{
  "schemaVersion": 1,
  "wpId": 6031,
  "generatedAt": "2026-08-31T10:50:00+09:00",
  "evidenceClass": "deterministic local synthetic DApp permission boundary fixture",
  "localSyntheticEvidence": true,
  "readOnlyPublicArtifact": true,
  "publicParticipantData": false,
  "walletOpened": false,
  "accountConnectedByGenerator": false,
  "signatureRequested": false,
  "privateKeyPresentInArtifact": false,
  "seedPhrasePresent": false,
  "remoteRpcRequestSent": false,
  "transactionBroadcastToPublicNetwork": false,
  "assetMoved": false,
  "environment": {
    "framework": "Foundry",
    "chainId": 31337,
    "evmVersion": "prague",
    "solcVersion": "0.8.36",
    "fixtureDirectory": "examples/dapp-permission-boundaries",
    "publicTestAuthority": "0xe05fcC23807536bEe418f142D19fa0d21BB0cfF7",
    "publicTestRelayer": "0x0376AAc07Ad725E01357B1725B5ceC61aE10473c",
    "spender": "0x000000000000000000000000000000000000cafE",
    "sessionKey": "0x000000000000000000000000000000000000bEEF",
    "module": "0x000000000000000000000000000000000000D00D",
    "tokenAndDelegateAddresses": "deployed into each isolated local test"
  },
  "layerMatrix": [
    {
      "layer": "site-account-permission",
      "storedAt": "wallet/browser origin permission",
      "readOnlyCheck": "wallet connected-sites UI or supported permission API",
      "revokeAction": "disconnect or remove the origin permission",
      "transactionRequired": false,
      "changedBySiteDisconnect": true
    },
    {
      "layer": "siwe-web-session",
      "storedAt": "service session store and browser cookie or token",
      "readOnlyCheck": "authenticated endpoint or session-management UI",
      "revokeAction": "logout, server invalidation, or expiry",
      "transactionRequired": false,
      "changedBySiteDisconnect": "implementation-dependent"
    },
    {
      "layer": "erc20-allowance",
      "storedAt": "token contract owner/spender allowance mapping",
      "readOnlyCheck": "allowance(owner, spender)",
      "revokeAction": "approve the intended spender for amount zero or follow token-specific official guidance",
      "transactionRequired": true,
      "changedBySiteDisconnect": false
    },
    {
      "layer": "permit-permit2",
      "storedAt": "off-chain signature until use; contract allowance, nonce, and expiry after or around use",
      "readOnlyCheck": "nonce, expiration, amount, spender, and token-to-Permit2 allowance",
      "revokeAction": "implementation-specific allowance update, nonce invalidation, or expiry",
      "transactionRequired": "method-dependent",
      "changedBySiteDisconnect": false
    },
    {
      "layer": "session-key-module",
      "storedAt": "smart-account, module, validator, or policy contract state",
      "readOnlyCheck": "implementation-specific getter, module list, and configuration event",
      "revokeAction": "disable, remove, rotate, or expire under the account implementation",
      "transactionRequired": "usually true",
      "changedBySiteDisconnect": false
    },
    {
      "layer": "eip7702-delegation",
      "storedAt": "authority EOA code indicator; related state can remain in EOA storage",
      "readOnlyCheck": "eth_getCode, delegate address, authority nonce, and relevant storage",
      "revokeAction": "valid authorization targeting the zero address in a type 0x04 transaction",
      "transactionRequired": true,
      "changedBySiteDisconnect": false
    }
  ],
  "localTimeline": [
    {
      "phase": "configured",
      "siteConnected": true,
      "allowance": "250",
      "sessionKey": "0x000000000000000000000000000000000000bEEF",
      "moduleEnabled": true,
      "delegation": "delegate implementation A"
    },
    {
      "phase": "after-disconnect",
      "siteConnected": false,
      "allowance": "250",
      "sessionKey": "0x000000000000000000000000000000000000bEEF",
      "moduleEnabled": true,
      "delegation": "delegate implementation A"
    },
    {
      "phase": "after-allowance-revoke",
      "siteConnected": false,
      "allowance": "0",
      "sessionKey": "0x000000000000000000000000000000000000bEEF",
      "moduleEnabled": true,
      "delegation": "delegate implementation A"
    },
    {
      "phase": "after-session-module-disable",
      "siteConnected": false,
      "allowance": "0",
      "sessionKey": "0x0000000000000000000000000000000000000000",
      "moduleEnabled": false,
      "delegation": "delegate implementation A"
    },
    {
      "phase": "after-delegation-clear",
      "siteConnected": false,
      "allowance": "0",
      "sessionKey": "0x0000000000000000000000000000000000000000",
      "moduleEnabled": false,
      "delegation": null
    }
  ],
  "foundryAssertions": [
    "disconnect changes only the off-chain siteConnected boolean",
    "allowance remains 250 immediately after disconnect",
    "session key and module flag remain enabled immediately after disconnect",
    "authority code remains the 0xef0100 || delegate indicator immediately after disconnect",
    "allowance revoke does not disable the session key, module, or delegation",
    "session/module disable does not clear delegation",
    "delegation clear does not revoke an independently configured token allowance"
  ],
  "postActionVerification": {
    "walletPermission": [
      "reload connected-sites state for the same wallet instance and origin"
    ],
    "webSession": [
      "repeat an authenticated request or inspect the official session-management UI"
    ],
    "allowance": [
      "save receipt and Approval event",
      "read allowance(owner, spender) at a confirmed block"
    ],
    "sessionKeyModule": [
      "save receipt and configuration event",
      "repeat the implementation-specific getter or module pagination"
    ],
    "delegation": [
      "save the type 0x04 carrier receipt",
      "repeat eth_getCode for the authority at a confirmed block"
    ],
    "remainingLayers": [
      "re-read every other storage location instead of assuming cascade revocation"
    ]
  },
  "conclusion": "A wallet/site disconnect is one permission layer. Read, explicitly revoke, and re-read each independent storage location."
}