gowalk-cicd 1.0.152 → 1.0.153

package/action/.daemux-version

@@ -1 +1 @@
-1.0.152
+1.0.153

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.152
+1.0.153

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.152
+1.0.153

package/backend-action/network_pools.py

@@ -204,7 +204,9 @@ def validate_rules(rows):
         expected += [dict(marked, priority=5210, table='main'), dict(marked, priority=5230, table='default'),
                      dict(marked, priority=5250, action='unreachable'), {'priority': 5270, 'src': 'all', 'table': 52}]
     actual = []
-    tables = {255: 'local', 254: 'main', 253: 'default'}
+    # iproute2 iprule.c prints table names/numbers as JSON strings, including Tailscale's "52".
+    tables = {255: 'local', 254: 'main', 253: 'default',
+              '255': 'local', '254': 'main', '253': 'default', '52': 52}
     for row in rows:
         if not isinstance(row, dict) or set(row) - {'priority', 'src', 'table', 'protocol',
                                                    'fwmark', 'fwmask', 'action'}:

package/backend-action/test_network_rule_diagnostics.py

@@ -12,6 +12,22 @@ from test_network_inventory import FakeHost, RULES
 
 
 class RuleDiagnosticTests(unittest.TestCase):
+    def test_iproute_decimal_table_strings_keep_exact_policy_semantics(self):
+        marked = {'src': 'all', 'fwmark': '0x80000', 'fwmask': '0xff0000'}
+        rules = [dict(row, table=str({'local': 255, 'main': 254, 'default': 253}[row['table']]))
+                 for row in RULES]
+        validate_rules(rules)
+        rules += [dict(marked, priority=5210, table='254'), dict(marked, priority=5230, table='253'),
+                  dict(marked, priority=5250, action='unreachable'),
+                  {'priority': 5270, 'src': 'all', 'table': '52'}]
+        validate_rules(rules)
+        for invalid in ('53', '052', '0x34', 'private table alias', 53, True):
+            changed = copy.deepcopy(rules)
+            changed[-1]['table'] = invalid
+            with self.subTest(table=invalid), self.assertRaises(InventoryFailure) as caught:
+                validate_rules(changed)
+            self.assertEqual(caught.exception.code, 'host_rules_unsupported_table')
+
     def test_each_rejected_shape_keeps_a_closed_reason_without_values(self):
         marked = {'src': 'all', 'fwmark': '0x80000', 'fwmask': '0xff0000'}
         valid = RULES + [dict(marked, priority=5210, table='main'), dict(marked, priority=5230, table='default'),

package/docs/BACKEND_NETWORKS.md

@@ -82,6 +82,9 @@ Raw container data, labels, environment, daemon configuration and command errors
 Policy-rule refusals use `host_rules_unsupported_<reason>` to distinguish count, fields, priority,
 source, table, structure, fwmark, fwmask, action and duplicate mismatches. These fixed classifications
 retain the strict supported-rule comparison and publish no rejected keys or values.
+The exact decimal-string spellings of supported table IDs are normalized because
+[iproute2 prints rule tables as JSON strings](https://github.com/iproute2/iproute2/blob/v6.8.0/ip/iprule.c#L370).
+This does not admit additional routing tables, aliases, priorities or forwarding policies.
 
 The deployment emits its own `gowalk-cicd/backend-networks.v1` receipt. The existing
 `backend_deploy_failed` phase remains `compose_up` on a preparation refusal. Normal public health,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.152",
+  "version": "1.0.153",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {