utas: first real corpus, and two sanitiser gaps the audit caught

24 transactions across 11 connections from a retail session: login, hub, one pack open, two squad saves, a quick-sell, with before/after state manifests. Raw .ofcap stays gitignored at 0600; the sanitized corpus is committed as adapter fixtures. TWO GAPS FOUND BY AUDITING THE OUTPUT, NOT BY TRUSTING THE SANITISER. 1. `POST /ut/auth` carries `macAddress` and `deviceId`. Session tokens were being redacted correctly and these were not. A committed fixture is a published fixture. 2. Then, with those fixed, the audit fired AGAIN on the file about to be committed: `GET .../phishing/trusteddevice?deviceId=...` puts the id in the QUERY STRING. Three input surfaces carry identifiers -- headers, JSON bodies, and query strings -- and the sanitiser knew about two. Both fixed in the tool rather than by editing the file, with a regression test and a mutation for the query path. AND A THIRD ARTEFACT MIX-UP, in the mutation harness itself. It reported the query-redaction mutation as SURVIVED while a hand-run of the same mutation killed it. Cause: the harness pointed at a stale scratchpad copy of the test that pre-dated the query assertion, so it was faithfully testing the mutated tool against a test that could not detect the mutation. That is the same class as the build guard checking the wrong binary and cargo reusing a binary compiled from mutated source -- the third instance today of measuring the wrong artifact. The harness now resolves ROOT from its own location and runs the COMMITTED test; the stale copy is deleted. Harness committed as scripts/mutate-utas-observe.py so this is repeatable rather than a thing that happened once in a scratch directory. 6/6 killed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 18:33:59 +00:00
parent cdea85e214
commit 0b66662525
6 changed files with 405 additions and 50 deletions
@@ -0,0 +1,84 @@
+{
+  "routes": {
+    "accountInfo": {
+      "body_len": 2,
+      "fields": {
+        "keys": []
+      },
+      "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+      "status": 200
+    },
+    "activeSquad": {
+      "body_len": 8034,
+      "fields": {
+        "formation": "f442",
+        "id": 0,
+        "players.count": 23,
+        "slots": {
+          "0": 100000003,
+          "1": 100000006,
+          "10": 100000010,
+          "11": 0,
+          "12": 0,
+          "13": 0,
+          "14": 0,
+          "15": 0,
+          "16": 0,
+          "17": 0,
+          "18": 0,
+          "19": 0,
+          "2": 100000005,
+          "20": 0,
+          "21": 0,
+          "22": 0,
+          "3": 100000008,
+          "4": 100000007,
+          "5": 100000002,
+          "6": 100000004,
+          "7": 100000009,
+          "8": 100000001,
+          "9": 100000025
+        }
+      },
+      "sha256": "07e330ed358fbefe31379cd2462aaac4bdc9c85ee28b7500dd2d963e5ea565bd",
+      "status": 200
+    },
+    "credits": {
+      "body_len": 148,
+      "fields": {
+        "credits": 28112944
+      },
+      "sha256": "0a5f3bac80c3a8ee6f088ccf180f5fdcbcbe8a2ef19c7026e4f21876016d7786",
+      "status": 200
+    },
+    "tradePile": {
+      "body_len": 862,
+      "fields": {
+        "auctionInfo.count": 1
+      },
+      "sha256": "b42bab98202209bd8309beb0eca73dba471688e69fef3e014b59901fbc21fe04",
+      "status": 200
+    },
+    "unassigned": {
+      "body_len": 16,
+      "fields": {
+        "itemData.count": 0
+      },
+      "sha256": "873f8bba8baf9c573fc51b54d100c357b3bf0caeb2ccd104245c295e073cf342",
+      "status": 200
+    },
+    "userMassInfo": {
+      "body_len": 8929,
+      "fields": {
+        "clubAbbr": "OFC",
+        "clubName": "OpenFUT",
+        "personaId": 33068179,
+        "trophies": 0
+      },
+      "sha256": "a616aca1742263c47ade9409693e66ec13b50114e608d88bb94141ce80237b66",
+      "status": 200
+    }
+  },
+  "unix": 1786472465.339646,
+  "upstream": "127.0.0.1:8099"
+}
@@ -0,0 +1,84 @@
+{
+  "routes": {
+    "accountInfo": {
+      "body_len": 2,
+      "fields": {
+        "keys": []
+      },
+      "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+      "status": 200
+    },
+    "activeSquad": {
+      "body_len": 8034,
+      "fields": {
+        "formation": "f442",
+        "id": 0,
+        "players.count": 23,
+        "slots": {
+          "0": 100000003,
+          "1": 100000010,
+          "10": 100000001,
+          "11": 100000002,
+          "12": 0,
+          "13": 0,
+          "14": 0,
+          "15": 0,
+          "16": 0,
+          "17": 0,
+          "18": 0,
+          "19": 0,
+          "2": 100000009,
+          "20": 0,
+          "21": 0,
+          "22": 0,
+          "3": 100000008,
+          "4": 100000007,
+          "5": 100000006,
+          "6": 100000005,
+          "7": 100000004,
+          "8": 100000025,
+          "9": 0
+        }
+      },
+      "sha256": "768bb0584ad953ac5f088ad029f161d302ee1be3a63826eb186405acaf1b6232",
+      "status": 200
+    },
+    "credits": {
+      "body_len": 148,
+      "fields": {
+        "credits": 28020656
+      },
+      "sha256": "8d39fee51c24ddee9f12d98d7833af6cd3d3399a0e7567ab7062945a1180e30f",
+      "status": 200
+    },
+    "tradePile": {
+      "body_len": 862,
+      "fields": {
+        "auctionInfo.count": 1
+      },
+      "sha256": "1575046afb8ca60c76de64427ee0c70e1d4ca2da032819a60db95d72d272d11d",
+      "status": 200
+    },
+    "unassigned": {
+      "body_len": 16,
+      "fields": {
+        "itemData.count": 0
+      },
+      "sha256": "873f8bba8baf9c573fc51b54d100c357b3bf0caeb2ccd104245c295e073cf342",
+      "status": 200
+    },
+    "userMassInfo": {
+      "body_len": 8929,
+      "fields": {
+        "clubAbbr": "OFC",
+        "clubName": "OpenFUT",
+        "personaId": 33068179,
+        "trophies": 0
+      },
+      "sha256": "3d89d0497661fc62f107081208a14c4fa5753ee4e6482eeda825fe4b622f871f",
+      "status": 200
+    }
+  },
+  "unix": 1786472102.908128,
+  "upstream": "127.0.0.1:8099"
+}