RS3C-10 — Updated Adversarial Matrix and Fail-Open Cases — 2026-06-21

Macro: RS3C (Mục tiêu G) · Deliverable: 10 of 13 Date: 2026-06-21 · read-only · 0 mutations · criteria, not executed (no test run claimed) Total cases: 50 = 40 carried from RS3B-09 + 10 new (Codex C1/C2/C3 + source-contradiction cases). Anti-fail-open rule (retained): any uncertainty, unproven carrier/writer/authority, missing nonce state, inventory mismatch, hash mismatch, or unread source ⇒ REJECT / HOLD, never admit.

---

1. Carried cases (RS3B-09, 1–40) — category roll-up (unchanged, still required)

Range	Category	Expected disposition
1–4	Source unavailable / mass scan / wrong artifact / path traversal	REJECT / HOLD
5–10	Hash & carrier defects (no hash col, caller-proposed hash, snapshot unproven)	FAIL_CLOSED
11–16	Catalog race / clobber / on-deploy overlap	FENCE / REJECT
17–24	Replay / attempt / nonce (pre-C1 form)	FAIL_CLOSED
25–30	Rollback / partial-batch / audit-from-rolled-back-txn	COMPENSATE / REJECT
31–34	Trigger activation / gate opening	PRESERVE GATE / REJECT
35–38	Guard reachability / drift / missing Owner / missing APR	HOLD
39–40	Proposed-as-trusted / timestamp-trusted	REJECT

(Full 40-case text remains in RS3B-09; this rerun does not weaken any of them. Several are now upgraded from "criteria" to "source-confirmed real" — see §2 cross-refs.)

2. New cases (41–50), source-grounded

#	Case	Trigger condition	Required disposition	Source / live evidence
41	AUTH_NONCE_REUSED	same authorization_nonce presented for two requests	REJECT 2nd — nonce consumed once via UNIQUE(authorization_nonce)	RS3C-07 §1, §6#7-8
42	AUTH_NONCE_NOT_DURABLY_CONSUMED	nonce only hashed into replay_key, no separate consume row	HOLD/FAIL_CLOSED — require separate durable consume (C1)	RS3C-07 §2 (Codex C1)
43	LOGICAL_KEY_AND_NONCE_CONFLATED	one constraint claims to cover both effect-uniqueness and nonce single-use	REJECT — demand two independent unique constraints	RS3C-07 §1–2
44	ATTEMPT_ID_USED_AS_EFFECT_KEY	admission gated on attempt_id/attempt_no (e.g. reuse iu_route_attempt)	REJECT — attempt_id_not_unique_for_effect; UNIQUE(idempotency_key,attempt_no) admits repeats	RS3C-07 §4 (live iu_route_attempt_idem_uniq)
45	TARGET_VERIFIER_ROW_ASSUMED	assuming a verifier dot_tools row is auto-created per target	REJECT — one primary row; verifier only on explicit target-contract demand	RS3C-08 §2 (L148–151)
46	CONTROL_PAIR_CONFUSED_WITH_TARGET_PAIR	treating DOT-REGISTER↔DOT-HEALTH-DOT as a per-target two-row rule	REJECT — control pair = 2 pre-existing identities; paired_dot is a field copy	RS3C-08 §3 (Codex C2)
47	TRIGGER_INVENTORY_COUNT_MISMATCH	stated trigger count ≠ enumerated names	HOLD until re-derived from pg_catalog.pg_trigger (split tgisinternal)	RS3C-09 §2 (Codex C3)
48	CATALOG_SYNC_SOURCE_CONTRADICTS_BOUNDARY	catalog-sync found writing dot_tools	N/A — DISPROVEN: source writes only meta_catalog.record_count; if a future version writes dot_tools, REJECT without a governed write contract	RS3C-04 C6, RS3C-05
49	REGISTRAR_SOURCE_CONTRADICTS_SINGLE_ARTIFACT_CONTRACT	registrar mass-scans / multi-registers	CONFIRMED REAL → HOLD: operational registrar non-compliant (mass glob, no txn, status=active, fail-open)	RS3C-03 B4–B6/B12/B16/B18, RS3C-06
50	SOURCE_MIRROR_HASH_MISMATCH	mirror sha256 ≠ deployed snapshot hash	REJECT mirror (as was done for the web-test registrar copy = backup hash)	RS3C-01 §3 step 6, RS3C-02 §1

3. Fail-open guardrails confirmed by source (new this rerun)

Guardrail	Source defect found	Disposition
Success must equal HTTP-2xx + readback	registrar logs success on curl-exit-0 even on HTTP 4xx/5xx (no -f)	fail-open → must reject this pattern (RS3C-03 B18)
Dedup must be exact identity	unanchored substring grep, absolute-vs-normalized path mismatch	fail-open → duplicates (RS3C-03 B8)
DB must backstop identity	no UNIQUE(code/file_path), only PK(id)	fail-open → add unique on identity axis (RS3C-03 B9)
Registration must be inert	status:"active" hardcoded	violates closed-at-registration (RS3C-03 B12)
Authority must gate write	no Owner/APR/gate check in source	HOLD — authority absent (RS3C-03 B19)

4. Status

• 50 cases total; 10 new are source/live-grounded.
• No case is marked PASS/executed; all are criteria with required dispositions.
• Registration gate unchanged: REGISTRATION_HOLD · CAN_PROCEED = NO.