ADR-0014: Qualify security through target-contact and regression evidence

Status: Historical proposal (original status: Proposed)
Date: 2026-10-08
Original decision makers: Project architecture/security owners; approval still pending in the original proposal.
Requirements: HG-039, HG-040, HG-041, HG-044, HG-045
Original supersession: None; a new decision for the proposed product.

Note

This is the full English translation of the historical proposal dated 2026-10-08, originally Proposed. Its pending approval is historical and creates no additional alpha approval gate. Current Security model and limits, Development and tests, Verification report and Requirements and security invariants describe the operative scope and evidence.

The later single-package decision is recorded in ADR-0015: One installable extension.

Context

A test may pass even if it observes only an exception after a request has already been sent. DNS rebinding, redirects and shared pools are not sufficiently demonstrated by unit mocks alone. Existing Vault ADRs already distinguish transport-not-reached tests from real wire evidence.

Sources: [S06, S08, S19].

Decision

The normative corpus contains 84 test cases and maps all 45 requirements. Every critical denial case needs a negative target-contact proof: a transport spy first, plus instrumented hermetic target servers or network evidence for transport invariants. The test environment must not contact real cloud metadata services or foreign internal services.

Test layers: unit/property, library integration, genuine TYPO3 registration, real cURL network tests, concurrency/workers and Vault normal/OAuth/streaming/cancellation paths. Boundary cases use the same corpus. Isolated networks and injected resolvers make answers reproducible; qualification tests have no internet dependency.

Targeted mutations remove, for example, the pin or address check; the corresponding tests must then fail. Release gates require an integration probe first, then complete P0 evidence and independent security review. A new dependency major or security fix restarts the relevant gates.

Rejected alternatives

Coverage percentage alone: says nothing about the claimed invariant.
Check exceptions alone: may be too late.
Only a manually tested URL: not reproducible and potentially dangerous.
Present existing ADR measurements as new evidence: confuses a source with executed verification.

Consequences

Qualification can be traced to concrete guarantees. A test harness and multiple runtime combinations take effort, but prevent unnoticed regressions. This original documentation package alone does not yet satisfy those product gates.

Evidence and acceptance in the original proposal

T001-T084; especially T029-T033, T043-T048, T053-T061, T074-T080. Details and expected results are in Original verification specification. These tests were specified, not executed as part of the original documentation delivery.

Reasons to reconsider

New attack paths, transport options or consumers expand the corpus before approval. An irreproducible security promise must be narrowed rather than maintained in marketing.