fix(network): align destination checks for direct connections

crates/openshell-supervisor-network/src/policy_dns/mod.rs

@@ -373,7 +373,10 @@ fn eligible_endpoints(
             continue;
         }
         let raw_allowed_ips = value_string_array(&endpoint.endpoint, "allowed_ips");
-        let exact_declared_host = !pattern.contains('*') && pattern == name.as_str();
+        let exact_declared_host = !pattern.contains('*')
+            && pattern == name.as_str()
+            && value_field(&endpoint.endpoint, "advisor_proposed")
+                != Some(&regorus::Value::Bool(true));
         let destination_plan = build_validation_plan(
             name.as_str(),
             name.as_str(),
@@ -1126,6 +1129,68 @@ process: { run_as_user: sandbox, run_as_group: sandbox }
         assert!(matches!(result, Err(PolicyDnsError::NoValidAddress)));
     }
 
+    #[tokio::test]
+    async fn advisor_endpoints_filter_private_answers_without_losing_public_or_explicit_ips() {
+        for protocol in [
+            "",
+            "tcp",
+            "rest, access: read-only",
+            "rest, access: read-only, tls: skip",
+        ] {
+            for (family, private, public) in [
+                (AddressFamily::Ipv4, "10.2.3.4", "8.8.8.8"),
+                (AddressFamily::Ipv6, "fd12::4", "2001:4860:4860::8888"),
+            ] {
+                let private = private.parse::<IpAddr>().unwrap();
+                let public = public.parse::<IpAddr>().unwrap();
+                let yaml = BASE_POLICY.replace(
+                    "protocol: tcp",
+                    &format!("protocol: {protocol}, advisor_proposed: true"),
+                );
+                let yaml = yaml.replace("protocol: , ", "");
+                let private_only = service(&yaml, vec![private]);
+                assert!(
+                    matches!(
+                        private_only
+                            .answer_query("db.example", family, Instant::now())
+                            .await,
+                        Err(PolicyDnsError::NoValidAddress)
+                    ),
+                    "{protocol}: {private}"
+                );
+                for addresses in [vec![public], vec![private, public]] {
+                    let service = service(&yaml, addresses);
+                    let now = Instant::now();
+                    let answer = service
+                        .answer_query("db.example", family, now)
+                        .await
+                        .unwrap();
+                    let mapping = service
+                        .store
+                        .lookup(answer.address, 5432, answer.policy_generation, now)
+                        .unwrap();
+                    assert_eq!(mapping.record.contracts[0].pinned_addresses, [public]);
+                }
+                // Explicit narrow address permission retains its usual precedence.
+                let yaml = yaml.replace(
+                    "advisor_proposed: true",
+                    &format!("advisor_proposed: true, allowed_ips: ['{private}']"),
+                );
+                let service = service(&yaml, vec![private, public]);
+                let now = Instant::now();
+                let answer = service
+                    .answer_query("db.example", family, now)
+                    .await
+                    .unwrap();
+                let mapping = service
+                    .store
+                    .lookup(answer.address, 5432, answer.policy_generation, now)
+                    .unwrap();
+                assert_eq!(mapping.record.contracts[0].pinned_addresses, [private]);
+            }
+        }
+    }
+
     #[tokio::test]
     async fn allowed_ips_filters_each_answer_without_rejecting_usable_addresses() {
         let yaml =

crates/openshell-supervisor-network/src/policy_dns/store.rs

@@ -84,15 +84,26 @@ pub(crate) struct MappingLookup {
 }
 
 impl MappingLookup {
-    pub(crate) fn pinned_addresses(&self) -> Vec<IpAddr> {
+    /// Select only contracts authorized for this process and destination port.
+    pub(crate) fn pinned_addresses_for(
+        &self,
+        endpoint_ids: &[PolicyEndpointId],
+    ) -> Result<Vec<IpAddr>, MappingLookupError> {
         let mut seen = HashSet::new();
-        self.record
+        let addresses = self
+            .record
             .contracts
             .iter()
-            .filter(|contract| contract.port == self.port)
+            .filter(|contract| {
+                contract.port == self.port && endpoint_ids.contains(&contract.endpoint_id)
+            })
             .flat_map(|contract| contract.pinned_addresses.iter().copied())
             .filter(|address| seen.insert(*address))
-            .collect()
+            .collect::<Vec<_>>();
+        if addresses.is_empty() {
+            return Err(MappingLookupError::EndpointMismatch);
+        }
+        Ok(addresses)
     }
 
     pub(crate) fn endpoint_ids(&self) -> impl Iterator<Item = &PolicyEndpointId> {
@@ -112,18 +123,7 @@ impl MappingLookup {
         &self,
         endpoint_id: &PolicyEndpointId,
     ) -> Result<UpstreamConnector, MappingLookupError> {
-        let mut seen = HashSet::new();
-        let addresses = self
-            .record
-            .contracts
-            .iter()
-            .filter(|contract| contract.port == self.port && &contract.endpoint_id == endpoint_id)
-            .flat_map(|contract| contract.pinned_addresses.iter().copied())
-            .filter(|address| seen.insert(*address))
-            .collect::<Vec<_>>();
-        if addresses.is_empty() {
-            return Err(MappingLookupError::EndpointMismatch);
-        }
+        let addresses = self.pinned_addresses_for(std::slice::from_ref(endpoint_id))?;
         let plan = build_pinned_validation_plan(addresses)
             .map_err(|_| MappingLookupError::InvalidMapping)?;
         validate_destination(DestinationRequest {
@@ -735,7 +735,10 @@ mod tests {
             .lookup_intent(observed.synthetic_address, 443, 1, now)
             .unwrap();
         assert_eq!(intent.record.normalized_name.as_str(), "unknown.example");
-        assert!(intent.pinned_addresses().is_empty());
+        assert!(matches!(
+            intent.pinned_addresses_for(&[]),
+            Err(MappingLookupError::EndpointMismatch)
+        ));
         assert!(matches!(
             store.lookup_intent(observed.synthetic_address, 443, 2, now),
             Err(MappingLookupError::StalePolicy)
@@ -1021,6 +1024,54 @@ mod tests {
         assert_eq!(connector.addrs(), &["203.0.113.8:5432".parse().unwrap()]);
     }
 
+    #[tokio::test]
+    async fn endpoint_selection_unions_authorized_contracts_only_and_binds_connector() {
+        let store = store(1);
+        let now = Instant::now();
+        let mut request = request("must-not-resolve.invalid", 1, Duration::from_secs(5));
+        let first = request.contracts[0].clone();
+        let mut second = first.clone();
+        second.endpoint_id.endpoint_index = 1;
+        second.pinned_addresses = vec!["203.0.113.9".parse().unwrap(), first.pinned_addresses[0]];
+        let mut unrelated = first.clone();
+        unrelated.endpoint_id.policy_name = "other-binary".to_string();
+        unrelated.pinned_addresses = vec!["10.2.3.4".parse().unwrap()];
+        let mut other_port = second.clone();
+        other_port.port = 443;
+        other_port.pinned_addresses = vec!["203.0.113.10".parse().unwrap()];
+        request
+            .contracts
+            .extend([second.clone(), unrelated.clone(), other_port]);
+        let record = store.publish(request, 1, now).unwrap();
+        let lookup = store
+            .lookup(record.synthetic_address, 5432, 1, now)
+            .unwrap();
+        assert_eq!(
+            lookup
+                .pinned_addresses_for(&[first.endpoint_id.clone(), second.endpoint_id])
+                .unwrap(),
+            [
+                "203.0.113.8".parse::<IpAddr>().unwrap(),
+                "203.0.113.9".parse().unwrap()
+            ]
+        );
+        let connector = lookup.connector_for(&first.endpoint_id).await.unwrap();
+        assert_eq!(connector.addrs(), &["203.0.113.8:5432".parse().unwrap()]);
+        assert!(matches!(
+            lookup
+                .connector_for(&PolicyEndpointId {
+                    policy_name: "absent".to_string(),
+                    endpoint_index: 0
+                })
+                .await,
+            Err(MappingLookupError::EndpointMismatch)
+        ));
+        assert!(matches!(
+            lookup.pinned_addresses_for(&[]),
+            Err(MappingLookupError::EndpointMismatch)
+        ));
+    }
+
     #[tokio::test]
     async fn connector_preserves_resolver_address_order_while_deduplicating() {
         let store = store(1);