security: reject timeout-policy subclasses on the current policy stack

[seonghobae]

Purpose

Reconstruct the unique exact EgressTimeoutPolicy type boundary from stale/diverged Draft #158 on the current policy stack without transferring historical merge evidence.

This PR is intentionally stacked on #204 because both lanes modify src/egressweave/policy.py. Serializing them avoids parallel writers and lets the timeout boundary inherit the exact HTTP-method integrity tree rather than racing it.

Exact stack identity

• protected main ancestor: 7faf7a3b8a47980113982914000e724ab6a6cda5;
• predecessor security: reconstruct exact HTTP method strings on protected main #204 exact head/base: ab51ef1725bd20c898a3e3df82994b576e675e7b;
• RED-only head: a460ca5927c19ae593d70e508e7829dd772252ec;
• GREEN implementation head: 0b72ac4bd946f7a4aa4d6668f701859e03e45cdb;
• exact final head: b0e9b43d4b3c8701e8b6af7a93f1e82a0e9030c7;
• stale historical security: reconstruct exact request-timeout policy boundary on integrated main #158 head: 496d81709ad63be6b921510c447e7d2393daed96.

Test-first evidence

The RED-only head added two regressions requiring both public policy constructors to reject an EgressTimeoutPolicy subclass before a later transport can dynamically dispatch an overridden as_httpcore_timeout() implementation.

Hosted CI run 31783324371 failed on every Python 3.10–3.14 lane exactly because both new tests reported DID NOT RAISE TypeError; the Python 3.14 lane otherwise had 1,032 passing tests.

The minimal GREEN change replaces the subclass-accepting isinstance(...) check with an exact-type boundary. Follow-up commits document the pre-1.0 compatibility narrowing and add a documentation contract requiring the threat and migration path to remain explicit.

Implemented boundary

• require the exact built-in EgressTimeoutPolicy dataclass type during trusted EgressPolicy construction;
• reject subclass-controlled timeout exporters before transport dispatch;
• preserve exact instances, defaults, normalized authority and method policy, finite resource limits, deterministic evidence, and all public builder signatures;
• document that applications using subclasses must migrate to exact declarative instances;
• make no claim to sandbox arbitrary trusted Python code executing in the host process.

Exact-head verification

Exact head: b0e9b43d4b3c8701e8b6af7a93f1e82a0e9030c7

• CI succeeded on Python 3.10, 3.11, 3.12, 3.13, and 3.14.
• Python 3.14.6 lane: 1,035 tests passed.
• Production coverage: 1,762 / 1,762 statements and 590 / 590 branches (100%).
• Ruff, compileall, hourly product guard self-test, wheel/sdist build, archive verification, and installed-wheel smoke test succeeded.
• Full SAST and Security Scan workflows did not run for this stacked non-default-base PR; they remain mandatory after security: reconstruct exact HTTP method strings on protected main #204 integration and retargeting to protected main.

Merge contract

Keep Draft behind #204. Historical #158 checks, reviews, base identity, and mergeability are not acceptance evidence for this branch. Do not merge until:

1. security: reconstruct exact HTTP method strings on protected main #204 is integrated on an accepted protected tree;
2. this PR is retargeted/reconstructed on that exact tree without transferring historical evidence;
3. full current-head CI, SAST, substantive Dependency Review, Strix, and other required checks pass;
4. all current-head review findings are addressed and threads resolved;
5. independent approvals satisfy protected-branch policy; and
6. exact head/base/ancestry are revalidated immediately before merge.

Progresses #113. Supersedes #158 only after dependent #182 is safely retargeted to this replacement and #158 is closed as historical predecessor.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5e707795-3242-4658-ab1f-3342836b7e19

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact head b0e9b43d4b3c8701e8b6af7a93f1e82a0e9030c7, including the hosted RED failure on a460ca5927c19ae593d70e508e7829dd772252ec, the minimal exact-type GREEN change, migration documentation, and current 100% statement/branch coverage.

[seonghobae]

@opencode-agent

Please perform a fresh exact-head semantic review of b0e9b43d4b3c8701e8b6af7a93f1e82a0e9030c7. Validate the RED→GREEN lineage, exact-type threat model, compatibility/migration documentation, and the stacked-base merge contract. Submit a formal current-head verdict; do not treat the successful CI wrapper as a substitute for review.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 6 minutes and 1 seconds before sending another message.

[seonghobae]

@cwl-noema-review

Please independently review exact head b0e9b43d4b3c8701e8b6af7a93f1e82a0e9030c7 after a qualifying current-head OpenCode verdict. Confirm the exact-type restriction is proportionate, documented, and does not regress the public exact-instance policy path.

[seonghobae]

CO dependency request: model response lifetime, not a phase-cap bypass

Read-only baseline: protected main bd0339bf43cf5041e861bac86a84cb6e7e32637e.
This request does not claim ownership of #220 or change its reviewed exact-type
restriction. #210's extension snapshot and #235's hourly gateway migration are
also distinct, preserved deltas.

CO's administrator policy is now durable and revision-checked locally, but its
runtime activation remains closed. The required owner contract is missing from
the current documented finite connect/read/write/pool policy:

• Explicit trusted response-wait policy supports no model elapsed-time limit by
  default. This must not let arbitrary request extensions disable resource caps.
• Optional administrator total duration is distinct from read inactivity and
  covers the complete response stream, not only header acquisition. Chunk
  arrival cannot restart a configured total deadline.
• Preserve DNS/connect/pool capacity, exact authority, address revalidation,
  TLS identity, request/response byte and metadata limits. Document precisely
  which response-wait phase differs for this explicit contract.
• Expose distinct administrator expiry, caller cancellation and upstream
  termination outcomes without private exception or credential disclosure.
• Runtime/security ownership remains EgressWeave, with a Rust implementation
  and immutable protected release before CO consumes it. No CO timer or copied
  transport is proposed. CO retains model identity, settings/history and auth.

Required RED cases: a permitted slow response survives the legacy read cap when
unbounded; configured total expiry closes a stream despite periodic chunks;
caller cancellation remains cancellation; upstream termination remains upstream;
unknown/forged policy cannot widen authority; both streaming and non-streaming
paths preserve the existing security rejections and release conformance.

The PRD/TRD currently require finite phase waits and Python runtime; the new
contract therefore needs an explicitly Proposed architecture update, not a
claim that current main already satisfies it. Current GitHub release listing
was empty; that is not a claim about every package registry.

Please identify any existing implementation lane for this contract before a
duplicate writer is started. Visible local worktrees currently concern Actions
concurrency/draft admission/#235 and have been left untouched. No approval,
merge, branch takeover or runtime completion is inferred from this request.