security: reconstruct scalar integer sealing on current protected main

[seonghobae]

Purpose

Reconstruct issue #122 and superseded PR #159 directly on the current protected main. Historical #159 evidence does not transfer.

Exact current identity

• protected/live base: 29773ef81203c65878c14aeb66bb1dc2284cb331;
• exact current head: 7ad948eb2f1df25831c9c7e671f287df939892ab;
• current-tree refresh: merged protected main into the existing PR branch without force-push or destructive rebase;
• state: open / Ready, with fresh hosted Checks queued.

Security boundary

The source requires exact built-in integer values at shared allowed-port, DNS-count, positive-count, and positive-byte-count normalization while preserving reviewed ASCII decimal-string configuration and existing range/default/authority semantics. Focused tests reject integer subclasses at all shared policy integer fields and preserve exact integer/string equivalence.

Exact current-head local proof

The prior local proof was for predecessor aca7d0f7; it is not transferred. Fresh exact-head validation is required after the current-main merge. The central dependency-review prerequisite remains separately governed.

Do not self-approve, Admin-merge, bypass, or auto-merge.

Summary by CodeRabbit

• 보안

  • 정책 설정에서 정확한 기본 정수와 기존 ASCII 십진수 문자열만 허용합니다.
  • bool 및 정수 하위 클래스는 포트와 리소스 제한 값으로 사용할 수 없습니다.

• 문서

  • 정책 설정의 정수 값 검증 규칙과 잘못된 설정 처리 방식을 문서화했습니다.

• 버그 수정

  • 정책 설정 값이 의도하지 않은 정수 유형으로 저장되는 문제를 방지합니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f90619a-bb84-4be0-944a-32a37454217b

📥 Commits

Reviewing files that changed from the base of the PR and between 29773ef and 7ad948e.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/research/policy-configuration-integrity.md
• src/egressweave/_policy_normalization.py
• tests/test_policy_integer_value_types.py

---

📝 Walkthrough

Walkthrough

정책 정규화가 정확한 내장 int만 허용하도록 변경되었다. int 하위 클래스와 bool은 거부된다. ASCII 십진수 문자열, 기본값, 범위 검증 동작은 유지된다. 회귀 테스트와 무결성 문서가 추가되었다.

Changes

정책 정수 입력 무결성

Layer / File(s)	Summary
정수 입력 정규화 변경 src/egressweave/_policy_normalization.py	포트, DNS 주소 수, 개수 및 바이트 제한 필드가 정확한 내장 int만 허용한다. int 하위 클래스와 bool은 거부된다.
무결성 회귀 검증과 문서화 tests/test_policy_integer_value_types.py, docs/research/policy-configuration-integrity.md, CHANGELOG.md	정수 하위 클래스 거부, 내장 int와 ASCII 십진수 문자열의 동등한 정규화, 권한 포트 동작 및 관련 문서 내용을 검증한다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• security: seal normalized integer policy values before runtime retention #122 — 동일한 정책 정수 정규화 규칙을 다룬다.
• security: require exact authority-pair containers before indexed normalization #133 — 다른 정책 값 컨테이너에서 하위 타입 입력을 제한하는 동일한 경계 강화와 관련된다.
• security: require exact built-in connection-count values #120 — 정책의 정수 정규화에서 정확한 정수와 십진수 문자열을 유지하면서 하위 클래스를 거부하는 목표가 같다.

Possibly related PRs

• ContextualWisdomLab/EgressWeave#149 — 다른 정책 구성 요소에서 구체적인 내장 타입을 요구하는 경계 강화와 관련된다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보호된 main에서 스칼라 정수 봉인을 재구성한 보안 변경을 명확하게 설명하며 주요 변경 사항과 일치합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/reconstruct-policy-integer-values-a7fe3a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please review exact current head 65485ee196699ecb5a8451621d188afdd8731bf6 over live protected main 52a5c6a0862e0d035b0698b79a0e8556269e0b00. There is no current formal review or inline review thread on this exact head. Validate the exact current diff only; do not transfer predecessor-head evidence.

[coderabbitai]

@seonghobae I will review only the diff from 52a5c6a0862e0d035b0698b79a0e8556269e0b00 to 65485ee196699ecb5a8451621d188afdd8731bf6. I will not transfer predecessor-head evidence.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please review only exact current head 65485ee196699ecb5a8451621d188afdd8731bf6 against live protected main 52a5c6a0862e0d035b0698b79a0e8556269e0b00. The PR body still contains predecessor evidence for 2730ef688cff5a2e9d253374121061f8aae2dd4a; do not transfer that review/check identity. Focus on exact built-in integer sealing across shared policy normalizers, preservation of reviewed ASCII decimal strings/ranges/defaults/authority semantics, documentation parity, and interaction with stacked #184.

[coderabbitai]

@seonghobae I will review only the diff from 52a5c6a0862e0d035b0698b79a0e8556269e0b00 to 65485ee196699ecb5a8451621d188afdd8731bf6.

I will not use review or check evidence from 2730ef688cff5a2e9d253374121061f8aae2dd4a.

I will check built-in integer sealing in the shared policy normalizers. I will also check ASCII decimal-string handling, ranges, defaults, authority semantics, documentation parity, and the interaction with stacked #184.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Current-head refresh complete: protected main 1d2e19049354115776804c66b9366fad2ea5b6c5 was merged into aca7d0f7b99cdc7f10be711cddc9f686c459088f without force-push. Python 3.14 proof: 944 passed, 100% production statement/branch coverage (1704/1704, 576/576), Ruff, product-guard self-test, compileall, and CodeGraph sync. Draft remains pending fresh hosted evidence and the central fail-closed dependency-review repair; no self/Admin/bypass merge.

[seonghobae]

Exact-head refresh for 7ad948eb2f1df25831c9c7e671f287df939892ab over current protected main 29773ef81203c65878c14aeb66bb1dc2284cb331:

• current main was merged into the existing PR branch; the only conflict was CHANGELOG entry composition, resolved by retaining both security entries;
• Python 3.14: 964 passed; Python 3.10: 964 passed;
• coverage: 1713/1713 statements and 578/578 branches, 100%, zero misses/partials;
• Ruff, compileall, hourly product guard self-test, uv build wheel/sdist, and git diff --check passed;
• all predecessor evidence is intentionally superseded; fresh hosted exact-head Checks are still pending.

No runtime scope beyond exact built-in integer policy-value sealing was added. No self-approval, Admin merge, bypass, or auto-merge was used.