otto 2.6.0 → 2.8.0

data/lib/otto/security/middleware/ip_privacy_middleware.rb

@@ -10,8 +10,20 @@ class Otto
       # Automatically masks IP addresses for privacy by default. Original IPs
       # are never stored unless privacy is explicitly disabled.
       #
-      # This middleware runs FIRST in the stack to ensure all downstream
-      # middleware and application code receives masked IPs by default.
+      # Otto pins this middleware to the OUTERMOST position of the stack (the
+      # :entrypoint tier — see Otto::Core::MiddlewareStack#add_with_position),
+      # so it is the first middleware to touch a request and every other
+      # middleware, plus the application, reads masked IPs by default. Before
+      # #219 it was registered `position: :first`, which is first-in-array and
+      # therefore INNERMOST: only the wrapped app saw masked values while every
+      # other middleware still saw the raw peer address.
+      #
+      # Because it now runs ahead of everything, facts about the ORIGINAL peer
+      # that downstream code can no longer derive from the (masked) REMOTE_ADDR
+      # are recorded first, as leak-free booleans — never as addresses:
+      # env['otto.via_trusted_proxy'] (only when proxy trust is configured —
+      # absent otherwise, see the tri-state note in #call) and
+      # env['otto.peer_loopback'].
       #
       # @example Default behavior (privacy enabled)
       #   # env['REMOTE_ADDR'] is masked to 192.168.1.0
@@ -32,9 +44,6 @@ class Otto
           @app = app
           @security_config = security_config
           @config = security_config&.ip_privacy_config || Otto::Privacy::Config.new
-
-          # Privacy is enabled by default unless explicitly disabled
-          @privacy_enabled = @config.enabled?
         end
 
         # Process request with IP privacy
@@ -46,19 +55,46 @@ class Otto
           # canonical client IP for this request, do not re-resolve or re-mask.
           # This makes stacking two instances (e.g. an app-level mount plus
           # Otto's built-in router mount) order-safe instead of double-masking.
-          return @app.call(env) if env.key?('otto.client_ip')
+          if env.key?('otto.client_ip')
+            ensure_ip_match_present(env)
+            return @app.call(env)
+          end
 
           # Record the connecting peer's trust decision BEFORE any masking, so
           # secure? can authorize X-Forwarded-Proto canonically even after
           # REMOTE_ADDR is rewritten to the masked client IP. Leak-free boolean.
           #
-          # This is the trusted-proxy *identity* check only — it is deliberately
-          # independent of count-based depth mode. Depth resolves the client IP;
-          # it never grants proxy trust for X-Forwarded-Proto (matching the
-          # downstream OneTimeSecret behavior).
-          env['otto.via_trusted_proxy'] = trusted_proxy?(env['REMOTE_ADDR'])
+          # TRI-STATE: the key is written ONLY when the operator configured
+          # proxy trust (CIDR matchers or a depth). Present, its value is
+          # authoritative in both directions — true means the peer matched a
+          # CIDR (filter mode) or depth mode is active (configuring a depth
+          # asserts the connecting peer IS the operator's proxy tier, #226);
+          # false means trust IS configured and this peer failed it. Absent
+          # means no proxy trust is configured at all, so downstream consumers
+          # may fall back to their own heuristics without this key vetoing
+          # them. Writing false on unconfigured deployments made false
+          # ambiguous between "untrusted peer" and "nothing configured", which
+          # forced consumers into grant-only reads (#228).
+          # respond_to?: like geo_headers_trusted?, a partial/duck-typed
+          # config (or nil) that cannot report trust state is "unconfigured".
+          if @security_config.respond_to?(:proxy_trust_configured?) && @security_config.proxy_trust_configured?
+            env['otto.via_trusted_proxy'] = trusted_proxy?(env['REMOTE_ADDR'])
+          end
 
-          if @privacy_enabled
+          # Same rationale, for loopback: this middleware runs outermost, so a
+          # downstream middleware that must authenticate a DIRECT LOCAL CALL
+          # (Otto::CaddyTLS::LocalhostGuard) can no longer read the true socket
+          # peer from REMOTE_ADDR. Record the verdict here, on the untouched
+          # peer, as a boolean — the address itself is never exposed.
+          #
+          # Deliberately the raw peer, NOT the resolved client IP: resolution
+          # honors forwarded headers from trusted proxies, and a co-located
+          # reverse proxy on loopback is itself a natural trusted proxy, so
+          # resolving first would let `X-Forwarded-For: 127.0.0.1` promote a
+          # remote caller to "localhost".
+          env['otto.peer_loopback'] = Otto::Utils.loopback_address?(env['REMOTE_ADDR'])
+
+          if privacy_enabled?
             apply_privacy(env)
           else
             apply_no_privacy(env)
@@ -69,6 +105,56 @@ class Otto
 
         private
 
+        # Whether IP privacy is on for this request.
+        #
+        # Read live from the config rather than cached at construction. Otto
+        # builds its middleware stack at the end of Otto.new, but
+        # configure_ip_privacy stays legal until the first request (the
+        # configuration freeze is deferred — see Otto#initialize). A flag
+        # captured in #initialize would therefore ignore a post-construction
+        # `configure_ip_privacy(profile: :audit)` and keep masking under a
+        # profile the operator explicitly turned off. One predicate call per
+        # request buys that correctness.
+        #
+        # @return [Boolean]
+        def privacy_enabled?
+          @config.enabled?
+        end
+
+        # Guarantee env['otto.ip_match'] exists on the idempotent-return path.
+        #
+        # Every path in this middleware that sets otto.client_ip installs the
+        # capability first, so a second IPPrivacyMiddleware pass that reaches
+        # this guard finds both keys and leaves the precise closure in place.
+        # (The no-resolvable-IP path installs the capability but never sets
+        # otto.client_ip, so a second pass re-runs apply_privacy and reinstalls
+        # an equivalent fail-closed closure — idempotent, since there is nothing
+        # to double-mask.) The gap is out-of-contract writes: otto.client_ip is
+        # documented as "Set by: IPPrivacyMiddleware" (see Otto::EnvKeys), but
+        # an app or test harness that sets it directly trips the idempotency
+        # guard and leaves the advertised capability nil — downstream policy
+        # code then raises NoMethodError on nil.
+        #
+        # The repair installs a fail-closed check, NOT one derived from
+        # env['otto.client_ip']. That value may already be masked, and matching
+        # a masked address against a narrow CIDR produces false ALLOWs (masked
+        # 192.168.1.0 falls inside 192.168.1.0/28 when the real client was
+        # .200). A universal deny is the safe verdict; the warning below is
+        # what makes it diagnosable instead of a silent lockout.
+        #
+        # @param env [Hash] Rack environment
+        def ensure_ip_match_present(env)
+          return if env.key?('otto.ip_match')
+
+          Otto.logger.warn(
+            '[IPPrivacyMiddleware] otto.client_ip was set outside this ' \
+            'middleware, so otto.ip_match could not be built from the ' \
+            'unmasked address; installing a fail-closed check (every CIDR ' \
+            'test returns false). Let IPPrivacyMiddleware resolve the client IP.'
+          )
+          env['otto.ip_match'] = ->(_cidrs) { false }
+        end
+
         # Apply privacy settings to environment
         #
         # @param env [Hash] Rack environment
@@ -77,7 +163,19 @@ class Otto
           # canonical resolution step; masking below operates on this value.
           client_ip = resolve_client_ip(env)
 
-          Otto.logger.debug "[IPPrivacyMiddleware] Resolved client IP: #{client_ip}" if Otto.debug
+          # Install the verdict-only precision capability while client_ip is
+          # still the real address — after this method returns, the raw
+          # material is gone (REMOTE_ADDR and forwarded headers rewritten).
+          install_ip_match(env, client_ip)
+
+          # There is deliberately no debug line for the resolution itself. It
+          # used to interpolate client_ip, which handed back through the log
+          # exactly what these profiles withhold from env — and logs travel
+          # further than a process does. Stripped of the address it carried no
+          # information worth a line: this method only runs on the masking
+          # profiles (:masked / :anonymous), and every branch below already logs
+          # its own outcome. To trace resolution here, log a derived value (the
+          # masked IP, the family, the trusted-proxy verdict) — never the address.
 
           # No resolvable client IP (REMOTE_ADDR absent or blank, and no trusted
           # forwarded value). There is nothing to mask, and masking would derive
@@ -94,9 +192,18 @@ class Otto
           # original sensitive data. So still scrub those headers before
           # bailing — a request with no resolvable IP must not leak an
           # un-anonymized User-Agent or Referer.
+          #
+          # Likewise, forwarded headers may still carry raw client addresses
+          # (e.g. an X-Forwarded-For / Forwarded value with no usable REMOTE_ADDR
+          # to anchor resolution). There is no masked IP to rewrite them to, so
+          # DELETE them — leaving them would leak the raw address downstream.
           if client_ip.to_s.empty?
             Otto.logger.debug '[IPPrivacyMiddleware] No resolvable client IP; skipping IP masking' if Otto.debug
-            scrub_sensitive_headers(env, Otto::Privacy::RedactedFingerprint.new(env, @config))
+            scrub_sensitive_headers(
+              env,
+              Otto::Privacy::RedactedFingerprint.new(env, @config, geo_headers_trusted: geo_headers_trusted?(env))
+            )
+            scrub_forwarded_headers(env)
             return
           end
 
@@ -119,7 +226,13 @@ class Otto
               # localhost / RFC-1918 addresses (the default dev path) even when a
               # correlation_secret is configured. Set mask_private_ips to treat
               # private IPs as public and run them through the full path below.
-              Otto.logger.debug "[IPPrivacyMiddleware] Private/localhost IP exempted: #{client_ip}" if Otto.debug
+              # No address interpolated (see the resolution note at the top of
+              # this method). Exempt IPs skip fingerprinting entirely, so there
+              # is no derived value to log either — the line records only that
+              # the exemption fired. The address is not lost to debugging: this
+              # path leaves REMOTE_ADDR unmasked and sets otto.client_ip to the
+              # same value, so downstream request logs still carry it.
+              Otto.logger.debug '[IPPrivacyMiddleware] Private/localhost IP exempted from masking' if Otto.debug
               return
             end
           end
@@ -128,7 +241,9 @@ class Otto
           # We temporarily set REMOTE_ADDR to the client IP for fingerprint creation
           original_remote_addr = env['REMOTE_ADDR']
           env['REMOTE_ADDR'] = client_ip
-          fingerprint = Otto::Privacy::RedactedFingerprint.new(env, @config)
+          fingerprint = Otto::Privacy::RedactedFingerprint.new(
+            env, @config, geo_headers_trusted: geo_headers_trusted?(env)
+          )
           env['REMOTE_ADDR'] = original_remote_addr
 
           # Set privacy-safe values in environment
@@ -239,6 +354,51 @@ class Otto
           Otto::Utils.resolve_client_ip(env, @security_config)
         end
 
+        # Install env['otto.ip_match']: a verdict-only CIDR membership check
+        # over the resolved, UNMASKED client IP.
+        #
+        # This is the precision axis of the privacy design, decoupled from the
+        # observability axis (the privacy profile): policy code downstream —
+        # e.g. a per-tenant IP allowlist — can ask "is this client inside
+        # these ranges?" at full /32-/128 precision under ANY profile,
+        # including full masking. The unmasked address itself never lands in
+        # env; only this closure does, and a closure serializes to nothing
+        # useful, so env dumps, loggers, and error reporters that walk env
+        # cannot leak the IP accidentally.
+        #
+        # Threat model: the capability is a membership oracle, so deliberate
+        # in-process code could reconstruct the address via adaptive queries —
+        # but in-process code is already trusted (it could monkeypatch this
+        # middleware). The invariant defended is accidental persistence and
+        # serialization, and a Proc preserves it where a raw string could not.
+        #
+        # The closure is installed on every path that resolves an IP (masked,
+        # private-exempt, and privacy-disabled). When the request has no
+        # resolvable client IP the check returns false — fail-closed for
+        # allowlist callers. Invalid CIDR entries raise (configuration error);
+        # see Otto::Utils.ip_in_cidrs?.
+        #
+        # @param env [Hash] Rack environment
+        # @param client_ip [String, nil] resolved, unmasked client IP
+        def install_ip_match(env, client_ip)
+          env['otto.ip_match'] = ->(cidrs) { Otto::Utils.ip_in_cidrs?(client_ip, cidrs) }
+        end
+
+        # Delete forwarded IP headers outright.
+        #
+        # Used on the no-resolvable-client-IP path, where there is no masked IP
+        # to rewrite these to. Leaving them would leak a raw client address (in
+        # X-Forwarded-For / X-Real-IP / X-Client-IP / RFC 7239 Forwarded)
+        # downstream. Deleting is Rack-SPEC-safe: an absent CGI key is valid.
+        #
+        # @param env [Hash] Rack environment
+        def scrub_forwarded_headers(env)
+          env.delete('HTTP_X_FORWARDED_FOR')
+          env.delete('HTTP_X_REAL_IP')
+          env.delete('HTTP_X_CLIENT_IP')
+          env.delete('HTTP_FORWARDED')
+        end
+
         # Mask X-Forwarded-For and related proxy headers
         #
         # Replaces forwarded IP headers with the masked IP to prevent leakage
@@ -261,19 +421,64 @@ class Otto
           env['HTTP_X_REAL_IP'] = masked_ip if env['HTTP_X_REAL_IP']
           env['HTTP_X_CLIENT_IP'] = masked_ip if env['HTTP_X_CLIENT_IP']
 
+          # RFC 7239 Forwarded carries the client IP in a structured `for=`
+          # token, and Otto reads it as an authoritative client-IP source in
+          # count-based depth mode (trusted_proxy_header 'Forwarded'/'Both').
+          # Left as-is it would leak the real IP to downstream code. Redact only
+          # the `for=` value(s) so proto=/host=/by= metadata survives.
+          if env['HTTP_FORWARDED']
+            env['HTTP_FORWARDED'] = Otto::Privacy::IPPrivacy.mask_forwarded_for(env['HTTP_FORWARDED'], masked_ip)
+          end
+
           Otto.logger.debug "[IPPrivacyMiddleware] Masked forwarded headers" if Otto.debug
         end
 
-        # Check if an IP is from a trusted proxy
+        # Check if the connecting peer counts as a trusted proxy
+        #
+        # CIDR filter mode checks the peer's identity against the configured
+        # matchers. Count-based depth mode has no enumerable matchers — the
+        # depth setting itself is the operator's assertion that the peer is
+        # their proxy tier — so an active depth grants peer trust outright
+        # (#226). Geo-header trust is unaffected: geo_headers_trusted? gates on
+        # trusted_proxies_configured?, which stays matcher-only.
         #
         # @param ip [String] IP address to check
         # @return [Boolean] true if IP is from a trusted proxy
         def trusted_proxy?(ip)
           return false unless @security_config
+          return true if @security_config.trusted_proxy_depth_mode?
 
           @security_config.trusted_proxy?(ip)
         end
 
+        # Whether request geo headers may be trusted for this request.
+        #
+        # Geo headers (CF-IPCountry and friends, plus any app-configured header)
+        # are client-spoofable unless the request actually arrived through the
+        # CDN/proxy that sets them. So Otto trusts them ONLY when it can verify
+        # that origin: a request that arrived via a configured CIDR trusted
+        # proxy (identity checked against REMOTE_ADDR).
+        #
+        # Every other case is untrusted, and geo falls to the local database /
+        # custom resolver:
+        # - Count-based depth mode: the hop setting the header can't be verified
+        #   as a geo-CDN (depth proxies are often plain load balancers), and
+        #   depth configures no CIDR matchers, so trusted_proxies_configured? is
+        #   false here too.
+        # - No trusted-proxy configuration: the header is client-supplied and
+        #   unverifiable. Deployments behind a real CDN should configure
+        #   trusted_proxies (or a local database) to get header-based geo.
+        #
+        # @param env [Hash] Rack environment
+        # @return [Boolean]
+        def geo_headers_trusted?(env)
+          sc = @security_config
+          return false unless sc.respond_to?(:trusted_proxies_configured?)
+          return false unless sc.trusted_proxies_configured?
+
+          env['otto.via_trusted_proxy'] == true
+        end
+
         # Apply no-privacy settings (privacy explicitly disabled)
         #
         # When privacy is disabled, original IP is available for
@@ -284,7 +489,12 @@ class Otto
           # Resolve the canonical client IP once, even with privacy disabled, so
           # downstream code can read env['otto.client_ip'] instead of re-deriving
           # it from REMOTE_ADDR / forwarded headers.
-          env['otto.client_ip'] = resolve_client_ip(env)
+          client_ip = resolve_client_ip(env)
+          env['otto.client_ip'] = client_ip
+
+          # Same precision capability as the privacy-enabled paths, so policy
+          # code has one interface regardless of profile.
+          install_ip_match(env, client_ip)
 
           # Store original values for explicit access when privacy is disabled
           if env['REMOTE_ADDR']

data/lib/otto/security/rate_limiter.rb

@@ -80,9 +80,15 @@ class Otto
         # Log blocked requests if ActiveSupport is available
         return unless defined?(ActiveSupport::Notifications)
 
+        # Rack::Attack is mounted by the hosting app AHEAD of Otto, so this
+        # subscriber sees the raw peer regardless of where IPPrivacyMiddleware
+        # sits in Otto's own stack. Log a masked address, never req.ip: a
+        # deployment on the default :masked profile must not write raw client
+        # IPs to its logs every time a limit trips (issue #219).
         ActiveSupport::Notifications.subscribe('rack.attack') do |_name, _start, _finish, _request_id, payload|
           req = payload[:request]
-          Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{req.ip}: #{payload[:matched]}"
+          ip  = Otto::LoggingHelpers.privacy_safe_ip(req.env, req.ip)
+          Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{ip}: #{payload[:matched]}"
         end
       end
     end

data/lib/otto/utils.rb

@@ -320,5 +320,105 @@ class Otto
     rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
       false
     end
+
+    # Whether an address falls inside any of the given CIDR ranges.
+    #
+    # The general-purpose CIDR-set matcher (allowlists, denylists, network
+    # zones), sharing the semantics of the trusted-proxy matcher: the client
+    # address is normalized (port stripped, validated) and folded via
+    # IPAddr#native so an IPv4-mapped IPv6 peer (::ffff:203.0.113.7) matches
+    # an IPv4 range; ranges of the other address family are skipped rather
+    # than raising.
+    #
+    # Ranges are folded through #native too, so the fold is symmetric: a
+    # mapped-IPv6 CIDR (::ffff:10.0.0.0/104) matches a plain IPv4 client just
+    # as a mapped client matches a plain IPv4 range. Folding only one side
+    # made the family check reject the pair and silently drop the entry —
+    # wrong verdict, not a raise. #native returns self for ranges that are
+    # not IPv4-mapped/compatible, so ordinary IPv4 and IPv6 CIDRs are
+    # untouched, and it returns a new IPAddr rather than mutating, so
+    # pre-parsed entries in a caller's configuration array stay intact.
+    #
+    # The fold needs the prefix to cover the mapped marker — /96 or longer.
+    # ::ffff:10.0.0.0/104 folds to 10.0.0.0/8; ::ffff:10.0.0.0/64 does not
+    # fold at all, because masking zeroes the ffff marker, and so matches
+    # neither an IPv4 client nor a mapped one. Write mapped ranges at /96+,
+    # or just write the IPv4 CIDR. ::ffff:0:0/96 is the whole mapped space
+    # and therefore matches every IPv4 address. Deprecated IPv4-compatible
+    # notation (::a.b.c.d) folds on the same terms, on both sides.
+    #
+    # Asymmetric strictness, on purpose:
+    # - `ip` is runtime data — nil, blank, or malformed input returns false
+    #   (fail-closed for allowlist callers).
+    # - `cidrs` entries are configuration — an invalid CIDR string raises
+    #   IPAddr::InvalidAddressError, because silently skipping an entry
+    #   narrows an allowlist or widens a denylist. Validate entries at
+    #   write/boot time; pre-parsed IPAddr entries skip re-parsing here.
+    #
+    # @param ip [String, IPAddr, nil] address to test (runtime data)
+    # @param cidrs [Enumerable<String, IPAddr>, nil] CIDR ranges or host
+    #   addresses (configuration)
+    # @return [Boolean] true when ip is inside at least one range
+    # @raise [IPAddr::InvalidAddressError] if a cidrs entry is not a valid
+    #   IP or CIDR string
+    def ip_in_cidrs?(ip, cidrs)
+      return false if cidrs.nil?
+
+      client =
+        if ip.is_a?(IPAddr)
+          ip.native
+        else
+          candidate = normalize_ip(ip&.to_s)
+          return false unless candidate
+
+          IPAddr.new(candidate).native
+        end
+
+      cidrs.any? do |entry|
+        range = entry.is_a?(IPAddr) ? entry : IPAddr.new(entry.to_s)
+        # IPAddr#native builds its result with #clone, which carries frozen
+        # state over and then fails to mutate it. Callers who freeze their
+        # range configuration (or pass it through Ractor.make_shareable) would
+        # hit FrozenError, so hand #native an unfrozen receiver. Gating the dup
+        # on a foldable-range predicate would cost more than it saves:
+        # #ipv4_compat? is deprecated and warns under -w, and #native already
+        # short-circuits to self for anything that does not fold.
+        range = range.dup if range.frozen?
+        range = range.native
+        range.family == client.family && range.include?(client)
+      end
+    end
+
+    # Whether an address is on the loopback interface.
+    #
+    # This is the RAW SOCKET PEER test used to authenticate a direct local call
+    # (Otto::CaddyTLS::LocalhostGuard) — and, because IPPrivacyMiddleware now
+    # runs outermost and rewrites REMOTE_ADDR, the same test IPPrivacyMiddleware
+    # applies to the original peer and records as the leak-free boolean
+    # env['otto.peer_loopback']. Shared here so the pre-masking record and the
+    # guard's own fallback cannot drift.
+    #
+    # Fails closed: a blank or unparseable value is non-loopback rather than
+    # raising on the hot path.
+    #
+    # #native folds IPv4-mapped IPv6 (::ffff:127.0.0.1, which dual-stack servers
+    # commonly present) so it is recognized as loopback; plain IPAddr#loopback?
+    # returns false for the mapped form.
+    #
+    # Deliberately does NOT strip a ':port' suffix (unlike #private_ip?): a
+    # conforming Rack server reports the peer port in REMOTE_PORT, so an
+    # unexpected format means something upstream is non-standard and denying is
+    # safer than coercing.
+    #
+    # @param address [String, nil] raw socket peer address
+    # @return [Boolean]
+    def loopback_address?(address)
+      addr = address.to_s.strip
+      return false if addr.empty?
+
+      IPAddr.new(addr).native.loopback?
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      false
+    end
   end
 end

data/lib/otto/version.rb

@@ -3,5 +3,5 @@
 # frozen_string_literal: true
 
 class Otto
-  VERSION = '2.6.0'
+  VERSION = '2.8.0'
 end

data/lib/otto.rb

@@ -226,11 +226,19 @@ class Otto
     # before first request (before configuration freezing)
     finalize_request_response_classes
 
-    # Add IP Privacy middleware first in stack (privacy by default for public IPs)
-    # Private/localhost IPs are automatically exempted from masking
+    # IP Privacy is the ENTRY POINT of the stack: the first middleware to touch
+    # a request, so everything else — Otto's own middleware, an :outermost pin,
+    # and anything the app adds via Otto#use — observes the masked REMOTE_ADDR
+    # and the canonical env['otto.client_ip'] (privacy by default for public
+    # IPs; private/localhost IPs are automatically exempted from masking).
+    #
+    # NOT position: :first, which is first-in-ARRAY and therefore INNERMOST —
+    # it put IP masking closest to the app and left every other middleware
+    # reading the raw peer address (issue #219). See
+    # MiddlewareStack#add_with_position for the full position vocabulary.
     @middleware.add_with_position(
       Otto::Security::Middleware::IPPrivacyMiddleware,
-      position: :first
+      position: :entrypoint
     )
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: otto
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.8.0
 platform: ruby
 authors:
 - Delano Mandelbaum
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-10 00:00:00.000000000 Z
+date: 2026-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -144,6 +144,9 @@ files:
 - changelog.d/README.md
 - changelog.d/scriv.ini
 - docs/.gitignore
+- docs/1108-STREAMING_ARCHITECTURE_ANALYSIS.md
+- docs/1108-STREAMING_SUPPORT_SUMMARY.md
+- docs/geo-country.md
 - docs/ipaddr-encoding-quirk.md
 - docs/migrating/v2.0.0-pre1.md
 - docs/migrating/v2.0.0-pre2.md