# NFT-SEC-01 — Cache-poisoning safety probability budget

**Task**: AZ-436_nft_sec_01_cache_poisoning
**Name**: P(false-trust) ≤ 1e-6 per flight via per-tile signing + voting (AC-NEW-9 / Mode B Fact #103)
**Description**: Implement NFT-SEC-01 — synthetic flights with crafted poisoned tiles (≤5 % poison ratio); SUT MUST reject or downgrade them via signing-cert mismatch + Service voting + freshness gate; aggregate `false_trust_count_per_flight ≤ 1e-6 × flight_count`.
**Complexity**: 5 points
**Dependencies**: AZ-406, AZ-407
**Component**: Blackbox Tests / Security (epic AZ-262)
**Tracker**: AZ-436
**Epic**: AZ-262 (E-BBT)

## Problem

Cache-poisoning is the highest-impact security risk for the SUT — a single false-trust event yields a silent location drift attacker can use to compromise the mission. AC-NEW-9 / Mode B Fact #103 set a 1e-6 per-flight budget; only large-N synthetic-flight runs can validate this with statistical confidence.

## Outcome

- pytest scenario at `e2e/tests/security/test_nft_sec_01_cache_poisoning.py`. Tier-1 OR Tier-2.
- N synthetic flights (default N=1e4 — i.e. 10000 micro-replays of 60 s each; configurable for shorter CI runs); each flight's tile cache contains a small fraction (≤5 %) of crafted poisoned tiles (signing-cert mismatch, freshness violation, voting-disagreement).
- For each flight: count `false_trust_events` (a frame where SUT emits `satellite_anchored` from a poisoned tile).
- Aggregate: `total_false_trust_events ≤ N × 1e-6` (with statistical margin documented in the evidence).

## Scope

### Included
- Crafted-poisoned-tile generator (signing-cert variation, freshness variation, content variation per Mode B Fact #103).
- N synthetic flights via runner orchestration.
- Aggregate counting + margin statistics.

### Excluded
- Stale-tile rejection on the freshness axis alone — owned by FT-N-05 (AZ-427).

## Acceptance Criteria

**AC-1: N flights complete**
Given the test runs at default N=10000 OR the runner-configured N
Then all N synthetic flights complete (no early-return on partial failures).

**AC-2: poisoned-tile production**
Given the crafted-tile generator
Then the per-flight cache contains poisoned tiles in [1 %, 5 %] of all tiles, with at least one tile per defense layer (signing-cert mismatch, freshness violation, voting disagreement).

**AC-3: false-trust budget**
Given the aggregate over N flights
Then `total_false_trust_events ≤ N × 1e-6` (e.g. ≤0.01 events at N=10000 = the test passes if the count is 0).

**AC-4: parameterization**
Given conftest parameterization
Then the scenario runs per `(fc_adapter, vio_strategy)`. Note: N=10000 × 4 parameterizations is very expensive; the default per-CI run uses N=1000 + a single parameterization, and full N=10000 is gated behind a `release-gate` env flag.

## System Under Test Boundary

End-to-end through public boundaries.

- **Allowed**: tile-cache mount with crafted poisoned tiles, outbound `source_label` capture, FDR signing-rejection events.
- **Forbidden**: monkeypatching the signing-verification logic.

## Constraints

- Probability budget is statistical — at N=1000 the budget is 1e-3 expected events; the test passes only if 0 events are observed (per stricter zero-tolerance default).
- Crafted-tile generator's signing-cert path uses a deliberately-not-trusted CA; freshness path uses age-injected tiles; content path uses a tile whose embedded source-of-truth disagrees with neighboring votes.

## Document Dependencies

- `_docs/02_document/tests/security-tests.md` § NFT-SEC-01
- `_docs/02_document/tests/test-data.md` § Security
