Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.
T27 · Object IDs and errors reveal no private existence
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software |
| Layer / kind | API · security |
| Priority | P0 |
| Gates | A03, A06, A09 |
| Build step | 03 (GGA order; the 1.3 step is history) |
| Decisions | Q08 |
Disposition under GGA
| Field | Value |
|---|---|
| Disposition | Retained |
| GGA basis | Blueprint pp. 15, 17 (GGA-Requirement-Register) |
| Replaced or carried by | GS17-staged |
| Still open | none |
| What changes | 404 where existence must stay private; denials do not reveal private objects. |
The 1.3 text below is kept verbatim as history. Where the disposition is Reframed, Superseded or Parked it is not the GGA oracle; use the replacing scenario. A Parked scenario has no GGA feedback and stays a Proposed carry-forward. The status stays Not executed. Register: Scenario-Dispositions.
Given
B knows a valid C private ID and a non-existent ID; attacker submits forged tenant/actor IDs.
When
Probe read, edit, export if present, search/count, action, audit and all enabled API variants.
Then / oracle
Server derives company and actor. Unauthorised existing versus non-existent private objects have the agreed indistinguishable denial contract; no private metadata, canary, IDs or validation hints escape. No mutation occurs.
Evidence required
Status/body/header comparison; side-effect diff; enabled-route coverage inventory.
Decision dependency (verbatim)
Q08: define safe denial shape; exports not included are recorded Unavailable, not Passed.
Source: TDD rev 1.3 (PDF); machine-readable in 10-Sources/tdd-bundle/. Back to Scenario-Index · Traceability-Matrix · integration dependencies in Dependency-and-Regression-Table.