[eersnington]

• A guest TCP connect to a VM loopback port with no listener (and no loopbackExemptPorts entry) now fails with ECONNREFUSED, like Linux and a container with no published ports.
• Both places that answer this change: the sidecar connect filter and the kernel loopback check. Only the errno and message change. What is reachable does not.
• UDP sends and connects keep their current confinement error.

Guest code	Before	After
net.connect(4999, "127.0.0.1"), nothing listening	EACCES: blocked outbound network access … not owned by this VM	ECONNREFUSED: … no listener … in this VM; host loopback ports require loopbackExemptPorts
fetch retry loop waiting for a server to start	throws on the first attempt	retries until the server is up
host listener on a non-exempt port	not reached	not reached

network-deny-vm-local.test.ts now expects ECONNREFUSED for the host-loopback case. It still asserts the host server receives no request.

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.

[github-actions]

📟 Pip-Boy · c5345ad

📦 Packages

❌ Not run: the changes job was cancelled. See the run.

🧹 Rust dependencies

❌ Not run: the changes job was cancelled. See the run.

🦀 Binaries

❌ Not run: the changes job was cancelled. See the run.

⏱ Timing

job	wall time	slowest step
⊘ changes	5m02s	checkout · 4m59s
zizmor	10s	checkout · 3s
report	29s	checkout · 10s
⏭ self-test	—	skipped
⏭ hygiene	—	skipped
⏭ footprint	—	skipped
⏭ native · ${{ matrix.platform }}	—	skipped

🔭 Full CI trace for this commit

One OpenTelemetry trace of CI and Pip-Boy for c5345ad: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha c5345ad9097f645e3212e589b10d3e62890678aa

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/agentos checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.