{
  "schema": "mirror-qualification-measurements/v1",
  "collectedAt": "2026-10-22T12:36:10.429Z",
  "execution": "verifier-only",
  "modelCalls": 0,
  "verification": {
    "scenarios": [
      {
        "id": "baseline",
        "label": "Original runtime and weak application policy",
        "result": {
          "version": "v22.23.3",
          "strictNames": false,
          "pinDestination": false,
          "direct": {
            "discoveryName": "internal.test",
            "stage": [
              "suffix-rejected"
            ],
            "outcome": "SUFFIX_REJECTED",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "attack": {
            "discoveryName": "internal.test\u0000.allowed.test",
            "stage": [
              "suffix-approved",
              "resolved",
              "http-response"
            ],
            "destination": {
              "name": "127.0.0.1",
              "port": 55910,
              "priority": 0,
              "weight": 0
            },
            "body": "BLOG_ONLY_INTERNAL_MARKER",
            "outcome": "INTERNAL_MARKER_RETRIEVED",
            "dnsQueries": [
              "internal.test"
            ],
            "internalRequests": 1
          },
          "control": {
            "discoveryName": "status.allowed.test",
            "stage": [
              "suffix-approved",
              "resolved",
              "http-response"
            ],
            "destination": {
              "name": "127.0.0.1",
              "port": 55911,
              "priority": 0,
              "weight": 0
            },
            "body": "APPROVED_STATUS_OK",
            "outcome": "APPROVED_RESPONSE",
            "dnsQueries": [
              "status.allowed.test"
            ],
            "internalRequests": 0
          },
          "internalHits": 1,
          "approvedHits": 1,
          "scope": "Constructed service-discovery client with a deliberately weak raw-string suffix check. Real Node resolver behavior, fixed loopback DNS/SRV and HTTP services, harmless marker only.",
          "binarySha256": "68f4d07ca49e0500cc135c7e0a445093e228e42e126ac22306d045f0a8c2636b",
          "probeSha256": "c066a1ae8b3ecdd6fc82169ac514fba2ffc4b63ed4d914fc207ba622857480e9"
        }
      },
      {
        "id": "runtime-only",
        "label": "Vendor runtime update alone",
        "result": {
          "version": "v22.23.4",
          "strictNames": false,
          "pinDestination": false,
          "direct": {
            "discoveryName": "internal.test",
            "stage": [
              "suffix-rejected"
            ],
            "outcome": "SUFFIX_REJECTED",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "attack": {
            "discoveryName": "internal.test\u0000.allowed.test",
            "stage": [
              "suffix-approved",
              "request-rejected"
            ],
            "outcome": "ERR_INVALID_ARG_VALUE",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "control": {
            "discoveryName": "status.allowed.test",
            "stage": [
              "suffix-approved",
              "resolved",
              "http-response"
            ],
            "destination": {
              "name": "127.0.0.1",
              "port": 55915,
              "priority": 0,
              "weight": 0
            },
            "body": "APPROVED_STATUS_OK",
            "outcome": "APPROVED_RESPONSE",
            "dnsQueries": [
              "status.allowed.test"
            ],
            "internalRequests": 0
          },
          "internalHits": 0,
          "approvedHits": 1,
          "scope": "Constructed service-discovery client with a deliberately weak raw-string suffix check. Real Node resolver behavior, fixed loopback DNS/SRV and HTTP services, harmless marker only.",
          "binarySha256": "2cc28a1880d0774616959f2210ee739bffa6ac695c887e8988a496a21271f6c0",
          "probeSha256": "c066a1ae8b3ecdd6fc82169ac514fba2ffc4b63ed4d914fc207ba622857480e9"
        }
      },
      {
        "id": "input-only",
        "label": "Strict name validation on the old runtime",
        "result": {
          "version": "v22.23.3",
          "strictNames": true,
          "pinDestination": false,
          "direct": {
            "discoveryName": "internal.test",
            "stage": [
              "suffix-rejected"
            ],
            "outcome": "SUFFIX_REJECTED",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "attack": {
            "discoveryName": "internal.test\u0000.allowed.test",
            "stage": [
              "input-rejected"
            ],
            "outcome": "INPUT_REJECTED",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "control": {
            "discoveryName": "status.allowed.test",
            "stage": [
              "suffix-approved",
              "resolved",
              "http-response"
            ],
            "destination": {
              "name": "127.0.0.1",
              "port": 55919,
              "priority": 0,
              "weight": 0
            },
            "body": "APPROVED_STATUS_OK",
            "outcome": "APPROVED_RESPONSE",
            "dnsQueries": [
              "status.allowed.test"
            ],
            "internalRequests": 0
          },
          "internalHits": 0,
          "approvedHits": 1,
          "scope": "Constructed service-discovery client with a deliberately weak raw-string suffix check. Real Node resolver behavior, fixed loopback DNS/SRV and HTTP services, harmless marker only.",
          "binarySha256": "68f4d07ca49e0500cc135c7e0a445093e228e42e126ac22306d045f0a8c2636b",
          "probeSha256": "c066a1ae8b3ecdd6fc82169ac514fba2ffc4b63ed4d914fc207ba622857480e9"
        }
      },
      {
        "id": "destination-only",
        "label": "Pinned destination on the old runtime",
        "result": {
          "version": "v22.23.3",
          "strictNames": false,
          "pinDestination": true,
          "direct": {
            "discoveryName": "internal.test",
            "stage": [
              "suffix-rejected"
            ],
            "outcome": "SUFFIX_REJECTED",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "attack": {
            "discoveryName": "internal.test\u0000.allowed.test",
            "stage": [
              "suffix-approved",
              "resolved",
              "destination-rejected"
            ],
            "destination": {
              "name": "127.0.0.1",
              "port": 55922,
              "priority": 0,
              "weight": 0
            },
            "outcome": "DESTINATION_REJECTED",
            "dnsQueries": [
              "internal.test"
            ],
            "internalRequests": 0
          },
          "control": {
            "discoveryName": "status.allowed.test",
            "stage": [
              "suffix-approved",
              "resolved",
              "http-response"
            ],
            "destination": {
              "name": "127.0.0.1",
              "port": 55923,
              "priority": 0,
              "weight": 0
            },
            "body": "APPROVED_STATUS_OK",
            "outcome": "APPROVED_RESPONSE",
            "dnsQueries": [
              "status.allowed.test"
            ],
            "internalRequests": 0
          },
          "internalHits": 0,
          "approvedHits": 1,
          "scope": "Constructed service-discovery client with a deliberately weak raw-string suffix check. Real Node resolver behavior, fixed loopback DNS/SRV and HTTP services, harmless marker only.",
          "binarySha256": "68f4d07ca49e0500cc135c7e0a445093e228e42e126ac22306d045f0a8c2636b",
          "probeSha256": "c066a1ae8b3ecdd6fc82169ac514fba2ffc4b63ed4d914fc207ba622857480e9"
        }
      },
      {
        "id": "combined",
        "label": "Applied runtime and application controls",
        "result": {
          "version": "v22.23.4",
          "strictNames": true,
          "pinDestination": true,
          "direct": {
            "discoveryName": "internal.test",
            "stage": [
              "suffix-rejected"
            ],
            "outcome": "SUFFIX_REJECTED",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "attack": {
            "discoveryName": "internal.test\u0000.allowed.test",
            "stage": [
              "input-rejected"
            ],
            "outcome": "INPUT_REJECTED",
            "dnsQueries": [],
            "internalRequests": 0
          },
          "control": {
            "discoveryName": "status.allowed.test",
            "stage": [
              "suffix-approved",
              "resolved",
              "http-response"
            ],
            "destination": {
              "name": "127.0.0.1",
              "port": 55926,
              "priority": 0,
              "weight": 0
            },
            "body": "APPROVED_STATUS_OK",
            "outcome": "APPROVED_RESPONSE",
            "dnsQueries": [
              "status.allowed.test"
            ],
            "internalRequests": 0
          },
          "internalHits": 0,
          "approvedHits": 1,
          "scope": "Constructed service-discovery client with a deliberately weak raw-string suffix check. Real Node resolver behavior, fixed loopback DNS/SRV and HTTP services, harmless marker only.",
          "binarySha256": "2cc28a1880d0774616959f2210ee739bffa6ac695c887e8988a496a21271f6c0",
          "probeSha256": "c066a1ae8b3ecdd6fc82169ac514fba2ffc4b63ed4d914fc207ba622857480e9"
        }
      }
    ],
    "checks": [
      {
        "name": "Baseline retrieves the harmless internal marker through the malformed name",
        "passed": true
      },
      {
        "name": "Direct internal name is rejected by the original application policy",
        "passed": true
      },
      {
        "name": "Patched resolver rejects the malformed name before DNS dispatch",
        "passed": true
      },
      {
        "name": "Strict input validation interrupts the path on the old runtime",
        "passed": true
      },
      {
        "name": "Destination policy blocks the resolved internal endpoint",
        "passed": true
      },
      {
        "name": "Applied controls prevent the internal request",
        "passed": true
      },
      {
        "name": "Approved service requests still succeed in every scenario",
        "passed": true
      }
    ],
    "policy": {
      "runtime": "22.23.4",
      "strictNames": true,
      "pinDestination": true
    },
    "policyBeforeSha256": "225ccde28d3c83aab7f61b09d693ed7729a6cfa5c791994b32e85c0643cfa9f4",
    "policyAfterSha256": "61d15913faf4bcdbd9fb9672bd1e93fb5a39c59bf32dc9e06e486833d769ad48",
    "patch": "- runtime: 22.23.3\n+ runtime: 22.23.4\n- strictNames: false\n+ strictNames: true\n- pinDestination: false\n+ pinDestination: true",
    "scope": "Constructed loopback service-discovery attack path using real CVE-2026-105482 behavior and a deliberately weak application suffix check. Only a harmless marker is retrieved. No TLS compromise, NGINX exploit, external target, production data, or customer incident is asserted."
  },
  "recordSha256": "78f58be5b944268fd018151f10995bd29af66cc96d921018267b69d442b4b294"
}