{
  "ok": true,
  "source": "replay",
  "generatedAt": "2026-09-04T03:09:24.758Z",
  "commit": "c20cc1f",
  "validator": "packages/index/src/integrity.mjs (via createCatalog().upsert)",
  "note": "Replay of a fixed hostile corpus through the shipped validator. Every rule, verdict and reason is the validator’s own output. Not observed traffic.",
  "total": 16,
  "skippedCases": 0,
  "integrity": [
    {
      "at": 1788491364759,
      "verdict": "rejected",
      "rule": "resource.url",
      "field": "resource.url",
      "input": "javascript:alert(1)",
      "reason": "resource.url is missing or invalid",
      "survived": null
    },
    {
      "at": 1788491364759,
      "verdict": "rejected",
      "rule": "type",
      "field": "type",
      "input": "grpc",
      "reason": "type must be one of http|mcp",
      "survived": null
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "routeTemplate",
      "field": "routeTemplate",
      "input": "/v1/parse/:id/../../admin/keys",
      "reason": "routeTemplate contains path traversal \"..\" after decoding",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "routeTemplate",
      "field": "routeTemplate",
      "input": "/v1/%252e%252e/thing",
      "reason": "routeTemplate contains path traversal \"..\" after decoding",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "routeTemplate",
      "field": "routeTemplate",
      "input": "/v1/redirect/https%3A%2F%2Fexfil.example",
      "reason": "routeTemplate contains \"://\" after decoding",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.iconUrl",
      "field": "resource.iconUrl",
      "input": "http://169.254.169.254/latest/meta-data/",
      "reason": "iconUrl host rejected: IP literal host (decimal/octal/hex)",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.iconUrl",
      "field": "resource.iconUrl",
      "input": "http://2130706433/i.png",
      "reason": "iconUrl host rejected: IP literal host (decimal/octal/hex)",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.iconUrl",
      "field": "resource.iconUrl",
      "input": "http://0177.0.0.1/i.png",
      "reason": "iconUrl host rejected: IP literal host (decimal/octal/hex)",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.iconUrl",
      "field": "resource.iconUrl",
      "input": "http://[::1]/i.png",
      "reason": "iconUrl host rejected: IPv6 / bracketed host literal",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.iconUrl",
      "field": "resource.iconUrl",
      "input": "https://user:pass@cdn.example.com/i.png",
      "reason": "iconUrl must not contain userinfo",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.iconUrl",
      "field": "resource.iconUrl",
      "input": "data:image/svg+xml;base64,PHN2Zz48L3N2Zz4=",
      "reason": "iconUrl scheme \"data:\" is not http/https",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.tags[5]:over-limit",
      "field": "resource.tags",
      "input": "[\"invoice\",\"inv\",\"invoices\", … 96 more]",
      "reason": "99 tags submitted, catalog keeps 5 — overflow dropped to contain index pollution",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.tags[1]",
      "field": "resource.tags",
      "input": "[\"inv\\u0000oice\"]",
      "reason": "tag contains control characters",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.description:truncated",
      "field": "resource.description",
      "input": "\"best api in the world …\" (18,204 chars)",
      "reason": "description is 18,204 characters, catalog keeps 512 — truncated before BM25 indexing",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "resource.serviceName",
      "field": "resource.serviceName",
      "input": "payment-service\\u202Egnp.exe",
      "reason": "serviceName contains non-printable-ASCII characters",
      "survived": "record kept"
    },
    {
      "at": 1788491364759,
      "verdict": "soft-drop",
      "rule": "input.schema",
      "field": "input.schema",
      "input": "{ \"$ref\": \"https://exfil.example/schema.json\" }",
      "reason": "external reference not allowed: $.$ref = https://exfil.example/schema.json",
      "survived": "record kept"
    }
  ]
}