed": 4.49,
      "passed": true
    },
    {
      "id": "curl/vulnerable/valid-token",
      "expected": 200,
      "observed": 200,
      "passed": true
    },
    {
      "id": "curl/vulnerable/wrong-token",
      "expected": 401,
      "observed": 401,
      "passed": true
    },
    {
      "id": "curl/vulnerable/correct-prefix-wrong-rest",
      "expected": 401,
      "observed": 401,
      "passed": true
    },
    {
      "id": "curl/vulnerable/no-token",
      "expected": 401,
      "observed": 401,
      "passed": true
    },
    {
      "id": "curl/fixed/valid-token",
      "expected": 200,
      "observed": 200,
      "passed": true
    },
    {
      "id": "curl/fixed/wrong-token",
      "expected": 401,
      "observed": 401,
      "passed": true
    },
    {
      "id": "curl/fixed/correct-prefix-wrong-rest",
      "expected": 401,
      "observed": 401,
      "passed": true
    },
    {
      "id": "curl/fixed/no-token",
      "expected": 401,
      "observed": 401,
      "passed": true
    },
    {
      "id": "attack/vulnerable-delay-2ms-greedy/recovered-prefix",
      "expected": "4b02",
      "observed": "4b02",
      "passed": true
    },
    {
      "id": "attack/fixed-greedy/max-margin-below-0.50ms",
      "expected": "< 0.50 ms at every position",
      "observed": "0.005 ms",
      "passed": true
    },
    {
      "id": "attack/fixed-known-prefix/max-margin-below-0.50ms",
      "expected": "< 0.50 ms at every position",
      "observed": "0.008 ms",
      "passed": true
    }
  ],
  "failures": [],
  "inprocess_summary": [
    {
      "length_bytes": 32,
      "function": "==",
      "variant": "mismatch_at_first_byte",
      "median_ns": 11.23,
      "q1_ns": 10.9,
      "q3_ns": 12.17,
      "min_ns": 10.67,
      "max_ns": 29.0
    },
    {
      "length_bytes": 32,
      "function": "==",
      "variant": "mismatch_at_last_byte",
      "median_ns": 12.55,
      "q1_ns": 12.4,
      "q3_ns": 13.08,
      "min_ns": 12.19,
      "max_ns": 26.59
    },
    {
      "length_bytes": 32,
      "function": "==",
      "variant": "equal",
      "median_ns": 12.47,
      "q1_ns": 12.28,
      "q3_ns": 13.34,
      "min_ns": 12.02,
      "max_ns": 23.85
    },
    {
      "length_bytes": 32,
      "function": "compare_digest",
      "variant": "mismatch_at_first_byte",
      "median_ns": 29.53,
      "q1_ns": 29.26,
      "q3_ns": 30.38,
      "min_ns": 28.91,
      "max_ns": 66.77
    },
    {
      "length_bytes": 32,
      "function": "compare_digest",
      "variant": "mismatch_at_last_byte",
      "median_ns": 30.98,
      "q1_ns": 30.44,
      "q3_ns": 31.91,
      "min_ns": 30.07,
      "max_ns": 52.21
    },
    {
      "length_bytes": 32,
      "function": "compare_digest",
      "variant": "equal",
      "median_ns": 29.75,
      "q1_ns": 29.28,
      "q3_ns": 31.12,
      "min_ns": 28.97,
      "max_ns": 54.68
    },
    {
      "length_bytes": 32,
      "function": "python_loop",
      "variant": "mismatch_at_first_byte",
      "median_ns": 117.75,
      "q1_ns": 116.45,
      "q3_ns": 122.27,
      "min_ns": 114.59,
      "max_ns": 169.48
    },
    {
      "length_bytes": 32,
      "function": "python_loop",
      "variant": "mismatch_at_last_byte",
      "median_ns": 528.88,
      "q1_ns": 516.24,
      "q3_ns": 547.56,
      "min_ns": 508.55,
      "max_ns": 711.06
    },
    {
      "length_bytes": 32,
      "function": "python_loop",
      "variant": "equal",
      "median_ns": 529.76,
      "q1_ns": 511.24,
      "q3_ns": 573.74,
      "min_ns": 507.07,
      "max_ns": 908.72
    },
    {
      "length_bytes": 65536,
      "function": "==",
      "variant": "mismatch_at_first_byte",
      "median_ns": 9.83,
      "q1_ns": 9.72,
      "q3_ns": 10.04,
      "min_ns": 9.54,
      "max_ns": 10.85
    },
    {
      "length_bytes": 65536,
      "function": "==",
      "variant": "mismatch_at_last_byte",
      "median_ns": 1210.71,
      "q1_ns": 1200.57,
      "q3_ns": 1225.9,
      "min_ns": 1188.21,
      "max_ns": 1331.81
    },
    {
      "length_bytes": 65536,
      "function": "==",
      "variant": "equal",
      "median_ns": 1212.21,
      "q1_ns": 1193.33,
      "q3_ns": 1227.5,
      "min_ns": 1176.85,
      "max_ns": 1545.6
    },
    {
      "length_bytes": 65536,
      "function": "compare_digest",
      "variant": "mismatch_at_first_byte",
      "median_ns": 18701.56,
      "q1_ns": 18615.04,
      "q3_ns": 18952.52,
      "min_ns": 18470.35,
      "max_ns": 21406.58
    },
    {
      "length_bytes": 65536,
      "function": "compare_digest",
      "variant": "mismatch_at_last_byte",
      "median_ns": 18907.58,
      "q1_ns": 18704.66,
      "q3_ns": 19158.14,
      "min_ns": 18456.1,
      "max_ns": 20917.23
    },
    {
      "length_bytes": 65536,
      "function": "compare_digest",
      "variant": "equal",
      "median_ns": 18970.15,
      "q1_ns": 18675.96,
      "q3_ns": 19482.09,
      "min_ns": 18446.62,
      "max_ns": 23365.12
    }
  ],
  "attacks": {
    "vulnerable-delay-2ms-greedy": {
      "recovered": "4b02",
      "true_prefix": "4b02",
      "all_correct": true,
      "run_id": "vulnerable-delay-2ms-greedy",
      "mode": "vulnerable",
      "port": 53587,
      "known_prefix_given_to_attacker": false,
      "positions": [
        {
          "position": 0,
          "prefix_used": "",
          "picked": "4",
          "true_char": "4",
          "picked_is_true": true,
          "top_median_ms": 2.628,
          "runner_up_median_ms": 0.117,
          "median_of_other_15_ms": 0.099,
          "margin_ms": 2.529,
          "true_char_median_ms": 2.628,
          "true_char_rank_of_16": 1
        },
        {
          "position": 1,
          "prefix_used": "4",
          "picked": "b",
          "true_char": "b",
          "picked_is_true": true,
          "top_median_ms": 5.182,
          "runner_up_median_ms": 2.68,
          "median_of_other_15_ms": 2.66,
          "margin_ms": 2.521,
          "true_char_median_ms": 5.182,
          "true_char_rank_of_16": 1
        },
        {
          "position": 2,
          "prefix_used": "4b",
          "picked": "0",
          "true_char": "0",
          "picked_is_true": true,
          "top_median_ms": 7.76,
          "runner_up_median_ms": 5.264,
          "median_of_other_15_ms": 5.225,
          "margin_ms": 2.534,
          "true_char_median_ms": 7.76,
          "true_char_rank_of_16": 1
        },
        {
          "position": 3,
          "prefix_used": "4b0",
          "picked": "2",
          "true_char": "2",
          "picked_is_true": true,
          "top_median_ms": 10.114,
          "runner_up_median_ms": 7.753,
          "median_of_other_15_ms": 7.714,
          "margin_ms": 2.4,
          "true_char_median_ms": 10.114,
          "true_char_rank_of_16": 1
        }
      ]
    },
    "fixed-greedy": {
      "recovered": "0e9d",
      "true_prefix": "4b02",
      "all_correct": false,
      "run_id": "fixed-greedy",
      "mode": "fixed",
      "port": 53593,
      "known_prefix_given_to_attacker": false,
      "positions": [
        {
          "position": 0,
          "prefix_used": "",
          "picked": "0",
          "true_char": "4",
          "picked_is_true": false,
          "top_median_ms": 0.08,
          "runner_up_median_ms": 0.079,
          "median_of_other_15_ms": 0.076,
          "margin_ms": 0.004,
          "true_char_median_ms": 0.075,
          "true_char_rank_of_16": 11
        },
        {
          "position": 1,
          "prefix_used": "0",
          "picked": "e",
          "true_char": "b",
          "picked_is_true": false,
          "top_median_ms": 0.066,
          "runner_up_median_ms": 0.064,
          "median_of_other_15_ms": 0.061,
          "margin_ms": 0.005,
          "true_char_median_ms": 0.061,
          "true_char_rank_of_16": 9
        },
        {
          "position": 2,
          "prefix_used": "0e",
          "picked": "9",
          "true_char": "0",
          "picked_is_true": false,
          "top_median_ms": 0.067,
          "runner_up_median_ms": 0.067,
          "median_of_other_15_ms": 0.065,
          "margin_ms": 0.002,
          "true_char_median_ms": 0.066,
          "true_char_rank_of_16": 7
        },
        {
          "position": 3,
          "prefix_used": "0e9",
          "picked": "d",
          "true_char": "2",
          "picked_is_true": false,
          "top_median_ms": 0.066,
          "runner_up_median_ms": 0.065,
          "median_of_other_15_ms": 0.064,
          "margin_ms": 0.002,
          "true_char_median_ms": 0.064,
          "true_char_rank_of_16": 10
        }
      ]
    },
    "fixed-known-prefix": {
      "recovered": "4b04",
      "true_prefix": "4b02",
      "all_correct": false,
      "run_id": "fixed-known-prefix",
      "mode": "fixed",
      "port": 53593,
      "known_prefix_given_to_attacker": true,
      "positions": [
        {
          "position": 0,
          "prefix_used": "",
          "picked": "a",
          "true_char": "4",
          "picked_is_true": false,
          "top_median_ms": 0.065,
          "runner_up_median_ms": 0.064,
          "median_of_other_15_ms": 0.062,
          "margin_ms": 0.003,
          "true_char_median_ms": 0.062,
          "true_char_rank_of_16": 6
        },
        {
          "position": 1,
          "prefix_used": "4",
          "picked": "1",
          "true_char": "b",
          "picked_is_true": false,
          "top_median_ms": 0.069,
          "runner_up_median_ms": 0.068,
          "median_of_other_15_ms": 0.063,
          "margin_ms": 0.006,
          "true_char_median_ms": 0.063,
          "true_char_rank_of_16": 8
        },
        {
          "position": 2,
          "prefix_used": "4b",
          "picked": "4",
          "true_char": "0",
          "picked_is_true": false,
          "top_median_ms": 0.061,
          "runner_up_median_ms": 0.059,
          "median_of_other_15_ms": 0.053,
          "margin_ms": 0.008,
          "true_char_median_ms": 0.053,
          "true_char_rank_of_16": 8
        },
        {
          "position": 3,
          "prefix_used": "4b0",
          "picked": "4",
          "true_char": "2",
          "picked_is_true": false,
          "top_median_ms": 0.07,
          "runner_up_median_ms": 0.07,
          "median_of_other_15_ms": 0.067,
          "margin_ms": 0.003,
          "true_char_median_ms": 0.068,
          "true_char_rank_of_16": 7
        }
      ]
    },
    "vulnerable-no-delay-greedy": {
      "recovered": "a7b3",
      "true_prefix": "4b02",
      "all_correct": false,
      "run_id": "vulnerable-no-delay-greedy",
      "mode": "vulnerable",
      "port": 53653,
      "delay_ms": 0,
      "known_prefix_given_to_attacker": false,
      "positions": [
        {
          "position": 0,
          "prefix_used": "",
          "picked": "a",
          "true_char": "4",
          "picked_is_true": false,
          "top_median_ms": 0.075,
          "runner_up_median_ms": 0.074,
          "median_of_other_15_ms": 0.07,
          "margin_ms": 0.005,
          "true_char_median_ms": 0.069,
          "true_char_rank_of_16": 15
        },
        {
          "position": 1,
          "prefix_used": "a",
          "picked": "7",
          "true_char": "b",
          "picked_is_true": false,
          "top_median_ms": 0.078,
          "runner_up_median_ms": 0.075,
          "median_of_other_15_ms": 0.072,
          "margin_ms": 0.006,
          "true_char_median_ms": 0.071,
          "true_char_rank_of_16": 11
        },
        {
          "position": 2,
          "prefix_used": "a7",
          "picked": "b",
          "true_char": "0",
          "picked_is_true": false,
          "top_median_ms": 0.073,
          "runner_up_median_ms": 0.072,
          "median_of_other_15_ms": 0.07,
          "margin_ms": 0.002,
          "true_char_median_ms": 0.07,
          "true_char_rank_of_16": 10
        },
        {
          "position": 3,
          "prefix_used": "a7b",
          "picked": "3",
          "true_char": "2",
          "picked_is_true": false,
          "top_median_ms": 0.073,
          "runner_up_median_ms": 0.073,
          "median_of_other_15_ms": 0.07,
          "margin_ms": 0.003,
          "true_char_median_ms": 0.068,
          "true_char_rank_of_16": 16
        }
      ]
    },
    "vulnerable-no-delay-known-prefix": {
      "recovered": "4b02",
      "true_prefix": "4b02",
      "all_correct": true,
      "run_id": "vulnerable-no-delay-known-prefix",
      "mode": "vulnerable",
      "port": 53653,
      "delay_ms": 0,
      "known_prefix_given_to_attacker": true,
      "positions": [
        {
          "position": 0,
          "prefix_used": "",
          "picked": "b",
          "true_char": "4",
          "picked_is_true": false,
          "top_median_ms": 0.071,
          "runner_up_median_ms": 0.07,
          "median_of_other_15_ms": 0.068,
          "margin_ms": 0.003,
          "true_char_median_ms": 0.067,
          "true_char_rank_of_16": 16
        },
        {
          "position": 1,
          "prefix_used": "4",
          "picked": "d",
          "true_char": "b",
          "picked_is_true": false,
          "top_median_ms": 0.07,
          "runner_up_median_ms": 0.069,
          "median_of_other_15_ms": 0.067,
          "margin_ms": 0.003,
          "true_char_median_ms": 0.067,
          "true_char_rank_of_16": 10
        },
        {
          "position": 2,
          "prefix_used": "4b",
          "picked": "6",
          "true_char": "0",
          "picked_is_true": false,
          "top_median_ms": 0.073,
          "runner_up_median_ms": 0.073,
          "median_of_other_15_ms": 0.07,
          "margin_ms": 0.003,
          "true_char_median_ms": 0.073,
          "true_char_rank_of_16": 2
        },
        {
          "position": 3,
          "prefix_used": "4b0",
          "picked": "2",
          "true_char": "2",
          "picked_is_true": true,
          "top_median_ms": 0.072,
          "runner_up_median_ms": 0.072,
          "median_of_other_15_ms": 0.07,
          "margin_ms": 0.002,
          "true_char_median_ms": 0.072,
          "true_char_rank_of_16": 1
        }
      ]
    },
    "note": "No-delay runs are observations; no pass/fail is asserted for them."
  },
  "finished_at": "2026-11-10T22:47:24.928382+00:00",
  "all_checks_passed": true
}