authz.lock: full-stack-fastapi-template@cb740b6: pr-mut-mass-assign-owner.v0

Verdict: FAIL · 2 new invariant violations · 3 widened cells · 3 changed cells

probes	603
probe time (s)	65.2
coverage	20/22 operations
never green (unprobed)	POST /password-recovery-html-content/{email}, POST /reset-password/
harness	valid
app	full-stack-fastapi-template@cb740b6
expected	FAIL
what	POST /items/: client may set owner_id (added to ItemCreate, honoured if sent)
regression test	proven (JUnit: passes on base, AssertionError on head)
proof LLM cost	$0.0314 (12 calls, 2 prove runs in Nebius Sandboxes, 89.6 s)

Invariant violations introduced by this PR

rule	cell (op \| identity \| target \| variant)	detail
I3 write-isolation	`POST /items/ \| user_a \| - \| hostile`	user_a created a item row owned by user_b
I3 write-isolation	`POST /items/ \| user_b \| - \| hostile`	user_b created a item row owned by user_a

Access widened (lockfile diff)

cell	base	head
`POST /items/ \| superuser \| - \| hostile`	ALLOW 200 leaks=['self'] db=['insert:item:self'] count=None	ALLOW 200 leaks=- db=['insert:item:user_b'] count=None
`POST /items/ \| user_a \| - \| hostile`	ALLOW 200 leaks=['self'] db=['insert:item:self'] count=None	ALLOW 200 leaks=- db=['insert:item:user_b'] count=None
`POST /items/ \| user_b \| - \| hostile`	ALLOW 200 leaks=['self'] db=['insert:item:self'] count=None	ALLOW 200 leaks=- db=['insert:item:user_a'] count=None

Identity × operation

PASS = no invariant violation in any probe of that pair; FAIL = at least one new violation; CHANGED = widened vs base without a violation. Letters: A=ALLOW D=DENY I=INCONCLUSIVE probe counts. Expand a cell for per-probe evidence (status, leaked canary owners, DB row changes with owner attribution); request/response bodies are not stored in the lock, and tokens/passwords are redacted.

operation alg_none anonymous deleted_user expired forged_sig inactive superuser user_a user_b

DELETE /items/{id}

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 401	-	-	None
superuser	base	DENY 401	-	-	None
user_a	base	DENY 401	-	-	None
user_b	base	DENY 401	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 404	-	-	None
user_a	base	DENY 404	-	-	None
user_b	base	DENY 404	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 400	-	-	None
superuser	base	DENY 400	-	-	None
user_a	base	DENY 400	-	-	None
user_b	base	DENY 400	-	-	None

PASS A3 D1

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	ALLOW 200	-	delete:item:self	None
user_a	base	ALLOW 200	-	delete:item:user_a	None
user_b	base	ALLOW 200	-	delete:item:user_b	None

PASS A1 D3

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	ALLOW 200	-	delete:item:self	None
user_b	base	DENY 403	-	-	None

PASS A1 D3

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	ALLOW 200	-	delete:item:self	None

DELETE /users/me

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	delete:item:self, delete:item:self, delete:item:self, delete:item:self, delete:item:self, delete:item:self, delete:item:self, delete:user:self	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	delete:item:self, delete:item:self, delete:item:self, delete:user:self	None

DELETE /users/{user_id}

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 401	-	-	None
superuser	base	DENY 401	-	-	None
user_a	base	DENY 401	-	-	None
user_b	base	DENY 401	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 404	-	-	None
user_a	base	DENY 404	-	-	None
user_b	base	DENY 404	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 400	-	-	None
superuser	base	DENY 400	-	-	None
user_a	base	DENY 400	-	-	None
user_b	base	DENY 400	-	-	None

PASS A2 D2

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	ALLOW 200	-	delete:item:user_a, delete:item:user_a, delete:item:user_a, delete:item:user_a, delete:item:user_a, delete:item:user_a, delete:item:user_a, delete:user:user_a	None
user_b	base	ALLOW 200	-	delete:item:user_b, delete:item:user_b, delete:item:user_b, delete:user:user_b	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

GET /items/

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	inactive, self, user_a, user_b	-	14

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	7

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	3

GET /items/{id}

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 401	-	-	None
superuser	base	DENY 401	-	-	None
user_a	base	DENY 401	-	-	None
user_b	base	DENY 401	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 404	-	-	None
user_a	base	DENY 404	-	-	None
user_b	base	DENY 404	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 400	-	-	None
superuser	base	DENY 400	-	-	None
user_a	base	DENY 400	-	-	None
user_b	base	DENY 400	-	-	None

PASS A3 D1

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	ALLOW 200	self	-	None
user_a	base	ALLOW 200	user_a	-	None
user_b	base	ALLOW 200	user_b	-	None

PASS A1 D3

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	ALLOW 200	self	-	None
user_b	base	DENY 403	-	-	None

PASS A1 D3

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	ALLOW 200	self	-	None

GET /users/

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	inactive, self, user_a, user_b	-	4

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

GET /users/me

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	None

GET /users/{user_id}

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 401	-	-	None
superuser	base	DENY 401	-	-	None
user_a	base	DENY 401	-	-	None
user_b	base	DENY 401	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 404	-	-	None
user_a	base	DENY 404	-	-	None
user_b	base	DENY 404	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 400	-	-	None
superuser	base	DENY 400	-	-	None
user_a	base	DENY 400	-	-	None
user_b	base	DENY 400	-	-	None

PASS A3 D1

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	ALLOW 200	self	-	None
user_a	base	ALLOW 200	user_a	-	None
user_b	base	ALLOW 200	user_b	-	None

PASS A1 D3

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	ALLOW 200	self	-	None
user_b	base	DENY 403	-	-	None

PASS A1 D3

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	ALLOW 200	self	-	None

GET /utils/health-check/

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	-	None

PATCH /users/me

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None
-	hostile	DENY 401	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None
-	hostile	DENY 404	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	update:user:self	None
-	hostile	ALLOW 200	self	update:user:self	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	update:user:self	None
-	hostile	ALLOW 200	self	update:user:self	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	update:user:self	None
-	hostile	ALLOW 200	self	update:user:self	None

PATCH /users/me/password

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None
-	hostile	DENY 401	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None
-	hostile	DENY 404	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	update:user:self	None
-	hostile	ALLOW 200	-	update:user:self	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	update:user:self	None
-	hostile	ALLOW 200	-	update:user:self	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	update:user:self	None
-	hostile	ALLOW 200	-	update:user:self	None

PATCH /users/{user_id}

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 401	-	-	None
nonexistent	hostile	DENY 401	-	-	None
superuser	base	DENY 401	-	-	None
superuser	hostile	DENY 401	-	-	None
user_a	base	DENY 401	-	-	None
user_a	hostile	DENY 401	-	-	None
user_b	base	DENY 401	-	-	None
user_b	hostile	DENY 401	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
nonexistent	hostile	DENY 404	-	-	None
superuser	base	DENY 404	-	-	None
superuser	hostile	DENY 404	-	-	None
user_a	base	DENY 404	-	-	None
user_a	hostile	DENY 404	-	-	None
user_b	base	DENY 404	-	-	None
user_b	hostile	DENY 404	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 400	-	-	None
nonexistent	hostile	DENY 400	-	-	None
superuser	base	DENY 400	-	-	None
superuser	hostile	DENY 400	-	-	None
user_a	base	DENY 400	-	-	None
user_a	hostile	DENY 400	-	-	None
user_b	base	DENY 400	-	-	None
user_b	hostile	DENY 400	-	-	None

PASS A6 D2

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
nonexistent	hostile	DENY 404	-	-	None
superuser	base	ALLOW 200	self	update:user:self	None
superuser	hostile	ALLOW 200	self	update:user:self	None
user_a	base	ALLOW 200	user_a	update:user:user_a	None
user_a	hostile	ALLOW 200	user_a	update:user:user_a[priv:is_superuser]	None
user_b	base	ALLOW 200	user_b	update:user:user_b	None
user_b	hostile	ALLOW 200	user_b	update:user:user_b[priv:is_superuser]	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

POST /items/

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None
-	hostile	DENY 401	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None
-	hostile	DENY 404	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

CHANGED A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	insert:item:self	None
-	hostile	ALLOW 200	-	insert:item:user_b	None

FAIL A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	insert:item:self	None
-	hostile	ALLOW 200	-	insert:item:user_b	None	⚠ I3 write-isolation: user_a created a item row owned by user_b

FAIL A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	insert:item:self	None
-	hostile	ALLOW 200	-	insert:item:user_a	None	⚠ I3 write-isolation: user_b created a item row owned by user_a

POST /login/access-token

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

PASS A3 D5

target	variant	decision	leaked canaries	DB changes	count
nonexistent	valid_creds	DENY 400	-	-	None
nonexistent	wrong_password	DENY 400	-	-	None
superuser	valid_creds	ALLOW 200	-	-	None
superuser	wrong_password	DENY 400	-	-	None
user_a	valid_creds	ALLOW 200	-	-	None
user_a	wrong_password	DENY 400	-	-	None
user_b	valid_creds	ALLOW 200	-	-	None
user_b	wrong_password	DENY 400	-	-	None

POST /login/test-token

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	self	-	None

POST /password-recovery-html-content/{email}

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 401	-	-	None
superuser	base	DENY 401	-	-	None
user_a	base	DENY 401	-	-	None
user_b	base	DENY 401	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	DENY 404	-	-	None
user_a	base	DENY 404	-	-	None
user_b	base	DENY 404	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 400	-	-	None
superuser	base	DENY 400	-	-	None
user_a	base	DENY 400	-	-	None
user_b	base	DENY 400	-	-	None

PASS D1 I3

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
superuser	base	INCONCLUSIVE 599	-	-	None
user_a	base	INCONCLUSIVE 599	-	-	None
user_b	base	INCONCLUSIVE 599	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

PASS D4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None

POST /password-recovery/{email}

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

PASS A4

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	ALLOW 200	-	-	None
superuser	base	ALLOW 200	-	-	None
user_a	base	ALLOW 200	-	-	None
user_b	base	ALLOW 200	-	-	None

POST /reset-password/

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

POST /users/

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None
-	hostile	DENY 401	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None
-	hostile	DENY 404	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None
-	hostile	DENY 400	-	-	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new[privileged]	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

PASS D2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None
-	hostile	DENY 403	-	-	None

POST /users/signup

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

PASS A2

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 200	-	insert:user:new	None
-	hostile	ALLOW 200	-	insert:user:new	None

POST /utils/test-email/

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 401	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 404	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 400	-	-	None

PASS A1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	ALLOW 201	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PASS D1

target	variant	decision	leaked canaries	DB changes	count	violation
-	base	DENY 403	-	-	None

PUT /items/{id}

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 401	-	-	None
nonexistent	hostile	DENY 401	-	-	None
superuser	base	DENY 401	-	-	None
superuser	hostile	DENY 401	-	-	None
user_a	base	DENY 401	-	-	None
user_a	hostile	DENY 401	-	-	None
user_b	base	DENY 401	-	-	None
user_b	hostile	DENY 401	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
nonexistent	hostile	DENY 404	-	-	None
superuser	base	DENY 404	-	-	None
superuser	hostile	DENY 404	-	-	None
user_a	base	DENY 404	-	-	None
user_a	hostile	DENY 404	-	-	None
user_b	base	DENY 404	-	-	None
user_b	hostile	DENY 404	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 403	-	-	None
nonexistent	hostile	DENY 403	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS D8

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 400	-	-	None
nonexistent	hostile	DENY 400	-	-	None
superuser	base	DENY 400	-	-	None
superuser	hostile	DENY 400	-	-	None
user_a	base	DENY 400	-	-	None
user_a	hostile	DENY 400	-	-	None
user_b	base	DENY 400	-	-	None
user_b	hostile	DENY 400	-	-	None

PASS A6 D2

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
nonexistent	hostile	DENY 404	-	-	None
superuser	base	ALLOW 200	self	update:item:self	None
superuser	hostile	ALLOW 200	self	update:item:self	None
user_a	base	ALLOW 200	user_a	update:item:user_a	None
user_a	hostile	ALLOW 200	user_a	update:item:user_a	None
user_b	base	ALLOW 200	user_b	update:item:user_b	None
user_b	hostile	ALLOW 200	user_b	update:item:user_b	None

PASS A2 D6

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
nonexistent	hostile	DENY 404	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	ALLOW 200	self	update:item:self	None
user_a	hostile	ALLOW 200	self	update:item:self	None
user_b	base	DENY 403	-	-	None
user_b	hostile	DENY 403	-	-	None

PASS A2 D6

target	variant	decision	leaked canaries	DB changes	count
nonexistent	base	DENY 404	-	-	None
nonexistent	hostile	DENY 404	-	-	None
superuser	base	DENY 403	-	-	None
superuser	hostile	DENY 403	-	-	None
user_a	base	DENY 403	-	-	None
user_a	hostile	DENY 403	-	-	None
user_b	base	ALLOW 200	self	update:item:self	None
user_b	hostile	ALLOW 200	self	update:item:self	None

Generated by report.py from the lockfile; the verdict is computed by authzlock.diff (deterministic, no LLM).