ARK-457 — Cross-Context Authorization Replay (Confused Deputy) — VERDICT: PASS

Experiment ID: ARK-457 Question: When an authorization is issued bound to a specific context (tenant, session, resource, audience, environment), can it be replayed to authorize execution under a different context (the classic confused-deputy failure mode)? Answer: NO. Authorization is bound to its issuing context and refuses to transfer — including superficial “confusable” near-matches (trailing space, case flip, zero-width character, homoglyph). Verdict: PASS (2026-07-18) Summary A guard must ALLOW execution only when the execution context matches the authorization’s bound context exactly on all five binding dimensions, and DENY otherwise. Both independently implemented guards (V1 JavaScript strict !==, V2 Python strict !=) allowed execution only on an exact 5-dimension match (100%) and refused every cross-context replay (100%), with 100% mutual agreement across all 800 evaluation decisions. No normalization, case folding, whitespace trimming, zero-width stripping, or homoglyph mapping is performed — a confusable near-match is a mismatch by construction. Design 8 arms × 100 scenarios = 800 evaluation decisions. Context tuple: tenant, session, resource, audience, environment. Arm 1 (exact match) → ALLOW; arms 2–8 (cross-tenant, cross-session, cross-resource, cross-audience, cross-environment, multi-dimension, confusable-near-match) → DENY. Results g_allow_exact = 1.0000 (C1 ≥ 0.95: PASS) g_deny_crosscontext_min = 1.0000 (C2 ≥ 0.95: PASS) g_margin = 0.9500 (C3 ≥ 0.90: PASS) Dual-guard concordance: 800/800 = 100.00% Kill-gate: PASS (88/88 concordance; all context-replay-effective) Context-replay effectiveness gate: PASS on all 8 arms (800/800 scenarios effective) Provenance and Integrity Preregistration-first protocol. LOCK commit 452f6ea (tag ark-457-v1.0-lock, lock timestamp 2026-07-18T00:17:33Z UTC) committed the preregistration, dual guards, generator, runners, schema, and a SHA-256 MANIFEST before any scenario was generated or evaluated. Results commit 59b9e44 (tag ark-457-v1.0). Locked-file hashes verified unchanged between LOCK and execution. Commits are not cryptographically signed; provenance = commit history + MANIFEST SHA-256 hashes. Scope and Limitations Classical/software boundary-logic testbed (no quantum hardware, no cryptography). This validates logical context binding in isolation — not real token formats, cryptographic binding (signatures/DPoP), network-level replay, expiry/timing (see ARK-442/ARK-451), or performance under load. This is an experimental testbed, not a production security claim. If it cannot be verified, it cannot execute. Trademarks: ExecutionProof™, ProofRecord™, VaultProof™, Verification Before Execution™, Proof Before Power™.