fix(network): bind socket port to canonical origin

[seonghobae]

Partial hardening of the direct-network authority stack, stacked on exact PR #54 head 8b8a5b443ad4620613b79f381db3fbe4d5a5f994.

Buyer/security and reliability gaps

A fresh resolution approves an exact address, not every service port on that address. FreshConnectionPlan therefore binds the requested socket port to the canonical origin's effective HTTP/HTTPS port. During this pass two adjacent malformed-input ordering defects were also proven and fixed:

• socket port zero was misclassified as OriginPortMismatch instead of InvalidPort; and
• zero/over-limit timeout or attempt settings were evaluated only after resolution membership and origin-port authority, allowing malformed input to be misdiagnosed by unrelated authority state.

Live dependency alignment

This branch remains non-destructively aligned with exact #54 head 8b8a5b443ad4620613b79f381db3fbe4d5a5f994. Current exact contributor head is 63576fb8e6594b47db2b0de6244b262f0aebc401; GitHub reports the Draft mergeable. Keep Draft while #54/#50/#47 remain active. No prerequisite check, review, mergeability, or approval evidence transfers.

Test-first RCA and remedy

1. Zero-port test-only head 0d0fbba7fc42d31cc3b2b0d8f6f9d2eab742b968 passed setup boundaries then failed in CI 31939622147 because the result was not NetworkError::InvalidPort. Production moved malformed zero-port validation ahead of resolution/origin authority.
2. Hostile settings test-only head 8d27a44b4e9f2cc206f45d31016f9853c2ce7f75 required zero timeout and zero attempt count to fail before both wrong-origin-port and unapproved-address state. CI 31940046251 reached those focused tests and proved the malformed settings were being masked by authority decisions.
3. Production added the same public timeout and attempt-count bounds used by ConnectionPlan before resolution authorization and port matching. An intermediate head passed semantics but exposed canonical rustfmt and one exact branch-coverage gap.
4. Current head exercises both lower and upper invalid bounds through FreshConnectionPlan::new: zero and MAX_CONNECT_TIMEOUT + 1ns, plus zero and MAX_CONNECTION_ATTEMPTS + 1. No production gate or limit was weakened.

The final constructor order is input shape (port, timeout, attempts) → fresh-resolution authorization → canonical origin-port equality → exact ConnectionPlan creation. It still performs no DNS lookup or socket I/O during admission.

Exact-current proof

On unchanged exact head 63576fb8e6594b47db2b0de6244b262f0aebc401:

• CI run 31940961006: success;
• Rust contracts: repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc success under Rust 1.97.1;
• Production coverage: exact owned production function/line/region/branch enforcement success;
• no submitted formal reviews are returned;
• no inline review threads are returned; and
• GitHub reports the Draft mergeable against the exact live prerequisite.

Security/SAST/central/model workflows not returned for this stacked Draft are absent and are not represented as passing. No predecessor-head, prerequisite-head, queued, skipped, cancelled, stale, synthetic, status-only, or model-only evidence is promoted.

Truth boundary

This is deterministic plan admission and error-classification hardening only. It performs no DNS lookup, socket I/O before admission, TLS/HTTP exchange, proxy/PAC selection, persistence, secret/model work, or release action. Later integrated paths must still compose exact peer verification, TLS identity, HTTP authority, browser policy, and post-condition evidence. The scheduled actor does not merge or self-approve.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ad91ee1f-171b-436a-816d-92646c36ae4d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}