gowalk-cicd 1.0.151 → 1.0.153

package/action/.daemux-version

@@ -1 +1 @@
-1.0.151
+1.0.153

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.151
+1.0.153

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.151
+1.0.153

package/backend-action/network_pools.py

@@ -10,7 +10,8 @@ FAILURES = frozenset({
     'pool_provenance_unknown', 'pool_inventory_invalid', 'host_routes_unsupported',
     'host_rules_unsupported', 'host_addresses_invalid', 'resolver_inventory_invalid',
     'resolver_upstream_unknown',
-})
+}) | frozenset('host_rules_unsupported_' + part for part in
+              ('count', 'fields', 'priority', 'source', 'table', 'structure', 'fwmark', 'fwmask', 'action', 'duplicate'))
 PRIVATE = tuple(ipaddress.ip_network(value) for value in ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'))
 DEVICE = re.compile(r'[A-Za-z0-9][A-Za-z0-9_.:-]{0,14}')
 
@@ -195,7 +196,7 @@ def validate_rules(rows):
     """Admit ordinary Linux rules or the exact Tailscale v1.88.2 baseIPRules chain."""
     # https://github.com/tailscale/tailscale/blob/v1.88.2/wgengine/router/router_linux.go
     if not isinstance(rows, list) or len(rows) not in (3, 7):
-        raise InventoryFailure('host_rules_unsupported')
+        raise InventoryFailure('host_rules_unsupported_count')
     expected = [{'priority': p, 'src': 'all', 'table': t}
                 for p, t in ((0, 'local'), (32766, 'main'), (32767, 'default'))]
     if len(rows) == 7:
@@ -203,23 +204,36 @@ def validate_rules(rows):
         expected += [dict(marked, priority=5210, table='main'), dict(marked, priority=5230, table='default'),
                      dict(marked, priority=5250, action='unreachable'), {'priority': 5270, 'src': 'all', 'table': 52}]
     actual = []
-    tables = {255: 'local', 254: 'main', 253: 'default'}
+    # iproute2 iprule.c prints table names/numbers as JSON strings, including Tailscale's "52".
+    tables = {255: 'local', 254: 'main', 253: 'default',
+              '255': 'local', '254': 'main', '253': 'default', '52': 52}
     for row in rows:
-        if (not isinstance(row, dict) or set(row) - {'priority', 'src', 'table', 'protocol',
-                                                   'fwmark', 'fwmask', 'action'}
-                or type(row.get('priority')) is not int or row.get('src') != 'all'):
-            raise InventoryFailure('host_rules_unsupported')
+        if not isinstance(row, dict) or set(row) - {'priority', 'src', 'table', 'protocol',
+                                                   'fwmark', 'fwmask', 'action'}:
+            raise InventoryFailure('host_rules_unsupported_fields')
+        if type(row.get('priority')) is not int:
+            raise InventoryFailure('host_rules_unsupported_priority')
+        if row.get('src') != 'all':
+            raise InventoryFailure('host_rules_unsupported_source')
         normalized = {key: value for key, value in row.items() if key != 'protocol'}
         table = normalized.get('table')
         if table is not None:
             if type(table) not in (str, int):
-                raise InventoryFailure('host_rules_unsupported')
+                raise InventoryFailure('host_rules_unsupported_table')
             normalized['table'] = tables.get(table, table)
-        if normalized not in expected or normalized in actual:
-            raise InventoryFailure('host_rules_unsupported')
+        wanted = next((item for item in expected if item['priority'] == normalized['priority']), None)
+        if wanted is None:
+            raise InventoryFailure('host_rules_unsupported_priority')
+        if set(normalized) != set(wanted):
+            raise InventoryFailure('host_rules_unsupported_structure')
+        for field in ('table', 'fwmark', 'fwmask', 'action'):
+            if normalized.get(field) != wanted.get(field):
+                raise InventoryFailure('host_rules_unsupported_' + field)
+        if normalized in actual:
+            raise InventoryFailure('host_rules_unsupported_duplicate')
         actual.append(normalized)
     if len(actual) != len(expected):
-        raise InventoryFailure('host_rules_unsupported')
+        raise InventoryFailure('host_rules_unsupported_count')
 
 
 def resolver_exclusions(raw, *, resolved=False, records=None):

package/backend-action/test_network_rule_diagnostics.py

@@ -0,0 +1,69 @@
+"""Classify refused policy shapes without publishing their private values or relaxing admission."""
+import copy
+import json
+import os
+import unittest
+from unittest.mock import patch
+
+from network_diagnostics import SCHEMA, decode
+from network_inventory import collect
+from network_pools import InventoryFailure, validate_rules
+from test_network_inventory import FakeHost, RULES
+
+
+class RuleDiagnosticTests(unittest.TestCase):
+    def test_iproute_decimal_table_strings_keep_exact_policy_semantics(self):
+        marked = {'src': 'all', 'fwmark': '0x80000', 'fwmask': '0xff0000'}
+        rules = [dict(row, table=str({'local': 255, 'main': 254, 'default': 253}[row['table']]))
+                 for row in RULES]
+        validate_rules(rules)
+        rules += [dict(marked, priority=5210, table='254'), dict(marked, priority=5230, table='253'),
+                  dict(marked, priority=5250, action='unreachable'),
+                  {'priority': 5270, 'src': 'all', 'table': '52'}]
+        validate_rules(rules)
+        for invalid in ('53', '052', '0x34', 'private table alias', 53, True):
+            changed = copy.deepcopy(rules)
+            changed[-1]['table'] = invalid
+            with self.subTest(table=invalid), self.assertRaises(InventoryFailure) as caught:
+                validate_rules(changed)
+            self.assertEqual(caught.exception.code, 'host_rules_unsupported_table')
+
+    def test_each_rejected_shape_keeps_a_closed_reason_without_values(self):
+        marked = {'src': 'all', 'fwmark': '0x80000', 'fwmask': '0xff0000'}
+        valid = RULES + [dict(marked, priority=5210, table='main'), dict(marked, priority=5230, table='default'),
+                         dict(marked, priority=5250, action='unreachable'),
+                         {'priority': 5270, 'src': 'all', 'table': 52}]
+        validate_rules(valid)
+        cases = [('fields', 'PRIVATE_SENTINEL', 'PRIVATE_SENTINEL'), ('priority', 'priority', True),
+                 ('source', 'src', 'PRIVATE_SENTINEL'), ('table', 'table', 'PRIVATE_SENTINEL'),
+                 ('fwmark', 'fwmark', 'PRIVATE_SENTINEL'), ('fwmask', 'fwmask', 'PRIVATE_SENTINEL')]
+        for reason, key, value in cases:
+            rows = copy.deepcopy(valid)
+            rows[3][key] = value
+            with self.subTest(reason=reason), self.assertRaises(InventoryFailure) as caught:
+                validate_rules(rows)
+            self.assertEqual(caught.exception.code, 'host_rules_unsupported_' + reason)
+            self.assertNotIn('PRIVATE_SENTINEL', str(caught.exception))
+        for rows, reason in ((valid[:-1], 'count'), (valid[:-1] + [valid[0]], 'duplicate'),
+                             ([dict(row, fwmark='0x80000') for row in RULES], 'structure')):
+            with self.subTest(reason=reason), self.assertRaises(InventoryFailure) as caught:
+                validate_rules(rows)
+            self.assertEqual(caught.exception.code, 'host_rules_unsupported_' + reason)
+
+    def test_scoped_diagnostic_retains_reason_and_partial_metadata_only(self):
+        host = FakeHost()
+        host.answers[('ip', '-j', '-4', 'rule', 'show')][0]['src'] = 'PRIVATE_SENTINEL'
+        with patch.dict(os.environ, {}, clear=True), self.assertRaises(InventoryFailure) as caught:
+            collect(host, require_pools=False)
+        failure = caught.exception
+        result = dict(failure.details, schema=SCHEMA, ok=False, project='fixture', failure=failure.code)
+        raw = json.dumps(result).encode()
+        self.assertEqual(decode(1, raw, 'fixture')['failure'], 'host_rules_unsupported_source')
+        self.assertFalse(result['complete'])
+        self.assertNotIn(b'PRIVATE_SENTINEL', raw)
+        self.assertNotIn('networks', result)
+        self.assertFalse(any('create' in call or 'rm' in call for call in host.calls))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/docs/BACKEND_NETWORKS.md

@@ -79,6 +79,12 @@ A routing refusal can retain safe engine/pool metadata with `complete:false` and
 partial evidence never admits allocation. A successful diagnostic is a readback, not a deployment,
 capacity reservation, proof of application health or proof that another project cannot reach the app.
 Raw container data, labels, environment, daemon configuration and command errors are not exported.
+Policy-rule refusals use `host_rules_unsupported_<reason>` to distinguish count, fields, priority,
+source, table, structure, fwmark, fwmask, action and duplicate mismatches. These fixed classifications
+retain the strict supported-rule comparison and publish no rejected keys or values.
+The exact decimal-string spellings of supported table IDs are normalized because
+[iproute2 prints rule tables as JSON strings](https://github.com/iproute2/iproute2/blob/v6.8.0/ip/iprule.c#L370).
+This does not admit additional routing tables, aliases, priorities or forwarding policies.
 
 The deployment emits its own `gowalk-cicd/backend-networks.v1` receipt. The existing
 `backend_deploy_failed` phase remains `compose_up` on a preparation refusal. Normal public health,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.151",
+  "version": "1.0.153",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {