---
title: "ADR-0014: Qualify security through target-contact and regression evidence"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0014@main"
source: "Adr/ADR-0014-SecurityEvidenceAndReleaseGates.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# ADR-0014: Qualify security through target-contact and regression evidence {#adr-0014}

-   *Status:* Historical proposal (original status: Proposed)
-   *Date:* 2026-10-08
-   *Original decision makers:*

    Project architecture/security owners; approval
    still pending in the original proposal.

-   *Requirements:* HG-039, HG-040, HG-041, HG-044, HG-045
-   *Original supersession:* None; a new decision for the proposed product.

> [!NOTE]
> This is the full English translation of the historical proposal dated
> 2026-10-08, originally Proposed. Its pending approval is historical and
> creates no additional alpha approval gate. Current
> [Security model and limits](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security@main), [Development and tests](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development@main), [Verification report](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-report@main) and
> [Requirements and security invariants](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development-requirements@main) describe the operative scope and evidence.
>
> The later single-package decision is recorded in [ADR-0015: One installable extension](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0015@main).

## Context {#adr-0014-context}

A test may pass even if it observes only an exception after a request has
already been sent. DNS rebinding, redirects and shared pools are not
sufficiently demonstrated by unit mocks alone. Existing Vault ADRs already
distinguish transport-not-reached tests from real wire evidence.

Sources: `[S06, S08, S19]`.

## Decision {#adr-0014-decision}

The normative corpus contains 84 test cases and maps all 45 requirements.
Every critical denial case needs a negative target-contact proof: a transport
spy first, plus instrumented hermetic target servers or network evidence for
transport invariants. The test environment must not contact real cloud
metadata services or foreign internal services.

Test layers: unit/property, library integration, genuine TYPO3 registration,
real cURL network tests, concurrency/workers and Vault
normal/OAuth/streaming/cancellation paths. Boundary cases use the same corpus.
Isolated networks and injected resolvers make answers reproducible;
qualification tests have no internet dependency.

Targeted mutations remove, for example, the pin or address check; the
corresponding tests must then fail. Release gates require an integration probe
first, then complete P0 evidence and independent security review. A new
dependency major or security fix restarts the relevant gates.

## Rejected alternatives {#adr-0014-rejected-alternatives}

-   **Coverage percentage alone:** says nothing about the claimed invariant.
-   **Check exceptions alone:** may be too late.
-   **Only a manually tested URL:** not reproducible and potentially dangerous.
-   **Present existing ADR measurements as new evidence:** confuses a source
    with executed verification.

## Consequences {#adr-0014-consequences}

Qualification can be traced to concrete guarantees. A test harness and
multiple runtime combinations take effort, but prevent unnoticed regressions.
This original documentation package alone does not yet satisfy those product
gates.

## Evidence and acceptance in the original proposal {#adr-0014-verification-and-acceptance}

`T001-T084; especially T029-T033, T043-T048, T053-T061, T074-T080`.
Details and expected results are in [Original verification specification](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/06-verification.md).
These tests were specified, not executed as part of the original documentation
delivery.

## Reasons to reconsider {#adr-0014-reassessment-trigger}

New attack paths, transport options or consumers expand the corpus before
approval. An irreproducible security promise must be narrowed rather than
maintained in marketing.

## Related documents {#adr-0014-related-documents}

[Original ADR](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/adr/ADR-0014-sicherheitsnachweis-und-release-gates.md), [Original product requirements](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/01-product-requirements.md), [Original security model](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/02-security-model.md),
[Original architecture](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/03-architecture.md) and [Original source catalogue](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/08-evidence-and-sources.md) (`S01-S23`),
plus the [ADR index](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-index@main). [Original sources](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-original-sources@main) explains
the immutable source index.