{
  "schemaVersion": 1,
  "type": "principle",
  "id": "postels-law",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "limited",
    "modes": [
      "application-fixture"
    ],
    "summary": "The local example accepted only documented ASCII-space normalization for a six-digit reference, rejected invalid or ambiguous dates, preserved exact-value spaces and rendered markup-like input as text.",
    "reportUrl": "/design-evaluations/principle-postels-law.json",
    "identity": {
      "target": "Original IonBin synthetic interface example; no external product or human-participant study.",
      "version": "2026-10-19 local fixture",
      "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only."
    },
    "environment": [
      "155.0.8059.82 Chromium; fresh context with all network requests blocked.",
      "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports."
    ],
    "tests": [
      {
        "name": "Inert text",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "Markup-like synthetic input stayed literal text; no image element or handler was created."
      },
      {
        "name": "Accept ASCII spaces in a reference",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "\"12 34 56\" was accepted after ASCII-space normalization by the six-ASCII-digit contract."
      },
      {
        "name": "Reject a short reference",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "\"12345\" was rejected by the six-ASCII-digit contract."
      },
      {
        "name": "Reject a long reference",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "\"1234567\" was rejected by the six-ASCII-digit contract."
      },
      {
        "name": "Reject full-width digits",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "\"１２３４５６\" was rejected by the six-ASCII-digit contract."
      },
      {
        "name": "Reject a tab in the reference",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "\"12\\t3456\" was rejected by the six-ASCII-digit contract."
      },
      {
        "name": "Reject markup as a reference",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "\"<script>\" was rejected by the six-ASCII-digit contract."
      },
      {
        "name": "Accept an ISO-format date",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "2027-03-04 was accepted."
      },
      {
        "name": "Reject an ambiguous date",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "03/04/2027 was rejected as ambiguous or invalid."
      },
      {
        "name": "Reject an impossible date",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "2027-02-30 was rejected as ambiguous or invalid."
      },
      {
        "name": "Exact value",
        "mode": "application-fixture",
        "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.",
        "result": "pass",
        "observation": "The exact-value example retained leading/trailing spaces; reference normalization was not reused."
      }
    ],
    "security": {
      "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.",
      "findings": [
        {
          "level": "caution",
          "basis": "advice",
          "title": "Normalization is not an injection defense",
          "detail": "These synthetic checks do not test a backend. Real systems need server validation, context-appropriate encoding, parameterized access and independent authorization."
        }
      ],
      "limits": [
        "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow."
      ]
    },
    "practicalCaveats": [
      "Define normalization field by field. Do not trim passwords, signed values or identifiers whose exact bytes carry meaning."
    ],
    "limits": [
      "This checks an authored application example, not the truth, effect size or generality of the named principle.",
      "No users, assistive-technology participants, physical devices or production task outcomes were evaluated."
    ],
    "sources": [
      {
        "label": "RFC 1122, section 1.2.2: Robustness Principle",
        "url": "https://www.rfc-editor.org/rfc/rfc1122.html#section-1.2.2",
        "scope": "Historical protocol context."
      },
      {
        "label": "RFC 9413: Maintaining Robust Protocols",
        "url": "https://www.rfc-editor.org/rfc/rfc9413.html",
        "scope": "IAB qualifications, active maintenance and security concerns."
      },
      {
        "label": "OWASP: Input Validation Cheat Sheet",
        "url": "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html",
        "scope": "Validation boundaries and related controls; guidance, not a security evaluation of a product."
      }
    ]
  }
}