OBSERVED
Finding · execute
A program passed all 24 of its recorded tests and still accepted a permission record that had never been issued.
§ 1
The record
FINDING · n-1-permit-membershipexecute · coverage illusion
A program passed all 24 of its recorded tests and still accepted a permission record that had never been issued.
- Claim
- A start permit assembled entirely from public registry facts, with its reference number derived by the authorizer's own function and committed to no ledger, was accepted by the bounded executor and the registry-named transform was applied; the target's bytes changed.
- Status
- OBSERVED Witnessed in one instance. No claim about how often.
- Question
- Authorised is not executed
- Subject
- The frozen STARTAUTH-01 executor, attacked from outside; the minimal public reproduction re-creates the defect in a small program. built for the study
- Frame
- One executor, one registry-named transform, one target file; forgery built from public registry facts.
- Method
- Three forgeries of increasing strength handed to the executor; bytes hashed before and after.
- Oracle
- The target bytes, hashed before and after each case.
- Negative control
- Present S16 and S17, the two weaker forgeries, were refused. Their refusals are what make the third result legible.
- Denominator
- 24 of 24 recorded cases matched their expectation; one of them (S18) expected the failure.
- Limitation
- One defect in one program built for this study. Not a measurement of deployed systems, and no claim about how often authorisation records are treated as evidence of authorisation. Not a break-in: producing the forgery requires the ability to run code as the same user, and such an actor can edit the target directly without any record. The minimal fix establishes that a membership check closes this specific defect; it does not establish at-most-once execution, atomic consumption, or independent measurement of the effect.
- Source
- repowazdogz-droid/omega-n1-permit-membership @ efba311
- Reproduce
git clone https://github.com/repowazdogz-droid/omega-n1-permit-membership && cd omega-n1-permit-membership && python3 reproduce.py
- Independent reproduction
- None known.
§ 2
Where this sits
This finding answers Authorised is not executed and supports the EXECUTE stage of the operating method. It is an instance of the coverage illusion mechanism.