{
  "schema": 1,
  "sqlstate": "28P01",
  "condition_name": "invalid_password",
  "sources": [
    {
      "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
      "id": "src.errcodes.18.6",
      "location": "lines 271-278",
      "path": "src/backend/utils/errcodes.txt",
      "sha256": "6e8de346643ba84aa3c9c6a73360acfc7b2dfb89162c06c08ce9bf5bcd5bbcba",
      "tag": "REL_18_6",
      "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/utils/errcodes.txt"
    },
    {
      "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
      "id": "src.auth.18.6",
      "location": "lines 270-332",
      "path": "src/backend/libpq/auth.c",
      "sha256": "94252cb1e2c49b0ddb15f6596d0abf8056c84493de07cc81439da4c5b07018f1",
      "tag": "REL_18_6",
      "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/libpq/auth.c#L270-L332"
    },
    {
      "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
      "id": "doc.client-auth.18",
      "location": "pg_hba.conf and password authentication",
      "path": "doc/src/sgml/client-auth.sgml",
      "sha256": "3fb31769e212f5ff97ffca769fe4c72c5963b90d0165bd6147f089e310167326",
      "tag": "PG18-docs",
      "url": "https://www.postgresql.org/docs/18/auth-pg-hba-conf.html"
    },
    {
      "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
      "id": "doc.protocol.18",
      "location": "ErrorResponse fields",
      "path": "doc/src/sgml/protocol.sgml",
      "sha256": "745339e07ebbc2bb67d98b258e25772ada644ef26011e3cd6b3fcbb435235f89",
      "tag": "PG18-docs",
      "url": "https://www.postgresql.org/docs/18/protocol-error-fields.html"
    },
    {
      "id": "manifest.28P01",
      "kind": "local_artifact",
      "location": "snapshots and definition_blobs entries for the 28P01 definition",
      "sha256": "1727a275f336988ff96b4f9990a4ca253080f73fc5d316e7def165c8cf3708a8"
    },
    {
      "id": "case-manifest.28P01",
      "kind": "local_artifact",
      "location": "wrong_password_authentication",
      "sha256": "f6b0cfcd0752036c7d3368586fb86740b5ef9364da20800554be02e89d44149f"
    },
    {
      "id": "snippet-registry.28P01.final",
      "kind": "local_artifact",
      "location": "wrong_password_authentication ordered SQL",
      "sha256": "9b2ca3d14cb093415043cb1cb8291eee2020df052f8067c4952ce2cd4597d395"
    }
  ],
  "claims": [
    {
      "id": "identity.class-and-condition",
      "limits": "Directory identity does not identify the selected authentication method or the matched HBA rule.",
      "method": "Read the Class 28 section and 28P01 row in the frozen errcodes.txt snapshot.",
      "sources": [
        "src.errcodes.18.6"
      ],
      "statement": "28P01 is the invalid_password condition in Class 28 invalid_authorization_specification."
    },
    {
      "id": "mechanism.auth-failure",
      "limits": "Other authentication methods and HBA configuration errors use separate branches and can report different SQLSTATEs or messages.",
      "method": "Trace auth_failed's password/MD5/SCRAM error selection and detail construction and compare the official HBA and password-authentication rules.",
      "sources": [
        "src.auth.18.6",
        "doc.client-auth.18"
      ],
      "statement": "The password authentication failure path in auth.c selects ERRCODE_INVALID_PASSWORD, reports password authentication failed for user \"%s\" at FATAL, and may add the matched pg_hba.conf line to log detail."
    },
    {
      "id": "runtime.driver-collector-boundary",
      "limits": "Driver exposure can vary by client and startup failure; the collector record is the server-side SQLSTATE evidence here.",
      "method": "Compare driver diagnostics and collector SQL state code, severity, message, HBA detail, and source location in both final summaries and raw records.",
      "sources": [
        "doc.protocol.18",
        "runtime.28P01-registry-final-20260909.latest",
        "runtime.28P01-registry-final-20260909.pg10"
      ],
      "statement": "For the rejected startup connection, psycopg exposed startup text with sqlstate null while the PostgreSQL collector recorded FATAL SQLSTATE 28P01 and the password-failure message on both targets."
    },
    {
      "id": "runtime.authentication-repair",
      "limits": "The run proves a password failure under the controlled md5 rule; it does not cover certificate, GSSAPI, PAM, LDAP, peer, or HBA syntax failures.",
      "method": "Use an owner connection to set the disposable role password, reload the temporary HBA rule, test wrong and known passwords through new connections, restore and reload the original rule, and assert a fresh owner probe.",
      "sources": [
        "case-manifest.28P01",
        "snippet-registry.28P01.final",
        "runtime.28P01-registry-final-20260909.latest",
        "runtime.28P01-registry-final-20260909.pg10"
      ],
      "statement": "After enabling the temporary md5 rule, the known password opened a new role connection and returned SELECT 1 = 1; after exact HBA restoration, a fresh management connection also returned 1 on both targets."
    },
    {
      "id": "versions.catalogue-boundary",
      "limits": "The first scanned release is a lower bound, not an asserted introduction version.",
      "method": "Read the manifest snapshots and definition references for the code.",
      "sources": [
        "manifest.28P01"
      ],
      "statement": "The locked catalogue records 28P01 in every listed formal snapshot from 9.0.23 through 18.6 and in 19beta3; pre-9.0 history is not scanned."
    }
  ],
  "messages": [
    {
      "detail_template": "Connection matched file \"%s\" line %d: \"%s\"",
      "detail_type": "collector log detail assembled at runtime",
      "id": "message.password-failure",
      "limits": "The fixed PG18.6 source passes logdetail through errdetail_log; a client ErrorResponse need not expose it. PG10 collector output uses a release-specific pg_hba.conf wording and may include an additional password-mismatch line.",
      "primary_template": "password authentication failed for user \"%s\"",
      "severity_source": "explicit FATAL",
      "sources": [
        "src.auth.18.6"
      ],
      "sqlstate": "28P01"
    }
  ],
  "usage_evidence": [
    {
      "evidence_ids": [
        "identity.class-and-condition",
        "src.errcodes.18.6"
      ],
      "scope": "SQLSTATE directory identity",
      "status": "definition_only"
    },
    {
      "evidence_ids": [
        "mechanism.auth-failure",
        "message.password-failure",
        "src.auth.18.6",
        "doc.client-auth.18"
      ],
      "scope": "Password authentication failure source path and templates",
      "status": "source_path_confirmed"
    },
    {
      "evidence_ids": [
        "runtime.driver-collector-boundary",
        "runtime.authentication-repair",
        "snippet-registry.28P01.final",
        "runtime.28P01-registry-final-20260909.latest",
        "runtime.28P01-registry-final-20260909.pg10"
      ],
      "scope": "Startup driver/collector SQLSTATE boundary and HBA/password repair",
      "status": "observed_runtime"
    },
    {
      "evidence_ids": [
        "versions.catalogue-boundary",
        "manifest.28P01"
      ],
      "scope": "Version presence",
      "status": "definition_only"
    }
  ],
  "runtime": [
    {
      "cases": [
        "wrong_password_authentication"
      ],
      "id": "runtime.28P01-registry-final-20260909.latest",
      "observed": {
        "collector_message": "password authentication failed for user <generated-role>",
        "collector_severity": "FATAL",
        "collector_source": "auth.c:320",
        "collector_sqlstate": "28P01",
        "driver_sqlstate": null,
        "driver_text": "FATAL: password authentication failed for user <generated-role>",
        "hba_reload": {
          "enabled": true,
          "restored": true
        },
        "known_password_probe": 1,
        "restored_management_probe": 1,
        "transaction": "none opened for rejected startup",
        "collector_detail": "Connection matched file \"<pg_hba.conf path>\" line 1: \"host all all 0.0.0.0/0 md5\""
      },
      "raw_sha256": "97bcf605a806511aff3f0f4eeaa3615c159bf54e7d6f35b7bfbb45940d3d86d2",
      "run_id": "28P01-registry-final-20260909",
      "server_version": "18.6 (Homebrew)",
      "server_version_num": 180006,
      "snippet_registry": {
        "sha256": "9b2ca3d14cb093415043cb1cb8291eee2020df052f8067c4952ce2cd4597d395"
      },
      "status": "passed",
      "summary_sha256": "0f58bf277fdd33be8d39ed8f05dc6de5555b8aa89db344b1a4cdfb3eb425bcbf",
      "target": "latest"
    },
    {
      "cases": [
        "wrong_password_authentication"
      ],
      "id": "runtime.28P01-registry-final-20260909.pg10",
      "image": "postgres@sha256:b2baf8998630663d21370da06387c950e587071bdd307ee34e661cdcc7442bcc",
      "observed": {
        "collector_message": "password authentication failed for user <generated-role>",
        "collector_severity": "FATAL",
        "collector_source": "auth.c:329",
        "collector_sqlstate": "28P01",
        "driver_sqlstate": null,
        "driver_text": "FATAL: password authentication failed for user <generated-role>",
        "hba_reload": {
          "enabled": true,
          "restored": true
        },
        "known_password_probe": 1,
        "restored_management_probe": 1,
        "transaction": "none opened for rejected startup",
        "collector_detail": "Password does not match for user <generated-role>.\\nConnection matched pg_hba.conf line 1: \"host all all 0.0.0.0/0 md5\""
      },
      "raw_sha256": "6d67921dfd66d347593d1b5c348cb60402eee0aa8dfc2cb9c2dbba7872caefb8",
      "run_id": "28P01-registry-final-20260909",
      "server_version": "10.21 (Debian 10.21-1.pgdg90+1)",
      "server_version_num": 100021,
      "snippet_registry": {
        "sha256": "9b2ca3d14cb093415043cb1cb8291eee2020df052f8067c4952ce2cd4597d395"
      },
      "status": "passed",
      "summary_sha256": "c8b82b3c42519fe121d27a815f224a25a12b8d14fdffd111dedd23f7a8a0a334",
      "target": "pg10"
    }
  ]
}