[johntmyers]

Summary

Keep policy DNS address selection consistent with endpoint decisions for direct connections. Apply destination checks to selected address candidates before constructing upstream connectors.

Changes

• Preserve endpoint metadata when preparing DNS mappings.
• Select address candidates from matching endpoint contracts and reuse destination validation.
• Preserve address ordering and deduplication across compatible rules.
• Extend IPv4, IPv6, and per-executable regression coverage.
• Preserve the Python installation prefix for copied test executables.

Testing

Prior local validation:

• Network unit suite: 1,537 passed, 2 ignored.
• Component Clippy, formatting, and commit hooks passed.
• Docker transparent-TCP compatibility passed.
• Copied Python probes verified in the workload image.

Pending:

• CI validation against current main.
• Podman live regression.

Checklist

• Unit and E2E coverage added
• Commits signed off
• CI passes

[github-actions]

Label test:e2e applied, but pull-request/5004 does not exist yet. A maintainer needs to comment /ok to test c58d3368448ff12c4c40c83fd4843386054120cb to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. policy — No explicit risk acceptance found

Hostless allowed_ips rules previously authorized mapped hostname connections, but transparent TCP now requires the caller to match a hosted endpoint in the DNS record.

• Impact: Mediated clients receive InvalidDestination when another binary's hosted rule supplies the DNS mapping, even when both rules explicitly allow its resolved IPs.
• Action: Restore hostless allowed_ips access to trusted DNS pins while enforcing the caller's explicit allowlist, since this train prohibits removing Stable policy behavior.
• PR: fix(network): align destination checks for direct connections #5004

Review details

• Execution: complete
• Candidate: PR #5004 (0cc0e0e652c3feb47548a12579ceb503dbfc35b5)
• Baseline: 9f1cdb4ef6ed6be9fd86507580f9656b61b9c754 (9f1cdb4ef6ed6be9fd86507580f9656b61b9c754)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run