Declare internet egress #385

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

An Application author writes egress: internet with a reason, and the Process reaches public addresses and nothing on the tailnet, the LAN or the cluster. Settled in Decide how the model meets the live needs no chapter covers (item 16) and Decide which conditions on the settled decisions change the model (decision 14). Makes ready, with the Move: tribelt, notes and automation.

Acceptance criteria

• egress: internet is a closed vocabulary with a required reason and no destinations. No admission is required.
• It renders an allow to 0.0.0.0/0 except a fixed set: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, 169.254.0.0/16 and 127.0.0.0/8. No range is authored, and the rule reads no Platform fact.
• Chapter 16 states two limits: IPv6 is not allowed, and traffic to a pod's own node is always allowed.
• The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
• A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
• Each refusal has a refusal example with its diagnostics file.
• The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
• The behaviour-ledger row lands with its test, and npm run verify passes.

Blocked by

• Cut what the map cut and release package 1.0.0