From f86247c83500cfb94bde290ae7c43c2e51f88691 Mon Sep 17 00:00:00 2001 From: Jeff Larson Date: Sat, 1 Aug 2026 14:19:24 -0700 Subject: [PATCH] test(bench): add route-forwarded-backend fixture to cut-choice bench (ADR-0034) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a route_forwarded_entry_cve CASE to judge_bakeoff_cutchoice.py: a backend reached only via an Ingress route (no direct Service exposure), rendered in the ENTRY position with its own loaded-at-runtime CVE. Expected assessment=attack, contain=only that backend — mirroring entry_only_log4j but with a distinct node identity (checkout-api-7f9d4c8b6d-x2p9k) so it's clearly the route-forwarded case. This validates that the Ingress exposure observer's Exposure::Internet promotion of a route-forwarded backend feeds the T2b cut-choice prompt through the same edge-CVE lane as a directly-exposed entry. Confirmed locally: the script imports and CASES/render() build the prompt without error (dry parse only, no model call). The AUTHORITATIVE deployed-judge validation (does this fixture pass on qwen3:1.7b via the cluster port-forward, and do downstream_cve_only / downstream_behavioral still hold with no drift) is pending and runs separately against the deployed judge. --- scripts/judge_bakeoff_cutchoice.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/scripts/judge_bakeoff_cutchoice.py b/scripts/judge_bakeoff_cutchoice.py index 89d235f..93e8359 100644 --- a/scripts/judge_bakeoff_cutchoice.py +++ b/scripts/judge_bakeoff_cutchoice.py @@ -91,12 +91,25 @@ def menu(*lines): OBJS = (f" - secret/public/web-session.key [MOUNTED] ({CRED})\n" f" - {CACHE} [NETWORK] [same-ns] (Collection: Data from Information Repositories)") +# A distinct node identity for the route-forwarded-backend fixture below (never has its own +# entry status confused with the direct-exposure ENTRY/CACHE pair above). +ROUTE_ENTRY = "workload/public/Pod/checkout-api-7f9d4c8b6d-x2p9k" +ROUTE_ENTRY_LINE = f" - <<<{ROUTE_ENTRY}>>>: isolate the internet-facing entry — deny all ingress + egress except proven-benign peers (reversible NetworkPolicy) [blast radius: drops the route-forwarded backend; 1 alive peer isolated]" + CASES = [ # entry-only breach: log4j loaded on the ENTRY -> attack, contain ONLY the entry. ("entry_only_log4j", "attack", {ENTRY}, ENTRY, "<<>>", "(none)", "<<>> <<>>", OBJS, f" - <<<{CACHE}>>>: no evidence observed.", menu(ENTRY_LINE, CACHE_LINE)), + # route-forwarded backend (no Service directly exposed; reached only via an Ingress route) + # rendered in the ENTRY position with its own loaded-at-runtime CVE -> attack, contain ONLY + # that backend. Validates the Ingress observer's Exposure::Internet promotion feeds this + # prompt through the same edge-CVE lane as a directly-exposed entry (ADR-0033). + ("route_forwarded_entry_cve", "attack", {ROUTE_ENTRY}, + ROUTE_ENTRY, "<<>>", "(none)", + "<<>> <<>>", + OBJS, f" - <<<{CACHE}>>>: no evidence observed.", menu(ROUTE_ENTRY_LINE, CACHE_LINE)), # downstream behavioral compromise, CLEAN entry -> attack, contain ONLY the downstream (the # minimality centerpiece: the entry must be LEFT running). ("downstream_behavioral", "attack", {CACHE},