Constraint Lab v2
Same as the Lab, but the browser posts the predicate strings
(A1 = B1, …) instead of clue indices. The BE validates each against an
allowlist of known clue predicates — raw SQL is still rejected.
Clues
Combinations remaining
…
Request & response
Column legend — each column A1…E5 is one property; its value is
the house sequence (1–5) that property occupies.
A Nationality
A1 Englishman · A2 Spaniard · A3 Ukrainian · A4 Norwegian · A5 Japanese
B Color
B1 Red · B2 Green · B3 Ivory · B4 Yellow · B5 Blue
C Drink
C1 Coffee · C2 Tea · C3 Milk · C4 Orange juice · C5 Water
D Smoke
D1 Old Gold · D2 Kools · D3 Chesterfields · D4 Lucky Strike · D5 Parliaments
E Pet
E1 Dog · E2 Snails · E3 Fox · E4 Horse · E5 Zebra
The browser posts the predicate strings to the FE proxy; the FE forwards them to
the secured BE, which allowlists each predicate and re-composes the SQL. The BE
works in A1…E5 house numbers — labels are derived from the legend.
Request — predicates sent to the BE
Response — JSON (BE → FE proxy → browser)