security: reconstruct scalar integer sealing on current main

[seonghobae]

Superseded by integrated-main reconstruction

This historical reconstruction is closed without merge because protected main advanced from its base d3498ec9455bfd3f3bb7df78c914de0a5d1120fc to dd0324c0d7edb6effc74737039d1e754af09f5aa after the candidate was built.

Ready PR #159 preserves the scalar-integer boundary, full public-constructor regression coverage, canonical guidance and release history on the exact integrated base. Its current exact head is e80f83da3a22321e4fc013a05b3d94591dc304c0; CI 31445427241 and SAST 31445427240 are green with exact 100% owned production statement/branch coverage. Security Scan 31445427209 still has the actual pinned Dependency review step skipped, so #159 is not merge-ready until the read-only central dependency-review repair is integrated and the unchanged head is revalidated.

Historical evidence in this PR remains audit history; no check, review, approval, base identity or mergeability transfers to #159. Its former successor #154 must be reconstructed on the new predecessor rather than inheriting this stale stack.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fb211436-2f5f-4910-a5a1-58021f8f2d34

📥 Commits

Reviewing files that changed from the base of the PR and between 6d8cde2 and cbba06b.

📒 Files selected for processing (1)

• tests/test_policy_integer_value_types.py

📝 Walkthrough

Walkthrough

정책 정규화가 포트와 리소스 제한 필드에서 int 하위 클래스와 bool을 거부하도록 변경되었습니다. 정확한 int와 ASCII 십진 문자열은 계속 허용됩니다. 회귀 테스트, 연구 문서, 변경 로그를 추가했습니다.

Changes

정책 정수 입력 무결성

Layer / File(s)	Summary
엄격한 정수 정규화 src/egressweave/_policy_normalization.py	허용 포트, DNS 주소 수, 양의 개수, 바이트 예산에 type(value) is int 검증을 적용합니다.
회귀 검증 및 무결성 기록 tests/test_policy_integer_value_types.py, docs/research/policy-configuration-integrity.md, CHANGELOG.md	정확한 정수와 ASCII 십진 문자열의 동등성, int 하위 클래스 거부, 정책 무결성 계약과 변경 사항을 검증하고 기록합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• #122: 공유 정책 정규화 함수의 정확한 int 검증과 관련 테스트 및 문서 변경을 다룹니다.
• #133: _policy_normalization.py의 비정확한 내장 타입 방어와 관련되지만, 튜플 컨테이너를 대상으로 합니다.
• #120: int 하위 클래스 거부 규칙과 관련되지만, 연결 풀의 연결 수 필드를 대상으로 합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 현재 변경의 핵심인 스칼라 정수 값 봉인과 보안 수정 재구성을 명확하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/reconstruct-policy-integer-values-d3498

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/test_policy_integer_value_types.py`:
- Around line 16-63: Extend the integer-subclass rejection and
exact-integer/ASCII-decimal-string acceptance matrices in
test_policy_rejects_integer_subclass_for_resource_limits and
test_policy_keeps_exact_integer_and_decimal_string_configuration to cover
max_response_header_fields, max_response_bytes, max_response_header_bytes,
max_request_header_bytes, and max_request_target_bytes. Add corresponding
EgressPolicy.from_authorities tests covering rejection of _PolicyIntegerSubclass
ports and equivalence of exact integer versus ASCII decimal-string ports,
preserving the existing assertions on normalized int values.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e5f54442-382d-4bd9-959a-c75724726b43

📥 Commits

Reviewing files that changed from the base of the PR and between d3498ec and 6d8cde2.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/research/policy-configuration-integrity.md
• src/egressweave/_policy_normalization.py
• tests/test_policy_integer_value_types.py

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.