# Equivalence partitions: sample the rule, challenge the edges

This original fictional example validates a numeric configuration field called
`port`. The kit calls the exact exported functions in `validator.py`. It does not
open a socket, parse text, allocate a port or define operating-system binding
policy. The earlier article's integer-port table was illustrative; these are new
executions, not a replay or authentication of a historical run.

## Run the portable kit

Use Python 3.10 or newer with its standard library. No Proof service, package,
credential or network connection is required. From the extracted kit:

```sh
python3 reproduce.py
```

The default `rerun-output/` directory must be absent or empty. To preserve an
earlier run:

```sh
python3 reproduce.py --output-dir another-run
```

The wrapper returns **0 only when all expected passes and failures reproduce**.
It does not accept every implementation or prove equivalence of every class
member. Inspect the raw child stdout/stderr and `reproduction-summary.json` in
the new output directory. The original observed run is retained under `observed/`.

## Incoming domain and valid subset

The direct-call precondition is `type(port) is int`, excluding bool. This admits
negative integers, zero, valid values and integers above 65535. Other types are
outside this exercise's precondition: no type validator, parser or upstream
guarantee is implemented or established here.

The **valid subset** is 1 through 65535 inclusive. Invalid integers stay in the
wider incoming domain and are actually passed to the function. In particular,
0 must be rejected by this newly authored fictional field rule. That rule does
not describe all socket-binding interfaces or network uses of port zero.

The authored classes come from the written requirement:

| Class | Predicate | Exact specified response | Initial representative |
| --- | --- | --- | ---: |
| Below | `port < 1` | `{"accepted": false, "reason": "too_low"}` | -1 |
| Valid | `1 <= port <= 65535` | `{"accepted": true, "port": port}` | 443 |
| Above | `port > 65535` | `{"accepted": false, "reason": "too_high"}` | 65536 |

“Equivalent” here means the same specified response category and rejection reason,
or the same **input-preservation relation** for accepted values. Accepting 1 and
accepting 443 do not return an identical numeric payload. The criterion does not
promise identical execution paths or establish that every member actually behaves
alike in the implementation.

Each initial value is a concrete member of a different requirement-defined class.
That justifies the selection, while leaving an implementation-homogeneity
hypothesis to challenge. The partitions are not inferred from current code.

## Boundary complement and literal oracle

For the inclusive lower endpoint, select just below / at / just above: 0, 1, 2.
For the inclusive upper endpoint, select 65534, 65535, 65536. The complete refined
table in `cases.json` stores literal whole responses:

| Input | Accepted | Preserved port or rejection reason | Selection |
| ---: | --- | --- | --- |
| -1 | false | `too_low` | Below representative |
| 0 | false | `too_low` | Lower outside |
| 1 | true | 1 | Lower endpoint |
| 2 | true | 2 | Lower inside |
| 443 | true | 443 | Valid representative |
| 65534 | true | 65534 | Upper inside |
| 65535 | true | 65535 | Upper endpoint |
| 65536 | false | `too_high` | Above representative and upper outside |

The three representatives and six boundary values overlap at 65536, giving
**eight unique inputs**, not nine. There are still **three authored behavior
classes**; six neighbors are not six new classes. The refined selection keeps
the contract classes and adds endpoint/interior strata to the witness plan.
This is a chosen set around the **two accepted endpoints**, not every neighbor
of every invalid-class endpoint or a standard-wide boundary-coverage denominator.

The independent oracle compares exact response keys, types and literal values.
The acceptance flag must be bool; an accepted payload must be exact int; a
rejection reason must be str. Python's `True == 1` equality cannot silently satisfy
this typed contract. Expected values are not calculated by a copy of the validator.

## Actual observations

The baseline mistakenly rejects `port >= 65535`. It therefore passes all three
initial representatives while rejecting the valid endpoint 65535 as `too_high`.
The six-neighbor gate exposes that failure. The implemented correction changes
the comparison to reject only `port > 65535`.

| Gate | Passed / executed inputs | Child exit |
| --- | ---: | ---: |
| Baseline, three representatives | 3 / 3 | 0 |
| Baseline, six boundary neighbors | 5 / 6 | 1 |
| Baseline, refined eight | 7 / 8 | 1 |
| Corrected, refined eight | 8 / 8 | 0 |
| Seeded accept-all control, refined eight | 5 / 8 | 1 |
| Seeded reject-all control, refined eight | 3 / 8 | 1 |

The accept-all control fails exactly the three selected invalid inputs -1, 0,
65536. The reject-all control fails exactly the five valid inputs 1, 2, 443, 65534,
65535. These controls demonstrate sensitivity to the included invalid and valid
witnesses; no mutation-campaign score or general proof is claimed.

The six gates perform **41 function invocations** using eight distinct inputs.
Repeated executions do not create 41 unique cases. Counts of selected witnesses
from all three classes do not prove all class members are equivalent.

## Evidence and limits

`contract.json` states the authored policy and scope. `origin.json` binds the
retained illustrative source without inventing a historical execution. Source
hashes, Python version, commands, UTC timestamps and exact responses are retained
with the raw observations. `PROVENANCE.json`, `manifest.json` and `SHA256SUMS` bind
the portable kit. A new run writes new observations rather than replacing them.

This is a compact field-helper exercise, not a production/customer finding.
Selected green tests do not prove every Python integer, establish class closure
or certify all representations. There is no text/byte parser, malformed-string
test, type-validation adapter, fixed-width overflow, network binding, scheduler,
container, duration, resource or concurrency execution. Those require their own
interface, policy and evidence. No Proof CLI, model checker or generated witness
was executed by this standard-library kit.