security: require exact connection-pool policy type

[seonghobae]

Buyer-visible connection-pool policy-integrity gap

EgressPolicy retains one immutable EgressConnectionPoolPolicy, and both pinned transports later consume its capacity and expiry fields when constructing HTTPCore pools. A non-exact subclass is outside the reviewed finite-resource policy contract because later attribute dispatch can diverge from the values validated and fingerprinted at startup. This is a trusted configuration-integrity boundary, not a Python-sandbox claim.

Current canonical candidate

The current replacement is Draft PR #221, exact head f97084256922f7085b94096f6c20e4a613fac738, stacked on timeout-policy replacement #220 and method-policy predecessor #204. Historical #117/#151/#169/#182 remain evidence only; #182 is closed as superseded and no historical acceptance evidence transfers.

Test-first reconstruction is complete:

• RED-only head 834ec1979e48c37ae35483e20563772caabd59fd failed both constructor regressions across Python 3.10–3.14;
• minimal GREEN head 26fb5b2a84f8efa9a19b5ca5fc32e177786e0145 introduced the exact built-in policy-object boundary;
• exact final head f97084256922f7085b94096f6c20e4a613fac738 adds migration guidance and its permanent documentation contract;
• exact-head CI passed Python 3.10–3.14, 1,038 tests, 1,762/1,762 production statements, and 590/590 production branches.

Acceptance criteria

• Reproduce subclass-controlled later pool-value dispatch on the current policy stack.
• Add deterministic hosted RED evidence before production code.
• Reject non-exact EgressConnectionPoolPolicy objects during trusted construction.
• Preserve exact instances, defaults, normalization, public builders, deterministic evidence, and every existing authority/DNS/TLS/proxy/request/response/timeout boundary.
• Document the pre-1.0 compatibility narrowing and migration to an exact declarative instance.
• Obtain fresh Python 3.10–3.14/package verification with 100% owned-production statement/branch coverage.
• Integrate security: reconstruct exact HTTP method strings on protected main #204 and security: reject timeout-policy subclasses on the current policy stack #220 in dependency order on an accepted protected tree.
• Retarget/reconstruct security: reject connection-pool policy subclasses on the current policy stack #221 onto that exact tree without transferring historical evidence.
• Require the actual pinned Dependency Review action and authoritative exact-head Strix evidence after .github#897 and .github#965 integrate.
• Resolve every current-head finding and obtain counted independent formal approvals.
• Revalidate exact head/base/ancestry, checks, reviews, threads, and rulesets immediately before protected merge.
• Verify the exact policy-object boundary from protected main, then close this issue and advance security: require exact pool-count scalar types #222.

Concurrency discipline

#221 is the only active implementation lane. Do not reopen historical candidates, create a competing policy.py writer, weaken required gates, churn a clean head to retrigger external systems, or synthesize review/status evidence.

[seonghobae]

Current-stack refresh: PR #182 is now Ready at exact head 53d0731862549b3d94d436526243a308b5d7b071, directly based on #158 head aacd5b3e3e01ceef1959b175f6f40530d61be0f2. Exact local validation: 39 focused policy tests, 896 full-suite tests, 100% production statement/branch coverage (1704/1704 statements, 576/576 branches), Ruff, hourly product guard self-test, and compileall passed. Stacked hosted review/security evidence remains non-acceptance until the accepted predecessor chain is integrated and the actual central Dependency review gate executes.