fix(core): reject non-digit origin port prefixes

CHANGELOG.md

@@ -52,6 +52,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - State-changing actions are same-origin by default.
 - R3 and R4 approvals are bound to the exact action, target origin, and immutable digest of the complete canonical action intent; R5 legal consent is non-delegable.
 - Shortened, integer, hexadecimal, and legacy octal-looking IPv4 host spellings are rejected so the policy origin cannot diverge from Chromium host interpretation.
+- Explicit origin ports must contain ASCII decimal digits before numeric parsing, matching the WHATWG URL Standard port-state syntax and preventing Rust-only signed spellings such as a leading `+` from creating a browser/parser authority mismatch.
 - IPv4-mapped IPv6 is canonicalized before destination classification and pin comparison so mapped private or loopback addresses cannot bypass IPv4 policy.
 - The default destination policy permits only public addresses and denies unspecified, loopback, private, shared, link-local, metadata, documentation, benchmarking, multicast, broadcast, transition, and protocol-reserved destinations.
 - Azure platform IP `168.63.129.16` and Amazon EKS Pod Identity endpoints `169.254.170.23` and `fd00:ec2::23` are classified as metadata or platform services before broader public, link-local, or unique-local rules.
@@ -75,4 +76,8 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - The hourly product agent has no Git metadata or repository authority. A separate post-verification publisher opens one PR and cannot approve or merge it.
 - The unprivileged OpenCode user is restricted to loopback egress during model execution, preventing runner-wide allow-listed endpoints from becoming direct source-exfiltration channels.
 
+### References
+
+Web Hypertext Application Technology Working Group. (2026). *URL standard*. https://url.spec.whatwg.org/
+
 [Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD

crates/originweave-core/src/lib.rs

@@ -165,6 +165,9 @@ fn parse_bracketed_ipv6(authority: &str) -> Result<(String, Option<u16>, bool),
 }
 
 fn parse_port(port_text: &str) -> Result<u16, OriginError> {
+    if port_text.is_empty() || !port_text.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(OriginError::InvalidPort);
+    }
     let port = port_text
         .parse::<u16>()
         .map_err(|_error| OriginError::InvalidPort)?;

crates/originweave-core/tests/origin_port_syntax.rs

@@ -0,0 +1,18 @@
+use originweave_core::{Origin, OriginError};
+
+#[test]
+fn origin_rejects_non_digit_port_prefixes() {
+    for input in [
+        "https://example.com:+443",
+        "https://example.com:+8443",
+        "http://localhost:+80",
+        "http://127.0.0.1:+8080",
+        "https://[2001:db8::1]:+443",
+    ] {
+        assert_eq!(
+            Origin::parse(input),
+            Err(OriginError::InvalidPort),
+            "input={input}"
+        );
+    }
+}