# Phase 2.3 Failure Matrix — Grok G-5

**Commit:** `d6f087c21efb593ee7db58f816be98a2d087b3e3`  
**Date:** 2026-08-18

## Credential / IDOR

| Attack | Result | Grade |
|--------|--------|-------|
| B uses A’s giveaway id | 403 owner check | OK |
| Client supplies foreign organizerId | ignored; session owner used | OK |
| Decrypt B credential as A | no path | OK |
| Null organizerId authorize | Forbidden | OK |

## Resolver / Fallback

| Case | Behaviour | Grade |
|------|-----------|-------|
| Public + SERVICE configured | SERVICE | OK |
| Private + SERVICE fail PrivateResource | USER fallback | OK |
| RateLimit on SERVICE | no fallback | OK |
| Network/Timeout/Validation | no fallback | OK |
| SERVICE→USER→SERVICE loop | no | OK |
| PermissionError fallback | allowed by policy | WARN |

## Refresh

| Case | Behaviour | Grade |
|------|-----------|-------|
| 20 concurrent expired | 1 HTTP refresh (test) | OK |
| 50–100 concurrent | intended single-flight; finally-delete race | WARN |
| A and B concurrent | separate keys | OK |
| null expiresAt | no refresh | WARN |
| identity mismatch on refresh | not checked | WARN |
| stale write overwrite | no CAS | WARN |
| invalid refresh / 429 / 500 | ReauthenticationRequired | OK |
| token in error/API | not by design | OK |

## Import / Capabilities

| Case | Behaviour | Grade |
|------|-----------|-------|
| Provider before ownership | no | OK |
| Idempotent completed import | cache hit | OK |
| Partial SERVICE + USER restart | must full restart | WARN |
| Stale UI capabilities | re-resolve on import | OK |
| Token in participants response | summary only | OK |

## VK contract

| Item | Verdict |
|------|---------|
| Refresh endpoint | VERIFIED / PARTIAL |
| device_id | UNVERIFIED |
| Scope separator | UNVERIFIED |
| Fallback policy | VERIFIED (product) |
| Definitely WRONG | None |

---

## Summary grades

| Area | Grade |
|------|-------|
| Credential isolation | **PASS** |
| Resolver | **PASS WITH WARNINGS** |
| Refresh | **PASS WITH WARNINGS** |
| Refresh concurrency | **PASS WITH WARNINGS** |
| Fallback | **PASS WITH WARNINGS** |
| Capabilities | **PASS WITH WARNINGS** |
| Token confidentiality | **PASS** |
| Participant import | **PASS WITH WARNINGS** |
| VK contract | **PASS WITH WARNINGS** |
| **Overall** | **PASS WITH FIXES** |

## Smoke-test readiness

**YES** — no CRITICAL blockers for controlled real VK smoke.  
Watch: single-flight under load, null expiry, fallback only private/permission, zero token leakage in responses/logs.