security: require exact built-in connection-count values

[seonghobae]

Buyer-visible connection-pool value-integrity gap

EgressConnectionPoolPolicy count normalization must retain reviewed exact built-in integers rather than arbitrary int subclasses carrying polymorphic numeric behavior into finite connection-capacity state. This is trusted configuration integrity, not a claim that EgressWeave sandboxes arbitrary Python code already executing in the host process.

Current canonical candidate

The current replacement is Draft PR #222, exact head 89d9012af9a6bda7fc13169173f6476459bccc24, stacked on #221 → #220 → #204. Historical #117/#121/#151/#152/#187 remain evidence only; #187 is closed as superseded and no checks, reviews, base identity, or mergeability transfer.

Test-first reconstruction is complete:

• RED-only head 753c8bb38bbdb8952bf95baf2f8e9410b7e8934f failed the two new count-subclass regressions across Python 3.10–3.14;
• minimal GREEN head 21d61428791b6f7a807a3ec412156b598bbcfbbe requires exact built-in int values while retaining reviewed ASCII decimal strings;
• exact final head 89d9012af9a6bda7fc13169173f6476459bccc24 adds source-grounded migration guidance and a permanent documentation contract;
• exact-head CI passed Python 3.10–3.14, 1,042 tests, 1,762/1,762 production statements, and 590/590 production branches.

Acceptance criteria

• Reproduce the count-subclass defect on the current policy stack.
• Add deterministic hosted RED evidence before production code.
• Reject non-exact integer subclasses for both total and idle pool counts.
• Preserve exact built-in integers, reviewed ASCII decimal strings, zero/positive constraints, relational invariants, normalized exact outputs, and all public signatures.
• Document the pre-1.0 narrowing and conversion of validated subclass values to an exact built-in integer or approved decimal string.
• Obtain fresh Python 3.10–3.14/package verification with 100% owned-production statement/branch coverage.
• Integrate security: reconstruct exact HTTP method strings on protected main #204 → security: reject timeout-policy subclasses on the current policy stack #220 → security: reject connection-pool policy subclasses on the current policy stack #221 on an accepted protected tree.
• Retarget/reconstruct security: require exact pool-count scalar types #222 onto that exact tree without transferring historical evidence.
• Require the actual pinned Dependency Review action and authoritative exact-head Strix evidence after .github#897 and .github#965 integrate.
• Resolve every current-head finding and obtain counted independent formal approvals.
• Revalidate exact head/base/ancestry, checks, reviews, threads, and rulesets immediately before protected merge.
• Verify exact count normalization from protected main, then close this issue.

Concurrency discipline

#222 is the only active implementation lane. Do not reopen historical candidates, create a competing count-normalizer writer, weaken required gates, or manufacture review/status evidence.

[seonghobae]

Current-stack reconstruction update: PR #187 (826db8d549ee34d04c387bf538fb0ebfbbe7cfb3) is now ready for review on exact PR #182 head 53d0731862549b3d94d436526243a308b5d7b071. It reconstructs the unique connection-count integer-subclass boundary from historical #152 without transferring evidence. Exact local validation at the reconstructed tree: 901 passed, 100% production statement/branch coverage (1704/1704 statements, 576/576 branches), Ruff, hourly product guard self-test, and compileall passed. Historical #152 is evidence only; protected integration remains gated by its accepted predecessor chain and the central dependency-review prerequisite.