security: bind special-purpose address decisions to reviewed IANA registry

[seonghobae]

Purpose

Reconstruct the unique special-purpose IP registry compatibility delta from stale/diverged Draft #173 directly on exact protected main without transferring historical checks, reviews, approvals, base identity, or mergeability.

Python's ipaddress classification tables evolve with interpreter maintenance releases, while EgressWeave supports a Python version matrix and must keep destination authorization stable. The current IANA IPv4 and IPv6 Special-Purpose Address Space registries remain the authoritative reviewed source for the bounded compatibility overlay.

Exact identity and test-first lineage

• protected/live base: 7faf7a3b8a47980113982914000e724ab6a6cda5;
• RED-only head: 8312a000197eabd7d7d3d7433f6341263c79f031;
• GREEN production head: 26be254deb11be6d5ff1bb10f35e9e70395b91be;
• exact final head: 811ba846757adb44dfc648b9b13761aa1536a110;
• stale predecessor security: reconstruct special-purpose IP policy on current main #173 head: 74211307bf83d8089ca0c935a8a6664ca897ffce.

Hosted RED run 31785513013 failed on Python 3.10–3.14 exactly on the new compatibility contracts. The Python 3.14.6 lane reported 1,032 passing tests and 22 intended failures, demonstrating that the prior implementation depended on interpreter-version is_private / is_global metadata.

The final test/documentation correction accounts for 2001:2::/48 being denied through the reviewed broader 2001::/23 implementation range rather than requiring a redundant source literal.

Implemented boundary

• add a static, code-reviewed compatibility overlay derived from the IANA IPv4/IPv6 Special-Purpose registries;
• apply the most-specific global exceptions before reviewed non-global parent ranges;
• recursively classify IPv4-mapped IPv6 addresses through the underlying IPv4 address;
• retain current local-host, private-container, authority, DNS pinning/revalidation, TLS, proxy, request/response, credential, and generic-denial boundaries;
• perform no runtime registry download or mutable external lookup;
• document the source registry, deliberate 2002::/16 CPython compatibility decision, update procedure, and local-development non-widening contract.

Exact-head verification

Exact head 811ba846757adb44dfc648b9b13761aa1536a110:

• CI succeeded on Python 3.10, 3.11, 3.12, 3.13, and 3.14;
• Python 3.14.7 lane: 1,049 tests passed;
• production coverage: 1,773 / 1,773 statements and 598 / 598 branches (100%);
• Ruff, compileall, hourly product-guard self-test, wheel/sdist build, archive verification, and installed-wheel smoke test succeeded;
• current-head SAST Semgrep succeeded;
• current-head Security Scan wrapper succeeded, but dependency-review job 94723408440 skipped the actual pinned Dependency review step, so the aggregate green wrapper is not accepted as substantive supply-chain evidence;
• no formal current-head reviews have been submitted yet.

Authoritative registries:

• https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
• https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml

Merge contract

Keep Draft. Do not merge until:

1. .github#897 integrates and a fresh exact-head Security Scan executes the actual pinned Dependency Review action successfully;
2. .github#965 integrates and Strix provides authoritative exact-head evidence rather than unavailable, neutral, metadata-less, or mismatched evidence;
3. all current-head review findings are resolved;
4. qualifying independent formal approvals satisfy protected-branch policy; and
5. exact head, base, ancestry, checks, reviews, threads, and rulesets are revalidated immediately before protected merge.

Progresses #95. Supersedes #173; historical predecessor evidence is intentionally not transferred.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7bc5c108-02aa-4b4c-a913-5c3f0a086492

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact head 811ba846757adb44dfc648b9b13761aa1536a110. Validate the hosted RED→GREEN lineage, reviewed IANA/CPython overlay ordering, IPv4-mapped recursion, local-development non-widening boundary, source/documentation alignment, and exact-head 1,049-test / 100% statement-and-branch evidence.

[seonghobae]

@opencode-agent

Please perform a fresh exact-head semantic review of 811ba846757adb44dfc648b9b13761aa1536a110. Verify the RED evidence, current registry grounding, most-specific exception ordering, mapped-address behavior, fail-closed local boundary, and documentation truthfulness. Submit a formal current-head verdict; do not infer approval from CI wrappers.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 28 minutes and 13 seconds before sending another message.

[seonghobae]

@cwl-noema-review

After a qualifying exact-head OpenCode verdict, independently review 811ba846757adb44dfc648b9b13761aa1536a110. Confirm the compatibility overlay is deliberately bounded, reproducible, source-grounded, and does not widen local or authority policy.

[seonghobae]

Current-head source review for 811ba846757adb44dfc648b9b13761aa1536a110 found no blocking defect in the five-file special-purpose registry compatibility scope. The implementation applies reviewed most-specific IANA global exceptions before broader non-global compatibility ranges, recursively classifies IPv4-mapped IPv6 through the underlying IPv4 policy, preserves the narrower local-development authority path, performs no runtime registry lookup, and keeps ordinary stdlib classification for addresses outside the bounded overlay. The documented overlay matches the current IANA registries last updated 2025-10-09, including the 2001::/23 exception structure and current 192.0.0.0/24 exceptions. This is author-side review evidence only, not independent approval. Keep Draft until corrected central Dependency Review and authoritative Strix evidence run on the unchanged head and qualifying independent review exists.

[seonghobae]

@cwl-noema-review review

Review exact current head 811ba846757adb44dfc648b9b13761aa1536a110 against protected main@7faf7a3b8a47980113982914000e724ab6a6cda5. Validate the bounded IANA special-purpose compatibility overlay, most-specific global exceptions before non-global parents, IPv4-mapped recursion, local-development non-widening, static source-controlled registry provenance, and Python 3.10–3.14 decision stability. Submit a formal independent verdict only for this head. Do not mutate, merge, or promote wrapper-green supply-chain evidence while the actual Dependency Review action is skipped.