{
 "schema": "cain42.redteam.evolution.v1",
 "date": "2026-11-02",
 "engine_version_after": "redteam-keystone-1.1.0",
 "blind_set": "scripts/redteam/blind_2026_11_02.py (12 real-world bypasses outside the generator + 2 controls, written before any change)",
 "question": "After Red-Team says PATCHED or HELD, does the patched policy still let through a call the real tool would treat as forbidden?",
 "runs": [
  {
   "run": 1,
   "engine": "1.0.0",
   "held": "2/14",
   "note": "only the 2 controls held: all 12 bypasses survived a PATCHED or HELD verdict"
  },
  {
   "run": 2,
   "engine": "1.1.0",
   "held": "14/14",
   "note": "after the fixes; while fixing, 2 cases first still failed (tag characters were deleted instead of decoded; the /proc/self/root attack normalised to '/etc' without its slash) and were corrected"
  }
 ],
 "what_it_means": "Red-Team's PATCHED meant 'closed against the bypass families it generates', not 'safe'. The 1.1.0 pages say exactly that.",
 "findings": [
  {
   "id": "RT-11-02-1",
   "what": "Shell deny rules bypassed by quote removal: c''url, cu\\rl, r\"m\" -rf",
   "before": "ALLOW after patch",
   "after": "segments matched after quote and backslash removal; new attack family quote_split"
  },
  {
   "id": "RT-11-02-2",
   "what": "Shell deny rules bypassed by $'\\x63url' (ANSI-C quoting)",
   "before": "ALLOW after patch",
   "after": "$'..' decoded; new attack family ansi_c"
  },
  {
   "id": "RT-11-02-3",
   "what": "Shell deny rules bypassed by text built at run time: $(printf 'cu%sl' r)",
   "before": "ALLOW after patch",
   "after": "a deny rule matches any command containing $( ` or <( (fail closed); new family substitution_split"
  },
  {
   "id": "RT-11-02-4",
   "what": "Invisible U+2063 and Unicode tag characters (ASCII smuggling) inside a blocked phrase",
   "before": "ALLOW after patch",
   "after": "all format characters removed; tag characters read as the ASCII they carry; new family invisible_format"
  },
  {
   "id": "RT-11-02-5",
   "what": "MySQL executable comment /*!50000DROP*/ TABLE: the sql normalization deleted the comment MySQL runs",
   "before": "ALLOW after patch",
   "after": "/*!..*/ and /*+..*/ kept as code; new family versioned_comment"
  },
  {
   "id": "RT-11-02-6",
   "what": "Cloud metadata IP as 2852039166, 0xa9.0xfe.0xa9.0xfe or [::ffff:169.254.169.254]",
   "before": "HELD verdict, bypass ALLOW",
   "after": "IP literals get one spelling; deny host_in rules now get decimal_ip, hex_ip, mapped_ipv6 attacks"
  },
  {
   "id": "RT-11-02-7",
   "what": "/etc reached as /proc/self/root/etc/shadow",
   "before": "HELD verdict, bypass ALLOW",
   "after": "/proc/self|thread-self|<pid>/root resolved; new family proc_root"
  }
 ],
 "both_implementations": "every change is made twice, in keystone/redteam.py and the clean-room keystone/redteam_verify.py (stdlib only; socket and ipaddress added), and the spec text; the random-policy agreement tests pass",
 "tests": {
  "file": "tests/test_redteam_keystone.py",
  "before": 47,
  "after": 57,
  "all_pass": true
 },
 "live": "the gateway imports keystone/redteam.py: 1.1.0 is live after the next deploy; until then the demo boxes show the 1.0.0 answers (the bypasses are ALLOWED)",
 "self_run": "our own runs; no independent test",
 "run1_rows": [
  {
   "name": "shell_quote_split",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "shell_backslash_split",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "shell_double_quote_split",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "shell_ansi_c_quoting",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "shell_subshell_inside_deny_only_policy",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "text_invisible_separator",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "text_tag_characters",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "sql_mysql_versioned_comment",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode', 'sql'], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "url_decimal_ip_metadata",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict HELD, patch adds [], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "url_hex_ip_metadata",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict HELD, patch adds [], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "url_ipv4_mapped_ipv6",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict HELD, patch adds [], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "path_proc_self_root",
   "want": "refused",
   "outcome": "allowed",
   "detail": "verdict HELD, patch adds [], bypass -> ALLOW",
   "pass": false
  },
  {
   "name": "control_ordinary_shell_allowed",
   "want": "allowed",
   "outcome": "allowed",
   "detail": "verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW",
   "pass": true
  },
  {
   "name": "control_ordinary_url_allowed",
   "want": "allowed",
   "outcome": "allowed",
   "detail": "verdict HELD, patch adds [], bypass -> ALLOW",
   "pass": true
  }
 ]
}