security: reconstruct exact request-timeout policy boundary on integrated main by seonghobae · Pull Request #158 · ContextualWisdomLab/EgressWeave

seonghobae · 2026-08-11T00:06:16Z

Purpose

Preserve the exact request-timeout policy type repair while preventing stale predecessor/base evidence from being mistaken for current merge authority.

Exact current identity

current protected main: 7faf7a3b8a47980113982914000e724ab6a6cda5;
exact unchanged PR head: 496d81709ad63be6b921510c447e7d2393daed96;
head tree: 71a3aba28e2147ee81e63dbca24b284ae52eebb2;
current state: open / Draft / non-mergeable;
fresh current-main comparison: diverged, 20 commits ahead / 10 commits behind;
merge base with current protected main: 1d2e19049354115776804c66b9366fad2ea5b6c5.

The prior 1d2e190... base and its hosted evidence remain immutable development history only. They are not current-main acceptance evidence and must not be transferred after reconstruction or integration.

Security contract

Trusted policy construction requires the exact EgressTimeoutPolicy type. Non-exact subclasses are rejected before subclass-controlled as_httpcore_timeout() dispatch can replace reviewed finite phase ceilings. Exact factory-created timeout values, defaults/normalization, constructor parity, deterministic fingerprints, normalized (hostname, port) authorization, DNS/TLS/proxy/request/response boundaries and public builders remain unchanged.

Historical exact-head proof

On unchanged historical head 496d81709ad63be6b921510c447e7d2393daed96 over its then-current integrated base:

CI 31552525856: success across package acceptance and Python 3.10–3.14, including Ruff, full pytest/coverage, product guard, compileall, wheel/sdist verification and installed-wheel smoke;
SAST 31552525848: success;
Security Scan 31552525855: OSV, Trivy and Scorecard succeeded, but dependency-review job 93978067181 skipped the actual immutable-pinned Dependency review action;
required Strix check 94015723146 concluded wrapper success while its annotation stated Strix backend unavailable and no vulnerability report was produced;
formal reviews: none;
unresolved review threads: none.

Skipped Dependency Review and unavailable/no-report Strix are explicitly non-passing semantic evidence. Aggregate wrapper green does not repair either boundary.

Current RCA / feasibility

The first merge blocker is no longer merely provider review latency: the candidate is materially behind and diverged from protected main, while the organization-owned Dependency Review and Strix semantic evidence channels are also not acceptable. Repeated clean-head churn or another local security workflow would not change those root causes.

The central Dependency Review repair remains separately governed and read-only to this writer as ContextualWisdomLab/.github#897, exact head 59505c1d89eb7ea816e921b6da38079c736608c2, still open/unmerged at the latest refetch. The Strix false-green boundary is tracked separately by EgressWeave issue #197 and is organization-control-plane owned.

Do not refresh this branch merely to retrigger external behavior or race current policy writers. When the overlapping policy lane and central evidence prerequisites are stable, reconstruct only this unique timeout-policy delta non-destructively on the exact accepted protected tree and regenerate all base/head-sensitive evidence.

Remaining acceptance

Preserve immutable RED/GREEN lineage for the exact timeout-policy type boundary.
Keep the stale/diverged candidate Draft so it cannot be mistaken for merge-ready work.
Reconstruct the unique timeout-policy delta on an exact accepted current protected tree without transferring predecessor evidence.
Obtain fresh Python 3.10–3.14/package, exact 100% owned statement/branch coverage, SAST and all live required workflow evidence on that exact reconstructed head.
Require the actual immutable-pinned Dependency review action to execute and succeed rather than skip.
Require an actual exact-head Strix semantic report rather than backend-unavailable/neutral/wrapper-only evidence.
Validate all current human/automated findings and resolve only addressed exact-head threads.
Immediately before integration refetch exact head, live base, ancestry, ruleset, required workflows, reviews/findings/threads and writer evidence.
Merge only an unchanged accepted tree, then advance security: reconstruct exact connection-pool policy boundary on current timeout head #182 and security: reconstruct exact connection-count values on current pool-policy stack #187 strictly in dependency order on their own freshly regenerated evidence.

Progresses #113.

coderabbitai · 2026-08-11T00:06:28Z

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 11 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f5cff641-5000-4d46-ba91-00150422f712

📥 Commits

Reviewing files that changed from the base of the PR and between 1d2e190 and 496d817.

📒 Files selected for processing (5)

CHANGELOG.md
docs/research/request-timeout-boundaries.md
src/egressweave/policy.py
tests/test_timeout_policy_type_boundary.py
tests/test_timeout_policy_type_documentation.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-11T05:34:40Z

@coderabbitai review

coderabbitai · 2026-08-11T05:34:47Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-11T08:06:15Z

@coderabbitai review

Please review the unchanged exact current head cda34a973596e9f29a16585bb6b200ec404a4600 against live main c1a6ee1e437b44a9f8c06adb0fc91d4f1be9ff68. Focus on the exact EgressTimeoutPolicy construction boundary, preserved defaults/normalization, trusted startup diagnostics, tests, and directly affected guidance/release history. Report only current-head actionable findings. The organization dependency-review action is still skipped and remains a separate blocked gate.

coderabbitai · 2026-08-11T08:06:27Z

@seonghobae I will review PR #158 against the specified current head and live main. I will report only actionable findings on the current head. I will exclude the separate skipped dependency-review gate.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

…eave into HEAD

# Conflicts: # CHANGELOG.md

seonghobae · 2026-08-11T19:14:31Z

@coderabbitai review

Please review exact current head aacd5b3e3e01ceef1959b175f6f40530d61be0f2 over live protected main 52a5c6a0862e0d035b0698b79a0e8556269e0b00. There is no current formal review or inline review thread on this exact head. Validate only the unchanged exact current diff; do not transfer predecessor-head evidence.

coderabbitai · 2026-08-11T19:14:42Z

@seonghobae I will review PR #158 at aacd5b3e3e01ceef1959b175f6f40530d61be0f2 against main at 52a5c6a0862e0d035b0698b79a0e8556269e0b00.

I will validate only the current exact diff. I will not transfer findings or evidence from predecessor heads.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-12T00:22:19Z

@coderabbitai review

Please review exact current head aacd5b3e3e01ceef1959b175f6f40530d61be0f2 against protected main 52a5c6a0862e0d035b0698b79a0e8556269e0b00. Focus on exact-type sealing of EgressTimeoutPolicy, constructor parity, finite timeout semantics, fingerprint/configuration integrity, documentation/release-history parity, and preservation of existing authority/DNS/TLS/proxy/request/response behavior. This is the live predecessor for stacked #182 and #187; do not transfer historical #149 evidence.

coderabbitai · 2026-08-12T00:22:31Z

@seonghobae I will review PR #158 at aacd5b3e3e01ceef1959b175f6f40530d61be0f2 against main at 52a5c6a0862e0d035b0698b79a0e8556269e0b00.

I will review only the exact current diff. I will focus on EgressTimeoutPolicy type sealing, constructor parity, finite timeout handling, fingerprint and configuration integrity, documentation and release history, and preservation of authority, DNS, TLS, proxy, request, and response behavior. I will not transfer historical #149 evidence.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Integrate protected main 1d2e190 without rebasing. Preserve the current timeout-policy source/tests/research delta and take protected-main CHANGELOG as the initial merge resolution so integrated documentation parity can be revalidated independently.

seonghobae · 2026-08-12T01:09:49Z

@coderabbitai review

Please review exact current head 496d81709ad63be6b921510c447e7d2393daed96 against protected main 1d2e19049354115776804c66b9366fad2ea5b6c5. There are no formal reviews on this head; do not transfer any historical #149 or predecessor-head evidence.

This branch non-destructively integrated protected main via two-parent merge f4d14ae32b401bb9aabe66289737d8f8b8fede74. Integrated CI 31552188145 reproduced a deterministic documentation-contract RED because the initial merge resolution preserved protected-main CHANGELOG.md but omitted this branch's already-validated request-timeout exact-type release-history entry. Commit 496d81709ad63be6b921510c447e7d2393daed96 restores only that existing four-line entry; compare from the RED merge head changes exactly CHANGELOG.md (+4/-0).

Exact-current-head CI 31552525856 and SAST 31552525848 are green across Python 3.10–3.14, full coverage execution/report, product guard, compileall, wheel/sdist verification and installed-wheel smoke. Security Scan 31552525855 is aggregate green for OSV, Trivy and Scorecard, but the actual immutable-pinned Dependency Review action in job 93978067181 is skipped and remains non-passing supply-chain evidence.

Revalidate only the current integrated tree: exact EgressTimeoutPolicy type sealing at trusted construction, preservation of finite timeout values/defaults/fingerprints and constructor parity, no subclass-controlled as_httpcore_timeout() dispatch, documentation/release-history parity, and no regression to authority/DNS/TLS/proxy/request/response behavior.

coderabbitai · 2026-08-12T01:10:49Z

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='496d81709ad63be6b921510c447e7d2393daed96'
base='1d2e19049354115776804c66b9366fad2ea5b6c5'

printf '%s\n' '== Exact revisions =='
git rev-parse "$head" "$base"
printf '%s\n' '== Merge base =='
git merge-base "$head" "$base"
printf '%s\n' '== Diff summary (base...head) =='
git diff --stat "$base...$head"
printf '%s\n' '== Changed files (base...head) =='
git diff --name-status "$base...$head"
printf '%s\n' '== Direct post-merge changelog diff =='
git diff --unified=20 'f4d14ae32b401bb9aabe66289737d8f8b8fede74' "$head" -- CHANGELOG.md

printf '%s\n' '== Candidate files containing EgressTimeoutPolicy =='
rg -n -C 4 --glob '!**/.git/**' '\bEgressTimeoutPolicy\b' .

printf '%s\n' '== Candidate files containing as_httpcore_timeout or policy fingerprints/diagnostics =='
rg -n -C 4 --glob '!**/.git/**' \
  '\bas_httpcore_timeout\s*\(|\bfingerprint\b|timeout.*diagnostic|diagnostic.*timeout|type\(.*EgressTimeoutPolicy|isinstance\(.*EgressTimeoutPolicy' .

printf '%s\n' '== Documentation and release-history diff =='
git diff --unified=30 "$base...$head" -- CHANGELOG.md README.md docs 2>/dev/null || true

Length of output: 57316

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='496d81709ad63be6b921510c447e7d2393daed96'
base='1d2e19049354115776804c66b9366fad2ea5b6c5'

printf '%s\n' '== AST outlines =='
ast-grep outline src/egressweave/policy.py --items all --view expanded
ast-grep outline src/egressweave/timeout_policy.py --items all --view expanded
ast-grep outline src/egressweave/request_safety.py --items all --view expanded
ast-grep outline src/egressweave/decision_evidence.py --items all --view expanded
ast-grep outline tests/test_timeout_policy_type_boundary.py --items all --view expanded
ast-grep outline tests/test_timeout_policy_type_documentation.py --items all --view expanded

printf '%s\n' '== Complete implementation diff =='
git diff --unified=80 "$base...$head" -- src/egressweave/policy.py

printf '%s\n' '== Policy construction and timeout implementation =='
sed -n '140,455p' src/egressweave/policy.py
sed -n '1,100p' src/egressweave/timeout_policy.py

printf '%s\n' '== Sanitizer and fingerprint implementation =='
sed -n '240,325p' src/egressweave/request_safety.py
sed -n '1,100p' src/egressweave/decision_evidence.py

printf '%s\n' '== New boundary and documentation tests =='
cat -n tests/test_timeout_policy_type_boundary.py
cat -n tests/test_timeout_policy_type_documentation.py

printf '%s\n' '== Timeout policy construction/fingerprint/transport parity tests =='
sed -n '35,115p' tests/test_request_timeout_policy.py
sed -n '205,345p' tests/test_request_timeout_policy.py

printf '%s\n' '== All direct calls to EgressPolicy constructors and timeout sanitizer =='
rg -n -C 3 --glob '*.py' \
  '(EgressPolicy\s*\(|EgressPolicy\.from_hosts\s*\(|EgressPolicy\.from_authorities\s*\(|_bind_bounded_request_timeouts\s*\()' \
  src tests

Length of output: 128233

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='496d81709ad63be6b921510c447e7d2393daed96'
base='1d2e19049354115776804c66b9366fad2ea5b6c5'
merge='f4d14ae32b401bb9aabe66289737d8f8b8fede74'

printf '%s\n' '== Requested merge topology =='
git show -s --format='commit=%H%ntree=%T%nparents=%P%nsubject=%s' "$merge"
git show -s --format='commit=%H%ntree=%T%nparents=%P%nsubject=%s' "$head"

printf '%s\n' '== Remaining exact-authority constructor =='
sed -n '397,465p' src/egressweave/policy.py

printf '%s\n' '== Sync and async transport timeout-binding call sites =='
sed -n '180,235p' src/egressweave/sync_transport.py
sed -n '340,390p' src/egressweave/transport.py

printf '%s\n' '== All production accesses to request_timeout_policy =='
rg -n -C 3 --glob '*.py' '\.request_timeout_policy\b|request_timeout_policy\s*=' src

printf '%s\n' '== Exact type checks and timeout-export calls in production =='
rg -n -C 3 --glob '*.py' \
  'type\([^)]*request_timeout_policy[^)]*\)|as_httpcore_timeout\s*\(' src

printf '%s\n' '== Direct-construction position-parity regression =='
sed -n '185,225p' tests/test_request_target_limits.py

printf '%s\n' '== Diff integrity =='
git diff --check "$base...$head"
git diff --word-diff=porcelain "$base...$head" -- src/egressweave/policy.py \
  docs/research/request-timeout-boundaries.md CHANGELOG.md

Length of output: 22437

@seonghobae Reviewed 496d81709ad63be6b921510c447e7d2393daed96 against 1d2e19049354115776804c66b9366fad2ea5b6c5.

No current-head actionable findings.

The merge base matches the requested protected-main commit. The stated merge has the expected two parents. The final commit restores only the four-line CHANGELOG.md entry.

The exact-type check rejects EgressTimeoutPolicy subclasses at EgressPolicy construction. Both public constructors and direct construction use this check. The sync and async transports preserve their shared pre-dispatch timeout sanitizer. Defaults, finite-value normalization, fingerprint inputs, and constructor parameter order remain unchanged. The new tests cover hostile subclasses through both public constructors. The guidance and release history match the implementation. git diff --check passed.

I used the existing repository guidance that aggregate Security Scan success does not replace Dependency Review acceptance. I excluded the separately skipped dependency-review gate from this review, as requested.

🧠 Learnings used

Learnt from: seonghobae
Repo: ContextualWisdomLab/EgressWeave PR: 0
File: :0-0
Timestamp: 2026-08-08T00:09:53.945Z
Learning: For EgressWeave PR `#85`, successful aggregate Security Scan results do not provide complete dependency-review assurance until the separately governed central fail-closed dependency-review repair is integrated into protected main and a fresh Security Scan executes dependency review on the unchanged PR head.

_{You are interacting with an AI system.}

seonghobae · 2026-08-12T02:29:48Z

Exact current-head local revalidation completed on 496d81709ad63be6b921510c447e7d2393daed96: Python 3.14 935 passed, 100% production statement/branch coverage (1704/1704, 576/576), Ruff, product-guard self-test, compileall, and CodeGraph sync. Hosted checks remain terminal green, but the Security Scan dependency-review wrapper's actual pinned action is skipped; keep the central fail-closed repair as a prerequisite and do not self/Admin/bypass merge.

seonghobae · 2026-08-12T05:01:17Z

@coderabbitai review

coderabbitai · 2026-08-12T05:01:29Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-14T08:45:18Z

Superseded by #220, which reconstructs the unique timeout-policy exact-type delta on the current policy stack with explicit hosted RED evidence, minimal GREEN implementation, migration documentation, and exact-head 100% statement/branch coverage. Historical checks, reviews, base identity, and mergeability from this diverged branch are intentionally not transferred.

test: reproduce timeout-policy subclass dispatch

485873e

seonghobae added 2 commits August 11, 2026 09:07

fix: seal request-timeout policy to exact type

949c543

docs(security): preserve timeout-policy boundary guidance

24dbd89

seonghobae marked this pull request as ready for review August 11, 2026 00:14

merge: refresh timeout boundary on protected main 72e7e79

0109bd3

seonghobae added 6 commits August 11, 2026 14:49

Merge origin/main into timeout policy reconstruction

c6400d7

test: detect malformed timeout changelog structure

370d6d9

docs: restore changelog security structure

1f0397c

Merge remote-tracking branch 'origin/main' into HEAD

5a83a11

Merge remote-tracking branch 'origin/main' into HEAD

0794893

merge: update timeout policy on current main

cda34a9

seonghobae added 7 commits August 11, 2026 17:27

Merge branch 'main' of https://github.com/ContextualWisdomLab/EgressW…

0694961

…eave into HEAD

test: keep timeout policy PR lint-clean

92437b8

Merge branch 'main' of https://github.com/ContextualWisdomLab/EgressW…

b6f795a

…eave into HEAD

Merge remote-tracking branch 'origin/main' into HEAD

a1fbc27

Merge remote-tracking branch 'origin/main' into HEAD

bbca2f7

Merge remote-tracking branch 'origin/main' into HEAD

f227105

# Conflicts: # CHANGELOG.md

Merge remote-tracking branch 'origin/main' into HEAD

0fb67e8

seonghobae marked this pull request as draft August 11, 2026 12:09

Merge remote-tracking branch 'origin/main' into HEAD

aacd5b3

seonghobae marked this pull request as ready for review August 11, 2026 13:13

seonghobae mentioned this pull request Aug 11, 2026

security: fail closed when dependency review is unavailable #76

Open

10 tasks

This was referenced Aug 11, 2026

security: reconstruct exact connection-pool policy boundary on current timeout head #182

Closed

security: require exact connection-pool policy type #116

Open

security: require exact request-timeout policy type #113

Open

This was referenced Aug 12, 2026

security: reconstruct exact connection-count value types on current stack #152

Closed

security: require exact built-in connection-count values #120

Open

seonghobae added 2 commits August 12, 2026 10:00

docs: restore timeout-policy release history

496d817

seonghobae marked this pull request as draft August 12, 2026 18:12

seonghobae mentioned this pull request Aug 14, 2026

security: reject timeout-policy subclasses on the current policy stack #220

Draft

seonghobae closed this Aug 14, 2026

Uh oh!

Conversation

seonghobae commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Exact current identity

Security contract

Historical exact-head proof

Current RCA / feasibility

Remaining acceptance

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

seonghobae commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 12, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 12, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026

Uh oh!

seonghobae commented Aug 12, 2026

Uh oh!

seonghobae commented Aug 12, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 11, 2026 •

edited

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading