fix(network): bind socket port to canonical origin

[seonghobae]

Partial hardening of the direct-network authority stack, stacked on exact PR #54 head 8030c6d843a0f860b465c15b06c822d4c9b47831.

Buyer/security and reliability gaps

A fresh resolution approves an exact address, not every service port on that address. FreshConnectionPlan therefore binds the requested socket port to the canonical origin's effective HTTP/HTTPS port. The branch also closes adjacent input-ordering and freshness-timing defects:

• socket port zero is classified as InvalidPort, not an unrelated origin-port authority failure;
• invalid timeout/attempt settings are rejected before resolution membership and origin-port decisions; and
• the compatibility connect() path anchors elapsed monotonic time at the start of plan authorization, so time spent completing plan construction cannot be omitted from the freshness budget.

Live dependency alignment

Current exact prerequisite #50 head is 44c9fef65a009c814266b03fe07116449b616420. Current exact contributor head is 14cd1bdbae7462b18ec5bfa2b453f32851e9b9c6.

Fresh exact compare reports ahead 51 / behind 0, with merge base exactly the live prerequisite. GitHub reports the PR open, Draft, and mergeable. Keep Draft while #50 remains active. Closed PR #54 is no longer a dependency; its socket-use freshness behavior is absorbed here on top of #50. No prerequisite check, review, mergeability, coverage, or approval evidence transfers.

Test-first RCA and repair lineage

1. Zero-port test-only head 0d0fbba7fc42d31cc3b2b0d8f6f9d2eab742b968 proved the prior wrong OriginPortMismatch classification in CI 31939622147.
2. Hostile-settings test-only head 8d27a44b4e9f2cc206f45d31016f9853c2ce7f75 proved malformed timeout/attempt inputs were being masked by unrelated authority decisions in CI 31940046251.
3. Production moved public input-shape validation ahead of destination/origin authority and added effective-origin-port binding.
4. A later freshness review proved the process-local compatibility anchor was created only after constructor admission completed, so elapsed time inside that admission path could be omitted. A focused regression now starts the Instant, deliberately consumes more than the resolution validity interval before plan completion, and requires connect() to fail as DestinationError::ResolutionApprovalExpired before socket I/O.
5. Exact CI 32068058981 then exposed only strict-Clippy defects in that new regression (for_loops_over_fallibles). Subsequent repair exposed canonical rustfmt drift, and workspace policy also forbids test panic!. The current test uses an Option error-source chain with no panic/catch-all suppression, preserving the typed destination error proof.

No production gate, freshness limit, timeout limit, attempt limit, or fail-closed behavior was weakened.

Current restack evidence

On exact current head 14cd1bdbae7462b18ec5bfa2b453f32851e9b9c6 against exact prerequisite 44c9fef65a009c814266b03fe07116449b616420:

• the prerequisite merged without conflicts and the contributor delta remains limited to the same five files;
• fresh ancestry is ahead 51 / behind 0, with merge base exactly the live prerequisite;
• cargo test --locked --workspace --all-features: the complete Rust workspace and doctests passed;
• strict all-target/all-feature Clippy and no-dependency rustdoc passed;
• formal reviews and inline review threads currently returned: none; and
• GitHub reports the Draft mergeable against its exact live prerequisite.

Exact-head CI for this restack is pending. The prior head's successful CI is historical evidence only and is not promoted as current proof. Security/SAST/central/model workflows absent from this stacked Draft are not passing evidence. No predecessor-head, prerequisite-head, queued, cancelled, stale, synthetic, status-only, or model-only result is promoted as current proof.

Truth boundary

This slice is deterministic fresh-resolution/direct-socket plan admission and immediate-use hardening. It performs no DNS lookup, hostname reconnect, TLS/HTTP exchange, proxy/PAC selection, browser control, persistence, secret/model work, or release action. Later integrated paths must still compose trusted resolution, exact peer verification, TLS identity, HTTP authority, browser policy, typed action, and observed post-condition evidence.

Passing automation is not independent approval. This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}