security: require exact built-in HTTP method policy strings

[seonghobae]

Buyer-visible immutable method-policy value gap

EgressWeave must reject non-exact str subclasses before trusted HTTP-method normalization or comma-separated parsing can invoke subclass-controlled strip(), upper(), or split(). This is supported configuration integrity, not a Python-sandbox claim.

Current canonical reconstruction

Historical #129/#154/#161/#184/#196 remain TDD/review or superseded reconstruction history. The single live implementation owner is Draft PR #204 — security: reconstruct exact HTTP method strings on protected main.

Fresh exact lineage as of the current repository sweep:

• protected/live main: 7faf7a3b8a47980113982914000e724ab6a6cda5;
• security: reconstruct scalar integer sealing on current protected main #178 scalar-integer predecessor is already protected-main truth through merge commit 632bb83bb2cfa86cbcb389ef8d544abaeb0403ef;
• predecessor security: reconstruct exact HTTP method strings on current main #196 source head: 5b62c18f3776860dee63db0c226f8be7c9d40bff (historical only; its checks/reviews do not transfer);
• security: reconstruct exact HTTP method strings on protected main #204 exact current head: ab51ef1725bd20c898a3e3df82994b576e675e7b;
• security: reconstruct exact HTTP method strings on protected main #204 is open / Draft / mergeable, based on exact protected main 7faf7a3b8a47980113982914000e724ab6a6cda5;
• security: reconstruct exact HTTP method strings on protected main #204 is 0 commits behind that protected base and carries only the unique method-string delta across CHANGELOG.md, docs/research/policy-configuration-integrity.md, src/egressweave/_policy_normalization.py, src/egressweave/policy.py, and tests/test_policy_method_value_integrity.py.

The live candidate requires exact built-in str values before per-entry normalization and before supported comma-separated parsing. Ordinary exact strings, trimming, uppercase canonicalization, RFC 9110 token validation, default/deny-all method sets, unconditional CONNECT denial, exact (hostname, port) authorization, and the already-protected scalar-integer boundary remain unchanged.

Exact-current-head evidence

On unchanged ab51ef1725bd20c898a3e3df82994b576e675e7b:

• repository ci run 31597947375: completed success;
• required SAST Semgrep run 31597947456: completed success;
• required Security Scan run 31597947433: aggregate success, but job 94117979264 shows the actual immutable-pinned Dependency review step as skipped; this is explicitly non-passing supply-chain evidence under issue security: fail closed when dependency review is unavailable #76;
• exact-head OpenCode workflow/check completed successfully, but model/check status is not promoted into qualifying approval or a substitute for a missing required security action;
• formal reviews: none;
• unresolved review threads: none.

The separately governed root-cause repair remains read-only ContextualWisdomLab/.github#897, exact head 59505c1d89eb7ea816e921b6da38079c736608c2, open / Ready / mergeable / unmerged at the latest refetch. EgressWeave must not fork that workflow locally, weaken the gate, invent credentials, or churn #204's clean source head merely to reproduce the same skipped result.

Acceptance criteria

• Preserve immutable RED evidence for non-exact method entries and subclass-controlled comma-separated parsing.
• Reject non-exact str before per-entry strip() / upper() and before supported outer split(",") paths in the live reconstruction source.
• Preserve exact ordinary strings, comma-separated ergonomics, uppercase normalization, RFC 9110 token validation, default/deny-all method sets, unconditional CONNECT denial, and the protected scalar-integer boundary.
• Add a runtime authorization regression proving a hostile method-string subclass is rejected rather than dynamically normalized.
• Retire stale stacked reconstruction paths and rebuild the unique issue security: require exact built-in HTTP method policy strings #124 delta directly on exact protected main as security: reconstruct exact HTTP method strings on protected main #204 without force-push or destructive rebase.
• Obtain exact-current-head repository CI and SAST success for security: reconstruct exact HTTP method strings on protected main #204.
• Integrate the separately governed central fail-closed Dependency Review repair (ContextualWisdomLab/.github#897 or a freshly verified successor) and obtain a fresh unchanged security: reconstruct exact HTTP method strings on protected main #204 Security Scan whose actual immutable-pinned Dependency review action executes and succeeds.
• Require every other live organization-required workflow on the unchanged exact head to be genuinely passing; queued/skipped/neutral/backend-unavailable/wrapper-only/status/model/predecessor evidence does not pass by inference.
• Obtain current semantic/source review with zero valid unresolved findings; formal approval is required only if the live ruleset actually requires it (the current observed rule requires zero approving reviews but does require thread resolution).
• Immediately before integration refetch exact head, live base, ancestry, ruleset, every required workflow, reviews, findings, and threads; merge only the unchanged accepted tree.
• Verify the exact method-policy contract from protected main before closing this issue.

Non-goals

• No HTTP method allowlist redesign or authority widening.
• No change to request-time case/canonicality rules.
• No generalized Python sandbox or in-process code-containment claim.
• No EgressWeave-local replacement for organization-owned Dependency Review or Strix governance.

[seonghobae]

Exact-current-head refresh for the canonical Draft stack lane:

• security: reconstruct exact HTTP method strings on current integer-policy stack #184 remains Draft on exact predecessor security: reconstruct scalar integer sealing on current protected main #178 head 65485ee196699ecb5a8451621d188afdd8731bf6;
• security: reconstruct exact HTTP method strings on current integer-policy stack #184 exact head remains 365a38820474b4e8a5325b02dbdf3aa1a6f24a37;
• CI 31519709781, previously recorded here as queued, is now terminal success on that exact head, including package build/verification and the supported test matrix;
• this does not make security: reconstruct exact HTTP method strings on current integer-policy stack #184 Ready or mergeable for acceptance: it remains intentionally stacked behind security: reconstruct scalar integer sealing on current protected main #178, and Draft-skipped/absent SAST, Security Scan, review, and the centrally repaired actual Dependency review execution remain non-passing/absent acceptance evidence.

Do not transfer predecessor #178 or historical #161 evidence. Keep #184 Draft until #178 is accepted/integrated or reconstruct this unique method-string delta on the exact accepted replacement, then obtain fresh integrated-tree CI/SAST/security/review evidence.