The 44 controls / TS02
TS02 · HTTP and availability
Redirects are intentional, direct and loop-free.
Protocol wording · 0.1.0-draft.28 · Documentation view; no website assessment.
Control rule version : 0.1.0-draft.28
Reading guide: start with applicability and required evidence, then read expectations together with their limitations. Understand C, NC, NT and NA outcomes · Prepare a dossier
Expectations and evidence
- Required inputs (protocol identifiers)
- http, intent
- When it applies
- Variants and legacy URLs with a declared expected behavior.
- How to check
- Test HTTP/HTTPS, host, trailing-slash and legacy URL variants, including the redirect count.
- Expectation
- Each tested variant follows the approved destination and hop count without a loop; the owner confirms intent.
- Evidence to retain
- One final destination, documented chain and no loop.
- Non-applicability
- No redirects or expected variants, supported by an inventory.
- Limitations
- A valid redirect does not prove the semantic relevance of its destination. The executable reference covers bounded server-side HTTP trajectories; other mechanisms remain unestablished, without exempting the control.
- Outcome clarification
- C requires all expectations across the declared scope. NC requires evidenced contradiction; otherwise NT. NA requires evidence of non-applicability.
- Reference scope
- Technical reference; the TSEP acceptance rule remains an editorial proposal.
Atomic rules
TS02-A01 — Previously approved redirect plan
- Required inputs (protocol identifiers)
- intent
- When it applies
- Variants and legacy URLs with a declared expected behavior.
- How to check
- Declare source, final destination, allowed redirect and terminal statuses, minimum/maximum redirect count and context. Check the supplied owner review, reasoned, dated between declaration and capture and digest-bound to plan/context.
- Expectation
- The owner explicitly approves the applicable plan before capture. Explicit rejection bound to the same plan is fail; missing or unattributable review remains inconclusive.
- Evidence to retain
- Plan, context, declared owner identity and role, date, decision, reason, assistance and review provenance; exact digest of examined criteria.
- Assumptions
- The owner supplies criteria before capture; a laboratory author may supply an explicitly synthetic review. A digest binds records without authenticating a person.
- Inconclusive outcome
- Missing, invalid or late plan; absent, unbound or mistimed review; unsupported mechanism. The tool supplies no human approval.
- Non-applicability
- No atomic exemption. Whole-control non-applicability needs a separate positive inventory; a missing capture does not establish it.
- Limitations
- A valid redirect does not prove the semantic relevance of its destination. The executable reference covers bounded server-side HTTP trajectories; other mechanisms remain unestablished, without exempting the control.
TS02-A02 — HTTP trajectory matches the plan
- Required inputs (protocol identifiers)
- http, intent
- When it applies
- Variants and legacy URLs with a declared expected behavior.
- How to check
- Read each attributable GET exchange in order, resolve Location, retain codes and URLs, count redirects and check terminal destination/status. Compare with the pre-capture plan without reconstructing missing responses.
- Expectation
- The complete chain matches declared destination, statuses and bounds, without a loop. A forbidden type, exceeded maximum, redirect without Location or return to a visited URL is fail as soon as a complete prefix establishes it. Wrong terminal destination/status or insufficient count is fail after an attributable terminal response.
- Evidence to retain
- Original HTTP requests/responses per hop, URL, completeness, client and context; prior plan. Proven contradictions survive later gaps and absent A01 approval.
- Assumptions
- The owner supplies criteria before capture; a laboratory author may supply an explicitly synthetic review. A digest binds records without authenticating a person.
- Inconclusive outcome
- Unfinished chain without contradiction, collection limit, ambiguous Location, unsupported fragment/syntax, conditional/authenticated request, incomplete or unattributable capture. A collection limit does not prove a loop; exceeding an intended maximum is distinct.
- Non-applicability
- No atomic exemption. Whole-control non-applicability needs a separate positive inventory; a missing capture does not establish it.
- Limitations
- A valid redirect does not prove the semantic relevance of its destination. The executable reference covers bounded server-side HTTP trajectories; other mechanisms remain unestablished, without exempting the control.