Harden authority and evidence boundaries for v0.4.1 (#16)

Authorization v2 binds URL, Host, SNI, CONNECT, query, and header-mutation scope. Redirect observations preserve state, cross-origin forwarding is deny by default, and plan/evidence identities are corrected for v0.4.1.

Author: 0xmrma

.github/workflows/ci.yml

@@ -93,7 +93,7 @@ jobs:
       - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
       - name: Validate packaged release baseline
         run: python -m pytest tests/test_benchmark.py::test_packaged_release_benchmark_is_schema_valid_and_passed
-      - name: Run loopback expert benchmark
+      - name: Run loopback benchmark
         run: python -c "from mrma.cli import main; main()" benchmark --out-json benchmark-result.json
 
   runtime-audit:
@@ -142,7 +142,7 @@ jobs:
           /tmp/mrma-wheel/bin/python -m pip check
           cd /tmp
           /tmp/mrma-wheel/bin/mrma --version
-          /tmp/mrma-wheel/bin/python -c "from importlib.resources import files; root=files('mrma.schemas'); assert all(root.joinpath(f'experiment-v{v}.schema.json').is_file() for v in (2,3,4,5,6,7)); assert root.joinpath('authorization-v1.schema.json').is_file(); assert root.joinpath('benchmark-v1.schema.json').is_file(); assert files('mrma').joinpath('benchmarks', 'release-baseline.json').is_file(); assert 'site-packages' in str(root)"
+          /tmp/mrma-wheel/bin/python -c "from importlib.resources import files; root=files('mrma.schemas'); assert all(root.joinpath(f'experiment-v{v}.schema.json').is_file() for v in (2,3,4,5,6,7,8)); assert all(root.joinpath(f'authorization-v{v}.schema.json').is_file() for v in (1,2)); assert all(root.joinpath(f'benchmark-v{v}.schema.json').is_file() for v in (1,2)); assert files('mrma').joinpath('benchmarks', 'release-baseline.json').is_file(); assert 'site-packages' in str(root)"
           cd /tmp
           /tmp/mrma-wheel/bin/python -c "import json; from importlib.resources import files; from mrma.evidence import validate_benchmark_document; validate_benchmark_document(json.loads(files('mrma').joinpath('benchmarks', 'release-baseline.json').read_text()))"
 

CHANGELOG.md

@@ -3,6 +3,36 @@
 All notable changes are documented here. MRMA follows semantic versioning for the CLI and uses an
 independent version in each machine-readable evidence schema.
 
+## 0.4.1 - 2026-07-20
+
+### Policy Boundaries
+
+- Added strict `mrma.authorization/v2` authority policy. URL authority, `Host`, TLS SNI, and proxy
+  CONNECT routing are bound before each attempt; duplicate `Host` fields are rejected and deliberate
+  virtual-host mutations require an exact allowlist.
+- Added per-rule query-key policy and exact header mutation name, operation, and value-size limits.
+- Replaced cross-origin credential-name filtering with deny-by-default header forwarding. Redirects
+  that change to `GET` also remove content, digest, trailer, and message-signature metadata.
+
+### Observation And Evidence Correctness
+
+- Scoped cookie and fresh-connection state to a complete logical observation so redirect and retry
+  hops retain required state without leaking it into the next isolated observation.
+- Added `mrma.plan/v2`, which binds effective requests, duplicate header order, bodies, experiment,
+  comparison, retry, redirect, hook, transport, and authorization policy into one digest.
+- Added strict `mrma.experiment/v8` with the effective plan and an accurate partial-correlation
+  declaration. Experiment schemas v2-v7 and authorization v1 are byte-locked.
+- Added neutral `mrma.benchmark/v2` and `trust-influence-loopback/2.0` identifiers.
+
+### Verification
+
+- Expanded the critical semantic mutation baseline from 12 to 18 invariants, including effective
+  authority, query scope, cross-origin fields, observation state, and plan body identity.
+- Regenerated the 22-case local benchmark under the v2 contract: all expected conclusions passed
+  across 942 authorized attempts.
+- Expanded the suite to 292 tests. The local branch-coverage gate reports 94.77% across critical
+  runtime modules and 86.11% across the corrected core, with every critical module above 90%.
+
 ## 0.4.0 - 2026-07-15
 
 ### Authorization-First Runtime
@@ -162,7 +192,7 @@ independent version in each machine-readable evidence schema.
   as immutable. V4 removes the scalar confidence grade and requires a multidimensional assurance
   profile.
 - Results now include structured limitations with stable code, severity, scope, message, and
-  remediation fields for CI policy and external review.
+  remediation fields for CI policy and independent validation.
 - Added authoritative `exploratory`, `research`, and `forensic` assurance presets. Research mode
   selects fresh connections, isolated response state, disabled retries, a 20-round bracketed
   design, standard privacy, and full body retention within the response bound.

README.md

@@ -4,36 +4,39 @@ MRMA is an authorization-enforcing, budgeted, recoverable HTTP trust-influence r
 It runs repeated control/mutation experiments to test whether one request property reproducibly
 changes an observed HTTP outcome.
 
-> **Status: v0.4.0 research preview and expert-review candidate.** MRMA uses a semantic HTTPX
-> transport. It does not provide wire-exact replay, prove exploitability, identify a proprietary
-> component from black-box behavior, or claim enterprise readiness.
+> **Status: v0.4.1 research release.** MRMA uses a semantic HTTPX transport. It does not provide
+> wire-exact replay, prove exploitability, or identify a proprietary component from black-box
+> behavior.
 
-## What v0.4.0 enforces
+## What v0.4.1 enforces
 
-- Every network attempt requires an accepted `mrma.authorization/v1` decision, a central budget
+- Every network attempt requires an accepted authorization decision, a central budget
   lease, and journal context.
-- Redirects are followed manually and reauthorized at every hop. Retries and setup/reset hooks are
-  separate charged attempts.
+- `mrma.authorization/v2` binds URL, `Host`, TLS SNI, and proxy CONNECT authority policy; it also
+  constrains query keys and exact header mutation operations.
+- Redirects are followed manually, reauthorized, and charged at every hop. Cross-origin request
+  fields use a deny-by-default forwarding policy, and redirect cookies live only for one logical
+  observation under isolated state.
 - Research assurance uses isolated state, fresh observation clients, disabled retries, bounded
   bodies, and a predeclared fixed sample.
 - Partial or resource-limited work returns `INCONCLUSIVE` with structured limitations.
-- `mrma.experiment/v7` evidence records policy, budget, journal, comparison, semantic, transport,
-  and runtime provenance without embedding the executable authorization grant.
+- `mrma.experiment/v8` evidence binds the effective plan and accurately distinguishes run-local
+  fingerprints from deterministically linkable policy identifiers.
 - Deterministic evidence bundles include the result, append-only hash-chained journal, schema,
   release benchmark, runtime manifest, digests, and replay instructions.
 
 ## Install
 
 ```bash
-python -m pip install mrma==0.4.0
+python -m pip install mrma==0.4.1
 mrma --version
 ```
 
 Python 3.10 and 3.13 are tested on Linux, Windows, and macOS (six CI environments).
 
 ## Start locally
 
-Run the loopback-only expert benchmark; it sends no traffic to public targets:
+Run the loopback validation corpus; it sends no traffic to public targets:
 
 ```bash
 mrma benchmark --out-json benchmark.json
@@ -58,7 +61,7 @@ mrma experiment \
   --dry-run
 ```
 
-Remove `--dry-run` to execute and create a review bundle:
+Remove `--dry-run` to execute and create an evidence bundle:
 
 ```bash
 mrma experiment \
@@ -92,16 +95,16 @@ initialized.
 
 ## Workflow status
 
-| Workflow | v0.4 status |
+| Workflow | Current status |
 |---|---|
-| `experiment` | Confirmatory fixed-sample `ExperimentOracle`; strict v7 result |
+| `experiment` | Confirmatory fixed-sample `ExperimentOracle`; strict v8 result |
 | `impact` | Exploratory ranking through the policy kernel; emits a candidate manifest |
 | `run`, `diff`, `discover`, `isolate`, profiles, report | Authorization/budget/journal guarded, but statistically exploratory |
 | Candidate confirmation | Independent `experiment` run bound to one candidate-manifest digest |
 
 ## Documentation
 
-- [Expert review](docs/EXPERT_REVIEW.md)
+- [Validation](docs/VALIDATION.md)
 - [Architecture](docs/ARCHITECTURE.md)
 - [Threat model](docs/THREAT_MODEL.md)
 - [Authorization](docs/AUTHORIZATION.md)
@@ -121,12 +124,6 @@ state-changing methods, path scope, redirect destinations, CIDRs, rates, byte li
 narrow as the research design permits. Report security defects through GitHub's private Security
 Advisory flow as described in [SECURITY.md](SECURITY.md).
 
-## Positioning
-
-MRMA v0.4.0 is an authorization-enforcing, budgeted, recoverable HTTP trust-influence research
-platform prepared for external expert evaluation. It remains a semantic-HTTP research tool; full
-product-wide oracle migration and protocol-exact HTTP backends are separate future milestones.
-
 ## Author
 
 Mohamed Abdelaal / [0xMRMA](https://0xmrma.com)

RELEASE_CHECKLIST.md

@@ -1,13 +1,13 @@
-# MRMA v0.4.0 release checklist
+# MRMA v0.4.1 release checklist
 
 ## Correctness and security
 
 - [ ] Every network command is covered by the architectural policy-boundary test.
 - [ ] Authorization, budget, redirect, retry, hook, journal, privacy, and partial-result adversarial tests pass.
-- [ ] `mrma.experiment/v7`, authorization v1, benchmark v1, and all negative fixtures validate.
-- [ ] Experiment schemas v2-v6 match committed immutable SHA-256 fixtures.
+- [ ] `mrma.experiment/v8`, authorization v2, benchmark v2, and all negative fixtures validate.
+- [ ] Experiment schemas v2-v7 and authorization v1 match immutable SHA-256 fixtures.
 - [ ] The 22-case loopback benchmark passes with zero false positives/negatives.
-- [ ] Critical semantic mutation gate kills all 12 committed mutants.
+- [ ] Critical semantic mutation gate kills all 18 committed mutants.
 - [ ] No unresolved P0/P1 correctness, authorization, evidence, or secret-exposure issue remains.
 
 ## Quality gates
@@ -24,18 +24,18 @@
 
 ## Distribution and container
 
-- [ ] Version is `0.4.0` in package metadata, import, CLI, wheel, and container.
+- [ ] Version is `0.4.1` in package metadata, import, CLI, wheel, and container.
 - [ ] Wheel and sdist build from a clean tree and pass `twine check`.
 - [ ] Clean wheel install passes `pip check` outside the source tree.
-- [ ] Clean wheel contains experiment v2-v7, authorization v1, benchmark v1, and release baseline.
+- [ ] Clean wheel contains experiment v2-v8, authorization v1-v2, benchmark v1-v2, and release baseline.
 - [ ] Non-root container builds from digest-pinned base and hash-locked dependencies.
 - [ ] Container smoke, local authorized experiment, bundle creation, and offline verification pass.
 - [ ] Multi-architecture OCI publication includes provenance and SBOM; final digest is recorded.
 
 ## Documentation and governance
 
-- [ ] README, SECURITY, ROADMAP, CHANGELOG, expert guide, and all model docs agree.
-- [ ] Product claim remains a research platform/expert-review candidate, not enterprise-ready.
+- [ ] README, SECURITY, ROADMAP, CHANGELOG, validation guide, and all model docs agree.
+- [ ] Product claims remain limited to implemented and verified behavior.
 - [ ] Semantic HTTP, unsigned authorization, DNS/socket binding, exploratory legacy, and hash-chain trust limitations are explicit.
 - [ ] Protected PR checks and review complete without weakening rules.
 - [ ] Release commit is clean; annotated tag is SSH-signed and accepted by release signer policy.
@@ -45,4 +45,4 @@
 ## Final report
 
 - [ ] Record release commit/tag, test/coverage/mutation results, dependency checks, wheel/sdist hashes,
-  OCI digest, evidence verification, migration status, deferred work, and exact conservative positioning.
+  OCI digest, evidence verification, migration status, deferred work, and exact release claims.

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-MRMA is a research preview. Only the latest patch release receives security fixes.
+MRMA is a research tool. Only the latest patch release receives security fixes.
 
 ## Reporting a vulnerability
 

docs/API.md

@@ -76,14 +76,14 @@ consuming repetition or budget.
 
 ## Evidence APIs
 
-- `build_experiment_v7`: convert an `OracleRunResult` plus provenance into strict evidence.
+- `build_experiment_v8`: convert an `OracleRunResult` plus provenance into strict evidence.
 - `validate_result_document`: JSON Schema and semantic cross-field verification.
 - `create_evidence_bundle`: deterministic atomic bundle creation from public evidence and journal.
 - `verify_evidence`, `verify_evidence_bundle`, `verify_journal`: offline integrity verification.
 - `validate_benchmark_document`: benchmark schema verification.
 
 ## Compatibility
 
-The v0.4 SDK surface is typed and strict-mypy clean, but MRMA is still a research preview. Schema
+The v0.4 SDK surface is typed and strict-mypy clean, but MRMA remains a research tool. Schema
 versions are stronger compatibility contracts than Python object internals. No API accepts an
 authorization bypass, and transport does not accept a bare URL/request.

docs/ARCHITECTURE.md

@@ -2,7 +2,7 @@
 
 ## Product boundary
 
-MRMA v0.4.0 has one confirmatory engine and one shared network policy kernel. The CLI parses input,
+MRMA v0.4.1 has one confirmatory engine and one shared network policy kernel. The CLI parses input,
 selects workflow policy, and renders output. It does not own transport authorization decisions.
 
 ```text
@@ -21,7 +21,7 @@ ExperimentOracle
 SemanticHttpAdapter (HTTPX, follow_redirects=False)
         |
         v
-CapturedResponse -> experiment analysis -> v7 evidence -> bundle
+CapturedResponse -> experiment analysis -> v8 evidence -> bundle
 ```
 
 ## Enforced boundaries
@@ -32,15 +32,16 @@ adapter revalidates context identity, records `ATTEMPT_STARTED`, performs one se
 attempt, commits actual bounded cost, and records completion. It cannot be called with only a URL.
 
 `ExperimentOracle` owns retries, redirect traversal, setup/reset hooks, schedules, observations,
-and partial-run conversion. HTTPX redirect following is always disabled. Every hop becomes a new
+and partial-run conversion. One observation session owns redirect/retry cookie state and its
+fresh-observation client. HTTPX redirect following is always disabled. Every hop becomes a new
 authorization decision and budget lease.
 
 ## Packages
 
 - `mrma.engine`: typed plan and confirmatory oracle.
 - `mrma.policy`: authorization, budgets, comparison, method risk, and protocol interfaces.
 - `mrma.transport`: semantic HTTP adapter and request-byte estimator.
-- `mrma.evidence`: append-only journal, v7 model, schema validation, bundles, and verification.
+- `mrma.evidence`: append-only journal, v8 model, schema validation, bundles, and verification.
 - `mrma.workflows`: candidate manifests and guarded legacy exploratory dispatch.
 - `mrma.core`: comparison, statistical experiment, HTTP semantics, request model, and retained
   legacy algorithms.
@@ -64,7 +65,7 @@ policy guarded but do not yet use the fixed-sample verdict oracle.
 - Supported HTTPX APIs do not reliably expose the connected address, peer certificate, TLS cipher,
   or ALPN for every transport. Evidence records `null` plus limitations instead of inspecting
   unstable internals.
-- Authorization manifests are unsigned v1 policy documents. Organizational signing and trust
+- Authorization manifests are unsigned policy documents. Organizational signing and trust
   roots are deferred.
 - The CLI remains a large module. Further decomposition is deferred while the network boundary is
   enforced and tested.

docs/AUTHORIZATION.md

@@ -2,14 +2,16 @@
 
 ## Manifest contract
 
-Research networking requires a strict `mrma.authorization/v1` JSON manifest. Unknown fields,
+Research networking requires a strict authorization JSON manifest. New manifests should use
+`mrma.authorization/v2`; v1 remains readable for compatibility. Unknown fields,
 duplicate keys, non-finite numbers, malformed tokens, wildcards, invalid time windows, and an
 incorrect optional digest are rejected.
 
 The manifest contains engagement, issuer, subject, issue/expiry times, exact schemes/hosts/ports,
 segment-bounded path prefixes, case-sensitive method tokens, operation kinds, CIDRs, body limits,
 method repetition policy, proxy/redirect policy, mutation families/risk classes, and the central
-budget. It must not contain secrets.
+budget. Version 2 additionally defines query-key rules, effective authority rules, exact header
+mutation operations, and cross-origin header forwarding. A manifest must not contain secrets.
 
 HTTP methods are case-sensitive under [RFC 9110 section 9.1](https://www.rfc-editor.org/rfc/rfc9110#section-9.1).
 `GET` and `get` are different tokens. Lowercase standard-looking methods are unknown extensions and
@@ -19,18 +21,21 @@ require explicit authorization and repetition limits.
 
 1. Validate the authorization validity window.
 2. Canonicalize the semantic target and reject URL userinfo.
-3. Match exact scheme, IDNA host, effective port, path segment, method, operation kind, and body
-   bound.
-4. Resolve all A/AAAA answers and require every address to fall inside an allowed CIDR.
-5. Validate explicit proxy name, port, and every proxy address when proxy use is enabled.
-6. Enforce the higher of method risk and declared mutation risk.
-7. Enforce idempotency-key and per-method repetition policy.
-8. Return an `AuthorizedRequestContext` containing only private canonical target data and public
+3. Resolve the effective URL, `Host`, TLS SNI, and proxy CONNECT authorities. Reject duplicate
+   `Host` fields and require every mismatch to be explicitly authorized.
+4. Match exact scheme, IDNA host, effective port, path segment, query policy, method, operation
+   kind, and body bound.
+5. Resolve all A/AAAA answers and require every address to fall inside an allowed CIDR.
+6. Validate explicit proxy name, port, and every proxy address when proxy use is enabled.
+7. Enforce the higher of method risk and declared mutation risk.
+8. Enforce idempotency-key, per-method repetition, and header mutation policy.
+9. Return an `AuthorizedRequestContext` containing only private canonical target data and public
    fingerprints.
-9. Revalidate expiry, target DNS, and proxy DNS immediately before transport.
+10. Revalidate expiry, target DNS, and proxy DNS immediately before transport.
 
-Redirect destinations repeat the sequence. Same-origin and cross-origin behavior is selected by the
-manifest; credentials are stripped cross-origin unless explicit policy permits forwarding.
+Redirect destinations repeat the sequence. Cross-origin hops retain only `Accept`,
+`Accept-Language`, and `User-Agent` by default. Additional fields require an explicit v2 allowlist.
+When redirect semantics change a method to `GET`, body and content/signature metadata are removed.
 
 ## Hooks and state-changing methods
 
@@ -49,4 +54,4 @@ CA digests, not values or paths.
 
 Keep manifests short-lived and generated under an external approval process. Restrict paths,
 methods, operation kinds, CIDRs, and budgets to the exact design. The local example authorizes only
-loopback port 8000. Authorization v1 is not signed and does not establish legal authority.
+loopback port 8000. Authorization manifests are not signed and do not establish legal authority.