Requirements and security invariants 

This chapter connects the original design with today's single extension. Original text, statuses and measurements remain in immutable Git history; this overview explains the current contract and test layout. Historical IDs do not claim that all 84 old scenarios have passed again against the current source. Source-bound current executions are recorded under Verification report and Assessment reconciliation.

The design contains eight invariants, 45 IDs HG-001–HG-045 and 84 scenarios T001–T084 (74 P0, ten P1). HG-006 now means a framework-independent kernel embedded in one extension; the revised packaging decision is under ADR-0015: One installable extension.

Current security contract 

  • INV-01: Every connection uses only validated IPs from its current connection plan.
  • INV-02: Scheme, host, port, method, endpoint profile and policy revision bind the plan; changes invalidate it.
  • INV-03: Invalid targets, missing IPs or unsafe runtime conditions fail before contact in enforce.
  • INV-04: Internal grants require an explicitly bound client and endpoint.
  • INV-05: Redirects and retries are checked again; a URL is no lasting authorization.
  • INV-06: Policies combine restrictions; denial takes precedence over permissions.
  • INV-07: Grants, pins and connections cannot cross request, client or policy boundaries.
  • INV-08: Unprotected modes and paths outside integration receive no protection claim.

Original requirement ID overview 

Short topics and mappings come from the immutable requirement ledger. The scenario column preserves its mapping without introducing new statuses.

Requirement ID and short topic Original scenarios
HG-001: Outgoing HTTP extension point T001
HG-002: Guard before each native send T002, T003, T004, T083
HG-003: Default enforce and fail closed T005, T006
HG-004: No implicit internal grants T005
HG-005: Separate supported Core targets T001, T041, T082
HG-006: Framework-independent embedded kernel T007
HG-007: Shared strict URL normalization T008, T010
HG-008: Reject ambiguous or non-HTTP targets T009, T010, T011, T012
HG-009: Effective authority binding T004, T013
HG-010: Binary address classification T014, T015, T016, T020
HG-011: Deny special-purpose networks T014, T015, T017, T018, T019, T020
HG-012: Operator CIDR deny precedence T021
HG-013: Check every A/AAAA candidate T022, T023, T028
HG-014: Verified resolution required T024, T025, T026, T027
HG-015: Only validated connection plans T026, T027, T029, T030, T033, T084
HG-016: Pin complete permitted address sets T030, T031, T032
HG-017: Explicit endpoint/client binding T025, T027, T034, T035, T036, T037, T038, T081
HG-018: No user-controlled grants T034, T035, T036
HG-019: Cumulative Core and endpoint restrictions T002, T004, T021, T039, T083
HG-020: Reject unsafe transport options T040, T041
HG-021: Controlled cURL capabilities T042
HG-022: Detect and reject proxy routes T043, T044
HG-023: Recheck each redirect T045, T046, T048, T049, T051, T081
HG-024: Restrict redirected credentials T046, T047, T048, T050
HG-025: Recheck retries without implicit budget T052
HG-026: Isolate native DNS and connection caches T053, T054, T055, T084
HG-027: Bound verified memoization T056, T057
HG-028: Refuse generic streaming fallback T058
HG-029: Deliberate streaming adapter T059, T060
HG-030: Cancellation and cleanup T060, T061
HG-031: Typed synchronous and asynchronous errors T062
HG-032: Redacted and bounded reporting T063, T064
HG-033: Visible observe/disabled limits T065, T066
HG-034: Offline diagnostics T067
HG-035: URL check grants no reusable authority T068
HG-036: Deliberate external Vault integration T069, T070
HG-037: Preserve external Vault semantics T059, T060, T070, T071, T072
HG-038: Legacy allowlists grant no global access T039, T073
HG-039: Actual no-contact witnesses T074
HG-040: Concurrent and long-worker isolation T053, T054, T075
HG-041: Shared corpus with explicit integration scope T074, T076
HG-042: Declare uncovered paths T003, T006, T077
HG-043: Explicit versioned migration T038, T066, T073, T080
HG-044: Document time and memory bounds T028, T057, T078, T079, T082
HG-045: Reproducible qualified regressions T076, T080

Current test and build entry points 

These groups cover every original scenario ID and identify current checks for the same topics. Unit, genuine Core, wire, mutation and performance results remain distinct; a filename does not establish execution. The short test names below refer to Tests/Unit/, Tests/HttpGuard/Unit/Policy/ or Tests/HttpGuard/Unit/Transport/; filenames end in .php.

  • T001–T007: CoreStackProviderContractTest, RequestFactoryAbiContractTest, GuardConfigurationBoundaryContractTest; genuine Core paths under Tests/Functional/, preparation under Build/Fixtures/.
  • T008–T021: TargetAuthorityBoundaryContractTest, CidrMembershipBoundaryContractTest and AddressRulesBoundaryContractTest.
  • T022–T033: ResolverAnswerBoundaryContractTest and PolicyPlanBoundaryContractTest; actual DNS and pinning under Tests/HttpGuard/Integration/DnsPolicyTransportTest.php.
  • T034–T044: ClientFactoryContractTest, OptionSanitizerContractTest and MiddlewareRegistryContractTest; native option/proxy boundaries under Tests/HttpGuard/Integration/ProductionTransportTest.php.
  • T045–T057: InvocationLifecycleTest and ResolverResidualCacheContractTest; redirects, retries and isolation in ProductionTransportTest.php.
  • T058–T064: TransferLeaseLifecycleContractTest, TransferLeaseRuntimeBoundaryContractTest and DecisionReporterContractTest. The Vault portions of T059–T061 retain external historical qualification.
  • T065–T073: DiagnosticsContractTest, CommandContractTest, ManagedAuthenticationContractTest and Tests/Functional/mode-bootstrap.php. T070–T072 require Vault; kernel tests do not replace its complete suite.
  • T074–T077: Actual no-contact/concurrency witnesses in integration tests and versioned corpus under Resources/Private/HttpGuard/data/. T076's Vault portion remains historical; T077 describes uncovered paths.
  • T078–T084: WireDnsQueryTest, ManagedAuthenticationContractTest and CoreStackProviderContractTest; policy benchmark under Build/Scripts/benchmark-policy.php, mutation via infection.native.json5 and .github/workflows/verification.yml.

T079's named CI policy measurement is under Assessment reconciliation. It is not an end-to-end HTTP benchmark. Historical targeted mutants and global Infection MSI scores remain distinct evidence. The optional Vault reference under Optional nr-vault migration is outside this production extension and does not establish a freshly executed release of the external project.

Maintained source-bound reports are under Build/Reports/Assessment/completion/reconciliation.json; current tests are under Tests/ and tools under Build/. These development files are not TER runtime dependencies.

Immutable historical sources 

The 28 original specification files and raw receipts remain at commit 3f929ae8794ca04ab3dd25627e94d601a2db23e0 and in the verified external source archive (SHA-256 below). This manual does not copy conflicting old API proposals or historical passing statuses.

2e417da29df5348e284a93f1db96b2a067426dc5ce4e7ee74f978375d6eb34c9