security: require exact HTTPCore network-backend authority values

[seonghobae]

Buyer-visible dependency-boundary candidate

Fresh protected main is 10d0c51daf2ad278d66f43be479df8cf6b08ba6d. A duplicate-work search found no open EgressWeave issue dedicated to the authority-value types accepted by the private HTTPCore network-backend seam.

Both protected-main pinned backends call _verify_host_port(...) immediately before opening a socket. That check currently canonicalizes the dependency-supplied host with isinstance(host, bytes) plus decode(...), otherwise str(host), and compares the port through int(port). These conversions occur before the exact validated (hostname, port) comparison. The public package deliberately depends on private HTTPX/HTTPCore transport APIs, so the concrete types supplied at this seam are part of the reviewed compatibility/security contract rather than an arbitrary Python extension point.

This is a candidate integrity gap until immutable RED evidence reproduces subclass- or conversion-controlled behavior on the exact accepted transport tree. Do not claim an authority bypass from source inspection alone. Ordinary HTTPCore currently supplies normal built-in authority values; the question is whether EgressWeave should fail closed if a future/injected incompatible private-API surface supplies polymorphic values before socket creation.

Protected-main evidence:

• src/egressweave/sync_transport.py blob ce6bc1eb9fe9d89cf5783f35d8f42a4fec1e8953 accepts host: str | bytes but uses broad isinstance(host, bytes) / str(host) and int(port) inside _PinnedEgressSyncNetworkBackend._verify_host_port(...) before connect;
• src/egressweave/transport.py blob 0a5df55e2a1793eacb7932effca2e80745de34d2 uses the same conversion pattern in _PinnedEgressNetworkBackend._verify_host_port(...);
• protected-main AGENTS.md explicitly treats the private HTTPX/HTTPCore dependency seam as security-sensitive and requires revalidation when those dependencies change;
• issue reliability: align private HTTPX/HTTPCore runtime support with executable compatibility evidence #135 separately governs version compatibility evidence for the private API surface; this issue is the narrower runtime authority-value boundary and should be coordinated with, not duplicated into, that work.

Writer / dependency discipline

Do not open a competing implementation while active transport stacks own these files, including #75 and #101 (and any freshly verified successors). Wait for one exact accepted transport predecessor, then reconstruct only this unique boundary delta on that tree. No predecessor checks, reviews, approvals, security scans, or coverage evidence transfer.

Mandatory RED and remedy comparison

Before production change, add deterministic sync and async dependency-seam tests that use the smallest controlled host/port values necessary to answer these questions:

1. Can a non-exact bytes/str host value execute subclass-controlled decoding/string conversion or normalization before the authority mismatch is rejected?
2. Can a non-exact integer-like port execute caller/dependency-controlled integer conversion before the exact validated port comparison?
3. Do ordinary exact HTTPCore host/port values continue to pass unchanged?

If RED confirms polymorphic behavior, compare at least:

• exact built-in value requirements at _verify_host_port(...);
• a single private-adapter normalization seam shared by sync/async;
• capability/shape checks tied to the broader private-API compatibility contract in reliability: align private HTTPX/HTTPCore runtime support with executable compatibility evidence #135.

Prefer the smallest auditable repair that rejects an unsupported private shape before conversion behavior or network I/O without widening the supported authority model. Do not add coercion merely to accommodate an unreviewed dependency shape.

Acceptance criteria

• Start from the exact accepted transport predecessor and preserve immutable RED evidence before production changes.
• Prove or falsify subclass/conversion-controlled behavior for host and port independently at both sync and async network-backend seams.
• If confirmed, require only reviewed concrete authority-value shapes before semantic conversion/comparison, with a stable fail-closed internal transport error before socket creation.
• Preserve the exact validated (hostname, port) pair, DNS address validation/pinning, per-connect address revalidation, TLS identity, no proxy/redirect/Unix-socket path, finite connection deadline, request/response policy, and public builders.
• Preserve normal exact built-in HTTPCore values and do not claim arbitrary in-process Python sandboxing.
• Coordinate the accepted type/shape contract with reliability: align private HTTPX/HTTPCore runtime support with executable compatibility evidence #135 so advertised HTTPX/HTTPCore compatibility actually executes this seam; do not use this issue as a documentation-only substitute for dependency-profile testing.
• Add beginner-readable documentation and [Unreleased] only after observed RED → GREEN; reconcile Architecture/UML/Threat Model/traceability only where materially affected and keep unmerged behavior ACTIVE-PR.
• Maintain exact 100% owned production statement/branch coverage and complete shipped public docstrings.
• Verify Python 3.10–3.14 on the accepted integrated tree plus Ruff, product guard, compileall, wheel/sdist, and installed-wheel smoke.
• Pass exact-current-head SAST and the corrected organization Security Scan whose actual pinned Dependency review action executes successfully, current automated review with zero valid findings, every live branch/ruleset requirement, protected merge, and protected-main operational verification before closure.

Non-goals

• No assertion that current upstream HTTPCore emits hostile host/port objects.
• No redesign of EgressWeave authority semantics.
• No broad replacement of HTTPX/HTTPCore.
• No duplicate of reliability: align private HTTPX/HTTPCore runtime support with executable compatibility evidence #135's dependency-version support policy.
• No local workaround for the separately governed central .github dependency-review defect.
• No competing source edits while the current transport stack is active.