Hi Iman, Thank you for checking the probe and for pointing out both weaknesses.
I strengthened T4 so it now exercises the actual guarded execution path rather than only evaluating a predicate. The same guarded path is used in both directions: no-race control: the guarded path commits; external prerequisite changed: the guarded path refuses with zero effect. I also made T7b explicit. The case is now: final read sees compliance v4 / approved; compliance changes to v5 / suspended; target remains v7; the target-only mutation still commits. That makes the intended distinction clearer: fresh observation != commit-time guarantee The probe now separates three things: Target-resource conditional enforcement. Application-level prerequisite enforcement when the changed prerequisite is visible before the guarded execution path runs. Post-final-read revocation, where a fresh read can still lose the race before the actual mutation commits. I also tightened the scope language in the README. These are deterministic in-memory model cases, not live tests against OAuth, HTTP servers, WebDAV, EMILIA/AEB, or participating providers, and I am not treating the result as proof of a standards gap. The remaining interoperability question I am trying to isolate is therefore narrower: When authorization depends on independently changing state maintained by more than one authority, is there an existing generic mechanism that both conveys the required conjunction of preconditions to the effecting component and gives those preconditions commitment/ordering semantics strong enough to survive revocation after the final read? Pinned commit: https://github.com/altrudev/authorization-transition-closure/commit/502d27e5fea506fab708bcdec48f14b60ab3f2eb Probe path: experiments/ietf-commit-boundary-probe/ietf_commit_boundary_probe.py I’ve attached the updated probe, README, generated results, and SHA-256. Thanks again for the review. Best, Valentyn Rukhaylo On Sun, Sep 13, 2026, 21:50 Iman Schrock <[email protected]> wrote: > Hi Valentyn, > > Thanks for sending the probe. I checked the SHA-256 and reran it. All > eight scenario outputs match your results.json. > > > [VR] fresh observation != commit-time guarantee > > [IS] T7b demonstrates that ordering in the model: the final read > passes, the approved compliance version changes, and the target > mutation still occurs. The unchanged-state control commits too. > > There is one test I'd strengthen before using this to compare > implementations. T4 calculates all_ok but never calls a guarded > execution path, so its zero effect doesn't yet test enforcement. Could > it call that path and assert refusal with zero effect, alongside a > no-race case that commits through the same path? That would catch a > guard being bypassed. > > For T7b, the code changes compliance.version but leaves > compliance.value at 1. I'd describe the current case as invalidation > of the approved version. If you mean an actual change from approved to > suspended, could that state change and its predicate be explicit too? > > > [VR] I can put it in a public GitHub commit next if that is the most > useful form for comparison. > > [IS] Yes, a pinned commit with the probe and results would give us a > shared baseline. Your README is right that this doesn't establish a > standards gap. I'd also say explicitly that these are in-memory cases > modeling the checks, not tests against OAuth, HTTP servers or > participating providers. > > Best, > Iman >
749461e8cff8bf66aabd393957be79b76e292d0f3e0440f1c322f168b3fc21f0 ietf_commit_boundary_probe.py
# IETF Commit-Boundary Probe v0.3 This deterministic in-memory probe models whether a fresh final read of independently changing prerequisite state establishes a commit-time guarantee. It does **not** test OAuth, HTTP servers, WebDAV servers, EMILIA/AEB implementations, or real participating providers. It models checks and orderings so candidate mechanisms can be compared against the same traces. ## Key traces - T1: target-only no-race control commits. - T2: target changes before commit; target guard refuses with zero effect. - T3: external budget prerequisite changes while target remains unchanged; target-only guard still commits. - T4a: full application guard, no race; guarded path commits. - T4b: same guarded path after external prerequisite changes; it refuses with zero effect. This tests enforcement rather than merely calculating a predicate. - T5: verifier passes, target changes; mutation-boundary target guard refuses. - T6: verifier passes, compliance changes from approved to suspended while target stays unchanged; target-only guard still commits. - T7a: final read passes and nothing changes; commit succeeds. - T7b: final read passes at compliance v4/approved, compliance changes to v5/suspended, then target mutation commits; target-only commit still succeeds. T7b demonstrates the modeled distinction: `fresh observation != commit-time guarantee`. ## Scope This probe does **not** by itself establish a standards gap or claim that OAuth RAR, RFC 9110 conditional requests, WebDAV, Transaction Tokens, EMILIA/AEB, or another specification is defective. The remaining interoperability question is whether an existing generic mechanism both conveys a conjunction of independently versioned execution preconditions to the effecting boundary and gives them commitment/ordering semantics strong enough to survive post-read revocation across participating authorities. ## Run ```bash python3 ietf_commit_boundary_probe.py > results.json sha256sum ietf_commit_boundary_probe.py ``` The script contains assertions for every scenario and exits non-zero if an expected outcome changes.
Hi Iman, Thanks — I tightened both points. T4 now exercises the actual guarded execution path in both directions: - no-race control -> the guarded path commits; - external prerequisite changed -> the same guarded path refuses with zero effect. For T7b, the prerequisite change is now explicit rather than version-only: - final read sees compliance v4 / approved; - compliance changes to v5 / suspended; - target remains v7; - target-only commit still succeeds. So the probe now distinguishes: 1. target-resource conditional enforcement; 2. application-level prerequisite enforcement when the change is visible before the guard; 3. post-final-read revocation, where observation freshness still does not create a commit-time guarantee. I also made the scope explicit: these are deterministic in-memory model cases, not tests against OAuth, HTTP servers, WebDAV servers, EMILIA/AEB, or real participating providers, and they do not by themselves establish a standards gap. Pinned public commit: https://github.com/altrudev/authorization-transition-closure/commit/502d27e5fea506fab708bcdec48f14b60ab3f2eb Probe path: experiments/ietf-commit-boundary-probe/ietf_commit_boundary_probe.py Attached are the probe, README, generated results, and SHA-256. Thanks, Valentyn
from __future__ import annotations
from dataclasses import dataclass
from typing import Dict, Tuple
@dataclass
class Resource:
version: int
value: int = 0
@dataclass(frozen=True)
class Approval:
target_version: int
external_versions: Dict[str, int]
action: str = "increment"
amount: int = 1
class World:
def __init__(self) -> None:
self.resources = {
"target": Resource(7, 0),
"budget": Resource(12, 100),
"compliance": Resource(4, 1),
}
def snapshot(self) -> Dict[str, int]:
return {name: r.version for name, r in self.resources.items()}
def mutate_version(self, name: str) -> None:
self.resources[name].version += 1
def revoke_compliance(self) -> None:
self.resources["compliance"].version += 1
self.resources["compliance"].value = 0
def execute_if_match_only(self, approval: Approval) -> Tuple[bool, str]:
if self.resources["target"].version != approval.target_version:
return False, "target_precondition_failed"
self.resources["target"].value += approval.amount
self.resources["target"].version += 1
return True, "committed"
def execute_full_guarded(self, approval: Approval) -> Tuple[bool, str]:
if self.resources["target"].version != approval.target_version:
return False, "target_precondition_failed"
for name, expected in approval.external_versions.items():
if self.resources[name].version != expected:
return False, f"{name}_version_precondition_failed"
if self.resources["compliance"].value != 1:
return False, "compliance_predicate_failed"
self.resources["target"].value += approval.amount
self.resources["target"].version += 1
return True, "committed"
def final_read_then_commit(self, approval: Approval, *, revoke_after_final_read: bool) -> Dict[str, object]:
target_ok = self.resources["target"].version == approval.target_version
external_ok = all(
self.resources[name].version == expected
for name, expected in approval.external_versions.items()
)
compliance_ok = self.resources["compliance"].value == 1
if not (target_ok and external_ok and compliance_ok):
return {
"final_read_passed": False,
"commit": (False, "final_read_failed"),
"effect": self.resources["target"].value,
}
if revoke_after_final_read:
self.revoke_compliance()
result = self.execute_if_match_only(approval)
return {
"final_read_passed": True,
"compliance_version_still_matches_at_commit":
self.resources["compliance"].version == approval.external_versions["compliance"],
"compliance_approved_at_commit": self.resources["compliance"].value == 1,
"commit": result,
"effect": self.resources["target"].value,
}
def authorize(world: World) -> Approval:
s = world.snapshot()
return Approval(
target_version=s["target"],
external_versions={"budget": s["budget"], "compliance": s["compliance"]},
)
def verifier_passes(world: World, approval: Approval) -> bool:
return (
world.resources["target"].version == approval.target_version
and all(
world.resources[name].version == expected
for name, expected in approval.external_versions.items()
)
and world.resources["compliance"].value == 1
)
def run_matrix() -> Dict[str, object]:
out: Dict[str, object] = {}
w = World(); a = authorize(w)
out["T1_control"] = {"verifier": verifier_passes(w, a), "result": w.execute_if_match_only(a), "effect": w.resources["target"].value}
w = World(); a = authorize(w); assert verifier_passes(w, a); w.mutate_version("target")
out["T2_target_race_if_match"] = {"result": w.execute_if_match_only(a), "effect": w.resources["target"].value}
w = World(); a = authorize(w); assert verifier_passes(w, a); w.mutate_version("budget")
out["T3_external_race_if_match_only"] = {
"target_version_still_matches": w.resources["target"].version == a.target_version,
"budget_version_matches": w.resources["budget"].version == a.external_versions["budget"],
"result": w.execute_if_match_only(a),
"effect": w.resources["target"].value,
}
w = World(); a = authorize(w)
out["T4a_full_guard_no_race"] = {"result": w.execute_full_guarded(a), "effect": w.resources["target"].value}
w = World(); a = authorize(w); assert verifier_passes(w, a); w.mutate_version("budget")
out["T4b_external_race_full_guard"] = {"result": w.execute_full_guarded(a), "effect": w.resources["target"].value}
w = World(); a = authorize(w); before = verifier_passes(w, a); w.mutate_version("target")
out["T5_verifier_to_commit_target_race"] = {"verifier_before_race": before, "result": w.execute_if_match_only(a), "effect": w.resources["target"].value}
w = World(); a = authorize(w); before = verifier_passes(w, a); w.revoke_compliance()
out["T6_verifier_to_commit_external_race"] = {
"verifier_before_race": before,
"target_version_still_matches": w.resources["target"].version == a.target_version,
"compliance_approved": w.resources["compliance"].value == 1,
"result_if_match_only": w.execute_if_match_only(a),
"effect": w.resources["target"].value,
}
w = World(); a = authorize(w)
out["T7a_final_read_no_race"] = w.final_read_then_commit(a, revoke_after_final_read=False)
w = World(); a = authorize(w)
out["T7b_revoked_after_final_read"] = w.final_read_then_commit(a, revoke_after_final_read=True)
return out
def self_test(results: Dict[str, object]) -> None:
assert results["T1_control"]["result"][0] is True
assert results["T2_target_race_if_match"]["result"][0] is False
assert results["T3_external_race_if_match_only"]["target_version_still_matches"] is True
assert results["T3_external_race_if_match_only"]["budget_version_matches"] is False
assert results["T3_external_race_if_match_only"]["result"][0] is True
assert results["T4a_full_guard_no_race"]["result"][0] is True
assert results["T4a_full_guard_no_race"]["effect"] == 1
assert results["T4b_external_race_full_guard"]["result"][0] is False
assert results["T4b_external_race_full_guard"]["effect"] == 0
assert results["T5_verifier_to_commit_target_race"]["verifier_before_race"] is True
assert results["T5_verifier_to_commit_target_race"]["result"][0] is False
assert results["T6_verifier_to_commit_external_race"]["verifier_before_race"] is True
assert results["T6_verifier_to_commit_external_race"]["target_version_still_matches"] is True
assert results["T6_verifier_to_commit_external_race"]["compliance_approved"] is False
assert results["T6_verifier_to_commit_external_race"]["result_if_match_only"][0] is True
assert results["T7a_final_read_no_race"]["final_read_passed"] is True
assert results["T7a_final_read_no_race"]["compliance_approved_at_commit"] is True
assert results["T7a_final_read_no_race"]["commit"][0] is True
assert results["T7b_revoked_after_final_read"]["final_read_passed"] is True
assert results["T7b_revoked_after_final_read"]["compliance_version_still_matches_at_commit"] is False
assert results["T7b_revoked_after_final_read"]["compliance_approved_at_commit"] is False
assert results["T7b_revoked_after_final_read"]["commit"][0] is True
assert results["T7b_revoked_after_final_read"]["effect"] == 1
if __name__ == "__main__":
import json
results = run_matrix()
self_test(results)
print(json.dumps(results, indent=2))
results.json
Description: application/json
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
