draft(architecture): preserve outbound-policy RED pending EgressWeave release

Cargo.toml

@@ -15,7 +15,7 @@ reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["fs", "macros", "net", "rt-multi-thread", "signal", "sync"] }
+tokio = { version = "1", features = ["fs", "macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
 waf-ids-core = { path = "crates/waf-ids-core" }
 
 [dev-dependencies]

docs/runbooks/operations.md

@@ -99,11 +99,15 @@ When `WAF_IDS_STATE_PATH` is enabled, the process writes a temporary sibling fil
 This baseline is suitable for local and controlled lab deployments. Internet-facing use still requires:
 
 - TLS termination and identity-aware admin access
-- upstream allowlists and egress controls
+- DNS-aware allowlists and request-time egress revalidation beyond the current literal-host fail-closed checks
 - durable database storage with backups
 - SSO/OIDC federation (multi-token RBAC with readonly role and audit-log auth are available)
 - asynchronous event persistence or a database-backed event store for high-throughput gateway traffic
 - In-process Coraza embedding (HTTP audit ingest at `POST /api/waf/coraza/audit` already fuses block hits into DNSBL/`client_ip` indicators for gateway enforcement)
 - Live Suricata EVE tailing / shipper (HTTP ingest of EVE alerts is available at `POST /api/ids/suricata/eve`)
 - Live MISP REST pull or live OpenCTI GraphQL pull (HTTP STIX/MISP/OpenCTI document ingest and TAXII 2.1 poll are available at `POST /api/threat-intel/stix`, `POST /api/threat-intel/misp`, `POST /api/threat-intel/opencti`, and `POST /api/threat-intel/taxii/poll`)
 - human approval workflow for AI SOC recommendations that change enforcement
+
+Current outbound guardrails reject destination URLs that include embedded credentials or fragments, require HTTPS off loopback, and fail closed when either literal IPs or request-time DNS resolution land on localhost/private/link-local/documentation address space before proxying gateway traffic or calling feed, Clearfolio, or SOC-LLM upstreams. This is still a first layer rather than a full egress platform: Wessels et al. (2024) show that incomplete SSRF defenses remain common when services rely on ad hoc validation rather than explicit request policy, and Jackson et al. (2007) explain why DNS rebinding defenses need request-time hostname revalidation rather than one-time parsing alone. Hostname allowlisting, DNS pinning, and audited proxy configuration remain follow-up controls.
+
+References: Wessels, M., Koch, S., Pellegrino, G., & Johns, M. (2024). *SSRF vs. developers: A study of SSRF-defenses in PHP applications*. https://trouge.net/papers/sec24_SSRF.pdf ; Jackson, C., Bortz, A., Boneh, D., & Mitchell, J. C. (2007). *Protecting browsers from DNS rebinding attacks*. https://web.eecs.umich.edu/~aprakash/eecs588/handouts/dns-rebinding.pdf. These links remain citation-only in this repository because this PR does not establish redistribution rights for the external paper PDFs.

docs/security/threat-model.md

@@ -25,7 +25,7 @@
 | Unauthorized management write | Route takeover or false blocking | `X-Admin-Token` write gate; multi-token RBAC with actor labels and readonly role; audit log for successful writes | SSO/OIDC, mTLS or identity proxy, SCIM |
 | Malicious threat feed import | False positives or broad blocks | Validation, route-scoped enforcement | Source signing, feed confidence, staged promotion |
 | State file corruption | Startup failure or stale policy | JSON parse failure surfaces startup error | Database, backup, schema migration |
-| Upstream SSRF through routes | Internal network exposure | Upstream scheme validation | Upstream allowlists, egress policy |
+| Upstream SSRF through routes | Internal network exposure | Shared outbound URL validation rejects credentials, fragments, and localhost/private literal destinations before proxy/fetch calls | DNS resolution allowlists, request-time rebinding checks, egress policy |
 | Gateway DoS | Availability loss | Rust memory safety, event retention limit | Rate limits, body limits, async event sink |
 | DNSBL abuse | Reputation damage | Loopback response-code validation | Authoritative DNS service, signing, publisher workflow |
 | Secret disclosure | Admin compromise | Support bundle excludes admin token; secrets bootstrapped into credential registry (`WAF_IDS_CREDENTIALS_PATH` preferred over long-lived env); health exposes source label only | External secret manager / SSO, rotation, access review |