FTH1 · RuneDomainNetwork · default-deny
ᚳᚪᛈᚪᛒᛁᛚᛁᛏᚣ ᚪᚾᛞ ᚾᚪᛗᛖᛋᛈᚪᚳᛖ ᛈᚩᛚᛁᚳᚣ
ᚦᛁᛋ ᛞᛖᛏᛖᚱᛗᛁᚾᛁᛋᛏᛁᚳ ᛚᚩᚳᚪᛚ ᛚᚪᚣᛖᚱ ᚳᚩᚾᛋᚢᛗᛖᛋ ᚪᚾ ACTIVE negotiated FTH1 session, ᛏᛖᛋᛏᛋ endpoint groups/capabilities, ᚪᚾᛞ ᛞᛖᚾᛁᛖᛋ undeclared cross-group transitions.
23ᛈᚩᛚᛁᚳᚣ tests PASS
9/9scenario fixtures
DENYᚳᚱᚩᛋᛋ-ᚷᚱᚩᚢᛈ default
ᛞᛖᚳᛁᛋᛁᚩᚾ ᛗᚪᛏᚱᛁᛉ
| case | decision | reason | rule |
|---|---|---|---|
| same-rdn-query | allow | same_group | rule.same-group.allow |
| same-other-query | allow | same_group | rule.same-group.allow |
| cross-default-deny | deny | cross_group_default_deny | rule.cross-group.default-deny |
| bridge-query-allow | allow | explicit_bridge | bridge.ear-to-othala.query |
| bridge-review-allow | allow | explicit_bridge | bridge.ear-to-othala.review |
| bridge-ack-allow | allow | explicit_bridge | bridge.othala-to-ear.ack |
| bridge-semantic-scope-deny | deny | cross_group_default_deny | rule.cross-group.default-deny |
| same-other-haegl-query | allow | same_group | rule.same-group.allow |
| haegl-protected-route-deny | deny | semantic_not_allowed_for_endpoint_group | rule.semantic.group-capability |
ᚷᚪᛏᛖᛋ
unknown-domain → deny · group spoof → deny · closed session → deny · flag/ontology escalation → deny · cross-group → deny unless explicit bridge.
ᚪ policy
allow ᛁᛋ ᚩᚾᛚᚣ ᚪ ᛚᚩᚳᚪᛚ result under checked-in fixtures. ᛁᛏ ᛁᛋ ᚾᚩᛏ authentication, ᚱᛠᛚ-ᚹᚩᚱᛚᛞ authorization, domain-control proof, ᚩᚱ external affiliation.rune-domain-network-policy.json futhorc-policy-test-results.json ᚾᛖᛏᚹᚩᚱᚳ ᛗᚪᛈ