security: reconstruct exact connection-pool policy boundary on current stack

[seonghobae]

Purpose

Replace stale stacked PR #117 with a bounded test-first reconstruction of issue #116 on the current accepted predecessor candidate #149. Historical #117 remains immutable evidence only; none of its checks, reviews, approvals, base identity, or mergeability transfers.

Exact stack and RED boundary

• predecessor branch: security/reconstruct-timeout-policy-type-d3498ec;
• predecessor exact head at reconstruction: b803faac4ace5946f168c9e7403bfa529e6a1c2d;
• test-only head: fb61d280415ff4a0bdfd663aef4e8e4963924afd;
• compare is exactly one commit ahead / zero behind;
• current delta is only tests/test_connection_pool_policy_type_boundary.py.

The regression requires both public policy constructors to reject an EgressConnectionPoolPolicy subclass before subclass-controlled attributes can replace reviewed finite pool ceilings. The expected RED is the current isinstance(...) acceptance boundary in EgressPolicy.__post_init__. Any unrelated failure is new evidence and must be investigated rather than normalized.

Planned narrow GREEN

After exact-head CI reproduces only the intended boundary, change only the shared construction guard to exact EgressConnectionPoolPolicy type acceptance, rerun the exact boundary, then reconstruct only directly affected operator/research guidance, documentation contract, and [Unreleased] parity test-first. Preserve #149's exact timeout-policy boundary and current protected-main release-evidence history.

No destination authority, DNS, TLS, proxy, request/response policy, timeout values, pool defaults, dependency, workflow, credential, publisher/release authority, public builder signature, or protected ref is widened.

Keep Draft while predecessor #149 is unintegrated. Predecessor checks/reviews do not transfer. Aggregate Security Scan success is not dependency-review acceptance while the organization-owned actual pinned Dependency review action is skipped.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b426774b-a603-4b45-bb2e-e36cd2501a28

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #169. This Draft remains pinned to predecessor snapshot b803faac4ace5946f168c9e7403bfa529e6a1c2d, while the accepted predecessor reconstruction is #158 24dbd89ca6f89657380702b235d03f1bafdad3e0. #169 was rebuilt from that exact predecessor, reproduced the intended source RED on 0dc1ce33bbcab2d36ff0812db3b28f6c15863205, then reconstructed the source and documentation boundary test-first. Final exact head cfbe299b5a226c2076e2cbd3aadbde0a257dd713 passed CI 31457907733 across Python 3.10–3.13 and package acceptance; Python 3.13.14 ran 772 tests with exact owned coverage 1633/1633 statements and 560/560 branches. The final #169 diff preserves this PR's unique source, regression, research-guide, and [Unreleased] changes. No checks, reviews, approvals, mergeability, or base identity are transferred. Closing this stale lane avoids duplicate writers for the same boundary.