Finding · execute
A program passed all 24 of its recorded tests and still accepted a permission record that had never been issued.
A start permit assembled entirely from public registry facts, with its reference number derived by the authorizer's own function and committed to no ledger, was accepted by the bounded executor and the registry-named transform was applied; the target's bytes changed.
What it does not establish
One defect in one program built for this study. Not a measurement of deployed systems, and no claim about how often authorisation records are treated as evidence of authorisation. Not a break-in: producing the forgery requires the ability to run code as the same user, and such an actor can edit the target directly without any record. The minimal fix establishes that a membership check closes this specific defect; it does not establish at-most-once execution, atomic consumption, or independent measurement of the effect.
Reproduce it
Nothing here has to be taken on trust.
git clone https://github.com/repowazdogz-droid/omega-n1-permit-membership && cd omega-n1-permit-membership && python3 reproduce.py
Where this sits
This finding supports the EXECUTE step of the operating method. It is an instance of the coverage illusion failure mechanism.