security: bind special-purpose address decisions to reviewed IANA registry

[seonghobae]

Purpose

Reconstruct the unique special-purpose IP registry compatibility delta from stale/diverged Draft #173 directly on exact protected main without transferring historical checks, reviews, approvals, base identity, or mergeability.

Python's ipaddress classification tables evolve with interpreter maintenance releases, while EgressWeave supports a Python version matrix and must keep destination authorization stable. The current IANA IPv4 and IPv6 Special-Purpose Address Space registries remain the authoritative reviewed source for the bounded compatibility overlay.

Exact identity and test-first lineage

• protected/live base: 7faf7a3b8a47980113982914000e724ab6a6cda5;
• RED-only head: 8312a000197eabd7d7d3f6341263c79f031;
• GREEN production head: 26be254deb11be6d5ff1bb10f35e9e70395b91be;
• exact current head: 811ba846757adb44dfc648b9b13761aa1536a110;
• stale predecessor security: reconstruct special-purpose IP policy on current main #173 head: 74211307bf83d8089ca0c935a8a6664ca897ffce.

Hosted RED run 31785513013 failed on Python 3.10–3.14 exactly on the new compatibility contracts. The Python 3.14.6 lane reported 1,032 passing tests and 22 intended failures, demonstrating that the prior implementation depended on interpreter-version is_private / is_global metadata.

The final test/documentation correction accounts for 2001:2::/48 being denied through the reviewed broader 2001::/23 implementation range rather than requiring a redundant source literal.

Implemented boundary

• add a static, code-reviewed compatibility overlay derived from the IANA IPv4/IPv6 Special-Purpose registries;
• apply the most-specific global exceptions before reviewed non-global parent ranges;
• recursively classify IPv4-mapped IPv6 addresses through the underlying IPv4 policy;
• retain current local-host, private-container, authority, DNS pinning/revalidation, TLS, proxy, request/response, credential, and generic-denial boundaries;
• perform no runtime registry download or mutable external lookup;
• document the source registry, deliberate 2002::/16 CPython compatibility decision, update procedure, and local-development non-widening contract.

Fresh primary-source revalidation — 2026-08-29 KST

The live IANA IPv4 and IPv6 Special-Purpose Address Space registries still report Last Updated: 2025-10-09. The current exact-head overlay remains consistent with the reviewed version-sensitive subset: IPv4 192.0.0.0/24 with globally reachable 192.0.0.9/32 and 192.0.0.10/32 exceptions; IPv6 64:ff9b:1::/48, 100:0:0:1::/64, 2001::/23, 3fff::/20, and 5f00::/16 non-global handling; and the current globally reachable exceptions inside 2001::/23. 2002::/16 remains a deliberate conservative EgressWeave/CPython compatibility policy rather than an overclaim that IANA marks it simply Globally Reachable=False.

docs/research/special-purpose-address-classification.md already carries APA 7-style primary-source traceability and an explicit future-update procedure. Because the primary registries have not changed, no source/document blob is churned merely to update a retrieval date.

This repository has no Storybook, Figma, or web design-system surface in the current product boundary; fresh repository searches returned no storybook, figma, or design-system UI evidence, so UI/accessibility design work is not applicable to this security-policy slice.

Exact-current-head verification

Exact head 811ba846757adb44dfc648b9b13761aa1536a110 remains unchanged and live protected main remains 7faf7a3b8a47980113982914000e724ab6a6cda5.

• repository CI 31786475525: terminal success;
• SAST Semgrep 31786475542: terminal success;
• Security Scan 31786475686: wrapper terminal success, but dependency-review job 94723408440 skipped the actual pinned Dependency review step; this is non-passing supply-chain evidence under the fail-closed acceptance contract;
• formal current-head reviews: one author-side COMMENTED review only, not an independent approval;
• current inline review threads: none.

Live protection and central dependencies

Effective organization ruleset 18156473 — CWL Central required workflows is active on the default branch and requires one approving review, stale-review dismissal on push, review-thread resolution, and the central OpenCode, scheduler, Security Scan, Strix, SAST, and Noema workflows. OrganizationAdmin bypass exists but is not merge authority for this lane and must not be used.

The old Strix prerequisite .github#965 is closed unmerged and superseded. The current bounded Strix exact-artifact successor is .github#1009; it is still open and not merge-authoritative. The Dependency Review fail-closed owner remains .github#897; its current source-level repair is open and technically demonstrates the exact HTTP-200/pinned-action path, but its current required Strix provider evidence and independent approval are still non-passing. These central lanes are read-only dependencies from EgressWeave and must not be raced or locally duplicated.

Merge contract

Keep Draft. Do not merge until:

1. the protected-central Dependency Review repair (ContextualWisdomLab/.github#897 or a freshly verified protected successor) integrates and a fresh unchanged-head Security Scan actually executes and succeeds at the immutable-pinned Dependency Review step;
2. the bounded Strix exact-artifact repair (ContextualWisdomLab/.github#1009 or a freshly verified protected successor) integrates and this exact EgressWeave head receives authoritative, internally coherent Strix evidence;
3. all current-head review findings are resolved;
4. a qualifying independent non-author formal approval satisfies live protected-branch policy; and
5. exact head, base, ancestry, checks, reviews, threads, active-writer evidence, and rulesets are revalidated immediately before normal protected merge.

Pending, queued, skipped-required, stale, predecessor-head, synthetic, wrapper-only, author-only, model-only, or provider-unavailable evidence is non-passing. Do not self-approve or use administrator bypass.

Progresses #95. Supersedes #173; historical predecessor evidence is intentionally not transferred.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7bc5c108-02aa-4b4c-a913-5c3f0a086492

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact head 811ba846757adb44dfc648b9b13761aa1536a110. Validate the hosted RED→GREEN lineage, reviewed IANA/CPython overlay ordering, IPv4-mapped recursion, local-development non-widening boundary, source/documentation alignment, and exact-head 1,049-test / 100% statement-and-branch evidence.

[seonghobae]

@opencode-agent

Please perform a fresh exact-head semantic review of 811ba846757adb44dfc648b9b13761aa1536a110. Verify the RED evidence, current registry grounding, most-specific exception ordering, mapped-address behavior, fail-closed local boundary, and documentation truthfulness. Submit a formal current-head verdict; do not infer approval from CI wrappers.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 28 minutes and 13 seconds before sending another message.

[seonghobae]

@cwl-noema-review

After a qualifying exact-head OpenCode verdict, independently review 811ba846757adb44dfc648b9b13761aa1536a110. Confirm the compatibility overlay is deliberately bounded, reproducible, source-grounded, and does not widen local or authority policy.

[seonghobae]

Current-head source review for 811ba846757adb44dfc648b9b13761aa1536a110 found no blocking defect in the five-file special-purpose registry compatibility scope. The implementation applies reviewed most-specific IANA global exceptions before broader non-global compatibility ranges, recursively classifies IPv4-mapped IPv6 through the underlying IPv4 policy, preserves the narrower local-development authority path, performs no runtime registry lookup, and keeps ordinary stdlib classification for addresses outside the bounded overlay. The documented overlay matches the current IANA registries last updated 2025-10-09, including the 2001::/23 exception structure and current 192.0.0.0/24 exceptions. This is author-side review evidence only, not independent approval. Keep Draft until corrected central Dependency Review and authoritative Strix evidence run on the unchanged head and qualifying independent review exists.

[seonghobae]

@cwl-noema-review review

Review exact current head 811ba846757adb44dfc648b9b13761aa1536a110 against protected main@7faf7a3b8a47980113982914000e724ab6a6cda5. Validate the bounded IANA special-purpose compatibility overlay, most-specific global exceptions before non-global parents, IPv4-mapped recursion, local-development non-widening, static source-controlled registry provenance, and Python 3.10–3.14 decision stability. Submit a formal independent verdict only for this head. Do not mutate, merge, or promote wrapper-green supply-chain evidence while the actual Dependency Review action is skipped.