feat(gateway): trust forwarded IPs only from trusted proxies

[seonghobae]

Preservation lane — do not merge independently

This Draft preserves reviewed trusted-proxy hostile/fuzz evidence from the earlier clean stack. Its exact head remains 65a2b7fbf2827f69ae1aa288696b6c5630af28c4, but its base is the superseded runner prerequisite branch #153@b663f9d200e5f385c7dd067d074940a02836c68e. #153 is now Draft because the sole same-path workflow writer is #159, which non-force carries the explicit hosted-runner prerequisite plus queue-pressure repair.

PR #165 is the current trusted-client-attribution feature owner on protected main. It has since repaired the canonical Runtime Configuration boundary, current review findings, literature traceability, and canonical trusted-CIDR fail-closed rule. This older branch must not become a second production owner.

It also must not be closed yet. Fresh delta comparison shows this branch still contains unique security evidence that #165 has not fully carried: the fuzz_trusted_forwarded_client_ip target and corpus, fuzz invariants, and additional trusted-proxy admission regressions. Its .github/workflows/fuzz.yml modification cannot be copied into #165 now because #159 is the sole writer for that workflow surface.

Dependency order is therefore:

1. fix(actions): coalesce Wardnet PR validation slots #159 reaches protected main through normal exact-head governance;
2. refactor(config): centralize runtime bootstrap snapshot #140 reaches protected main as the canonical Runtime Configuration foundation;
3. rebuild the current trusted-proxy successor non-destructively on fresh protected truth;
4. transfer and verify every still-valid unique fuzz/corpus/test delta from this branch without copying obsolete bootstrap/workflow authority;
5. reacquire exact-head repository/security/coverage/review evidence;
6. only after the successor demonstrably contains the complete valid delta may this preservation PR be closed as superseded.

Security behavior to preserve: forwarded identity is trusted only from configured proxy CIDRs; malformed chains fail closed to the direct peer/unknown identity; direct build_app(state) remains usable without trusting forwarded headers; trusted chains are parsed right-to-left with observed IPv4-mapped-address normalization; hostile unit/property/fuzz and operations evidence remain part of acceptance.

No predecessor evidence transfer, self/model approval, feature-branch final merge, force push, destructive rebase, routine bypass, or gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}