gowalk-cicd 1.0.154 → 1.0.156

package/action/.daemux-version

@@ -1 +1 @@
-1.0.154
+1.0.156

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.154
+1.0.156

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.154
+1.0.156

package/backend-action/action.yml

@@ -18,6 +18,10 @@ inputs:
     description: UTC YYYY-MM-DDTHH:MM:SSZ within the previous 24 hours; required for diagnostics.
     required: false
     default: ""
+  diagnostic-provider:
+    description: Optional fixed metadata source for network-diagnostics (none or digitalocean).
+    required: false
+    default: none
   host:
     description: SSH host of the deploy server.
     required: false
@@ -264,11 +268,13 @@ runs:
         DIAGNOSTIC_APP: ${{ inputs.app-name }}
         DIAGNOSTIC_HOST: ${{ inputs.host }}
         DIAGNOSTIC_USER: ${{ inputs.ssh-user }}
+        DIAGNOSTIC_PROVIDER: ${{ inputs.diagnostic-provider }}
       run: |
         RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-network-diagnostics.XXXXXX")"
         echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
         python3 "${{ github.action_path }}/network_diagnostics.py" \
           --app "$DIAGNOSTIC_APP" --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" \
+          --provider "$DIAGNOSTIC_PROVIDER" \
           --output "$RESULT_DIR/result.json"
 
     - name: Retain backend network diagnostics

package/backend-action/network_diagnostics.py

@@ -9,13 +9,16 @@ import shlex
 
 from identity_diagnostics import ReaderFailure, bounded, retain_result
 from network_pools import FAILURES as INVENTORY_FAILURES
+from network_selected_receipt import validate_selected
+from network_provider import validate_provider
 
-SCHEMA = 'gowalk-cicd/backend-network-diagnostics.v1'
-MODULES = ('identity_diagnostics', 'network_runtime', 'network_pools', 'network_inventory')
+SCHEMA = 'gowalk-cicd/backend-network-diagnostics.v2'
+MODULES = ('identity_diagnostics', 'network_runtime', 'network_pools', 'network_inventory',
+           'network_readback', 'network_selected', 'network_provider')
 FAILURES = INVENTORY_FAILURES | frozenset({'network_inventory_unverified', 'network_command_unavailable', ''})
 
 
-def remote_source(app):
+def remote_source(app, host='', provider='none'):
     """Send only package-owned Python sources; no environment, source checkout or private inputs."""
     sources = {name: Path(__file__).with_name(name + '.py').read_text() for name in MODULES}
     program = '''import json, sys, types
@@ -26,6 +29,8 @@ for name, source in sources.items():
     exec(compile(source, name + '.py', 'exec'), module.__dict__)
 from network_inventory import collect, InventoryFailure
 from network_runtime import run, NetworkFailure
+from network_selected import selected_validation
+from network_provider import observe
 result = {'schema': SCHEMA, 'ok': False, 'project': APP, 'failure': ''}
 try:
     inventory = collect(run, require_pools=False)
@@ -36,19 +41,24 @@ try:
                     'pool_failure', 'pools', 'observed_at')})
     result.update(ok=True, complete=True, network_count=len(inventory['networks']),
                   excluded_subnets=inventory['excluded'],
+                  host_identity=observe(inventory, HOST) if PROVIDER == 'digitalocean' else
+                  {'provider': 'none', 'status': 'not_requested'},
                   networks=[{'id': n['Id'], 'name': n['Name'], 'driver': n['Driver'],
                              'key': n['Labels'].get('com.docker.compose.network', ''),
                              'subnets': [p['Subnet'] for p in n['IPAM']['Config']],
-                             'endpoints': len(n['Containers'])} for n in own])
+                             'endpoints': len(n['Containers']),
+                             'validation': selected_validation(inventory, n, APP)} for n in own])
 except (InventoryFailure, NetworkFailure) as error:
-    result['failure'] = error.code
+    result = {'schema': SCHEMA, 'ok': False, 'project': APP, 'failure': error.code}
     result.update(getattr(error, 'details', {}))
 except Exception:
-    result['failure'] = 'network_inventory_unverified'
+    result = {'schema': SCHEMA, 'ok': False, 'project': APP, 'failure': 'network_inventory_unverified'}
 print(json.dumps(result, separators=(',', ':')))
 sys.exit(0 if result['ok'] else 1)
 '''
-    return program.replace('SCHEMA', repr(SCHEMA)).replace('APP', repr(app)).replace('SOURCES', repr(sources)).encode()
+    program = program.replace('SCHEMA', repr(SCHEMA)).replace('APP', repr(app))
+    return program.replace('HOST', repr(host)).replace('PROVIDER', repr(provider)).replace(
+        'SOURCES', repr(sources)).encode()
 
 
 def decode(status, raw, app):
@@ -57,7 +67,7 @@ def decode(status, raw, app):
     except (ValueError, TypeError):
         raise ReaderFailure('remote_invalid') from None
     allowed = {'schema', 'ok', 'project', 'failure', 'docker_version', 'compose_version', 'python_version',
-               'pool_source',
+               'pool_source', 'host_identity',
                'pool_failure', 'pools', 'observed_at', 'complete', 'network_count', 'excluded_subnets', 'networks'}
     if (not isinstance(result, dict) or set(result) - allowed or result.get('schema') != SCHEMA
             or result.get('project') != app or type(result.get('ok')) is not bool
@@ -107,16 +117,19 @@ def validate_inventory(result):
         if not isinstance(result.get(field), list) or len(result[field]) > limit:
             raise ReaderFailure('remote_invalid')
     try:
+        if result.get('host_identity') != {'provider': 'none', 'status': 'not_requested'}:
+            validate_provider(result.get('host_identity'))
         for value in result['excluded_subnets']:
             ipaddress.IPv4Network(value, strict=True)
         for network in result['networks']:
-            validate_network(network, result['project'])
+            validate_network(network, result)
     except (ValueError, TypeError, KeyError):
         raise ReaderFailure('remote_invalid') from None
 
 
-def validate_network(network, project):
-    if (not isinstance(network, dict) or set(network) != {'id', 'name', 'driver', 'key', 'subnets', 'endpoints'}
+def validate_network(network, inventory):
+    fields = {'id', 'name', 'driver', 'key', 'subnets', 'endpoints', 'validation'}
+    if (not isinstance(network, dict) or set(network) != fields
             or not isinstance(network['id'], str) or not re.fullmatch('[0-9a-f]{64}', network['id'])
             or not isinstance(network['name'], str) or not re.fullmatch('[A-Za-z0-9_.-]{1,256}', network['name'])
             or not isinstance(network['key'], str) or not re.fullmatch('[A-Za-z0-9_.-]{0,128}', network['key'])
@@ -125,19 +138,22 @@ def validate_network(network, project):
             or not isinstance(network['subnets'], list) or len(network['subnets']) > 64):
         raise ValueError()
     for value in network['subnets']:
+        if not isinstance(value, str):
+            raise ValueError()
         ipaddress.ip_network(value, strict=True)
+    validate_selected(network['validation'], network, inventory)
 
 
-def diagnose(app, host, user):
+def diagnose(app, host, user, provider='none'):
     if (not re.fullmatch(r'[a-z0-9][a-z0-9-]{0,79}', app)
             or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9.-]{0,252}', host)
-            or not re.fullmatch(r'[a-z_][a-z0-9_-]{0,31}', user)):
+            or not re.fullmatch(r'[a-z_][a-z0-9_-]{0,31}', user) or provider not in ('none', 'digitalocean')):
         raise ReaderFailure('invalid_destination')
     remote = shlex.join(['python3', '-'])
     argv = ['ssh', '-i', str(Path.home() / '.ssh/backend_deploy'), '-o', 'IdentitiesOnly=yes',
             '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', '-o', 'ServerAliveInterval=5',
             '-o', 'ServerAliveCountMax=2', user + '@' + host, remote]
-    status, raw = bounded(argv, payload=remote_source(app), seconds=60, with_status=True)
+    status, raw = bounded(argv, payload=remote_source(app, host, provider), seconds=60, with_status=True)
     return decode(status, raw, app)
 
 
@@ -146,10 +162,11 @@ def main():
     parser.add_argument('--app', required=True)
     parser.add_argument('--host', required=True)
     parser.add_argument('--user', default='root')
+    parser.add_argument('--provider', choices=('none', 'digitalocean'), default='none')
     parser.add_argument('--output', required=True)
     args = parser.parse_args()
     try:
-        result = diagnose(args.app, args.host, args.user)
+        result = diagnose(args.app, args.host, args.user, args.provider)
     except Exception as error:
         code = error.code if isinstance(error, ReaderFailure) else 'network_diagnostic_unverified'
         result = {'schema': SCHEMA, 'ok': False, 'project': args.app, 'failure': code}

package/backend-action/network_prepare.py

@@ -122,7 +122,8 @@ def prepare(config, app, *, reader=collect, owner_reader=ownership_inventory, co
                 inventory = reader(command, require_pools=False)
                 if inventory.get('pool_failure'):
                     raise NetworkFailure(inventory['pool_failure'])
-                if not re.fullmatch(r'v?2\.\d+\.\d+', inventory['compose_version']):
+                # Compose 2 and 5 reuse a project network that carries no config-hash label (docs/BACKEND_NETWORKS.md).
+                if not re.fullmatch(r'v?(?:2|5)\.\d+\.\d+', inventory['compose_version']):
                     raise NetworkFailure('compose_version_unsupported')
                 rows.append(create_one(plan, inventory, reader, command))
                 inventory = reader(command, require_pools=False)

package/backend-action/network_provider.py

@@ -0,0 +1,213 @@
+"""Optional fixed DigitalOcean metadata readback; identity evidence never delegates Docker address space."""
+import ipaddress
+import re
+import socket
+import time
+
+ORIGIN = ('169.254.169.254', 80)
+PATHS = {
+    'droplet_id': '/metadata/v1/id',
+    'region': '/metadata/v1/region',
+    'public_ipv4': '/metadata/v1/interfaces/public/0/ipv4/address',
+    'private_ipv4': '/metadata/v1/interfaces/private/0/ipv4/address',
+    'netmask': '/metadata/v1/interfaces/private/0/ipv4/netmask',
+    'private_gateway': '/metadata/v1/interfaces/private/0/ipv4/gateway',
+}
+IDENTITY = ('droplet_id', 'region', 'public_ipv4', 'private_ipv4', 'private_subnet', 'private_gateway')
+PRIVATE = tuple(ipaddress.IPv4Network(value) for value in ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'))
+REASONS = {
+    'verified': {''},
+    'mismatch': {'public_address_mismatch', 'public_address_unobserved', 'private_address_mismatch'},
+    'unavailable': {'metadata_missing', 'metadata_unavailable', 'metadata_timeout'},
+    'unverified': {'expected_host_unverified', 'host_inventory_unverified',
+                   'metadata_invalid', 'metadata_response_limit'},
+}
+
+
+class MetadataFailure(ValueError):
+    pass
+
+
+def _timeout(deadline):
+    remaining = deadline - time.monotonic()
+    if remaining <= 0:
+        raise MetadataFailure('metadata_timeout')
+    return remaining
+
+
+def _headers(connection, deadline):
+    raw = bytearray()
+    while not raw.endswith(b'\r\n\r\n'):
+        if len(raw) >= 8192:
+            raise MetadataFailure('metadata_response_limit')
+        connection.settimeout(_timeout(deadline))
+        value = connection.recv(1)
+        if not value:
+            raise MetadataFailure('metadata_invalid')
+        raw.extend(value)
+    lines = bytes(raw[:-4]).split(b'\r\n')
+    if len(lines) > 17:
+        raise MetadataFailure('metadata_response_limit')
+    match = re.fullmatch(rb'HTTP/1\.[01] ([1-5][0-9]{2})(?: [\x20-\x7e]*)?', lines[0])
+    if not match:
+        raise MetadataFailure('metadata_invalid')
+    if match[1] != b'200':
+        raise MetadataFailure('metadata_missing' if match[1] == b'404' else 'metadata_unavailable')
+    headers = {}
+    for line in lines[1:]:
+        match = re.fullmatch(rb"([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*([\x20-\x7e\t]*)", line)
+        if not match or match[1].lower() in headers:
+            raise MetadataFailure('metadata_invalid')
+        headers[match[1].lower()] = match[2].strip()
+    if b'transfer-encoding' in headers or headers.get(b'content-encoding', b'identity') != b'identity':
+        raise MetadataFailure('metadata_invalid')
+    length = headers.get(b'content-length')
+    if length is not None and not re.fullmatch(rb'[0-9]{1,3}', length):
+        raise MetadataFailure('metadata_invalid')
+    if length is not None and int(length) > 128:
+        raise MetadataFailure('metadata_response_limit')
+    return None if length is None else int(length)
+
+
+def _fetch(path, deadline):
+    """One HTTP/1.0 request, no proxy, DNS, redirect, authentication, discovery or retry."""
+    if path not in PATHS.values():
+        raise MetadataFailure('metadata_invalid')
+    deadline = min(deadline, time.monotonic() + 2)
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as connection:
+        connection.settimeout(_timeout(deadline))
+        connection.connect(ORIGIN)
+        connection.settimeout(_timeout(deadline))
+        request = 'GET ' + path + ' HTTP/1.0\r\nHost: 169.254.169.254\r\nConnection: close\r\n\r\n'
+        connection.sendall(request.encode('ascii'))
+        length = _headers(connection, deadline)
+        body = bytearray()
+        limit = 129 if length is None else length
+        while len(body) < limit:
+            connection.settimeout(_timeout(deadline))
+            value = connection.recv(limit - len(body))
+            if not value:
+                break
+            body.extend(value)
+        _timeout(deadline)
+        if len(body) > 128:
+            raise MetadataFailure('metadata_response_limit')
+        if length is not None and len(body) != length:
+            raise MetadataFailure('metadata_invalid')
+        return bytes(body)
+
+
+def _address(value):
+    if not isinstance(value, str):
+        raise ValueError()
+    address = ipaddress.IPv4Address(value)
+    if str(address) != value:
+        raise ValueError()
+    return address
+
+
+def _identity(values):
+    if (not re.fullmatch(r'[1-9][0-9]{0,19}', values['droplet_id'])
+            or not re.fullmatch(r'[a-z][a-z0-9-]{1,31}', values['region'])):
+        raise ValueError()
+    _address(values['public_ipv4'])
+    private, gateway = _address(values['private_ipv4']), _address(values['private_gateway'])
+    subnet = ipaddress.IPv4Network(values['private_subnet'], strict=True)
+    if (str(subnet) != values['private_subnet'] or subnet.prefixlen > 30
+            or not any(subnet.subnet_of(space) for space in PRIVATE)
+            or any(address not in subnet or address in (subnet.network_address, subnet.broadcast_address)
+                   for address in (private, gateway)) or private == gateway):
+        raise ValueError()
+
+
+def _read_values(fetch, deadline):
+    values = {}
+    for field, path in PATHS.items():
+        leaf_deadline = min(deadline, time.monotonic() + 2)
+        _timeout(leaf_deadline)
+        raw = fetch(path, leaf_deadline)
+        _timeout(leaf_deadline)
+        if not isinstance(raw, bytes):
+            raise MetadataFailure('metadata_invalid')
+        if len(raw) > 128:
+            raise MetadataFailure('metadata_response_limit')
+        values[field] = raw.decode('ascii').strip(' \t\r\n')
+    mask = values.pop('netmask')
+    mask_network = ipaddress.IPv4Network('0.0.0.0/' + mask)
+    if str(mask_network.netmask) != mask:
+        raise ValueError()
+    values['private_subnet'] = str(ipaddress.IPv4Network(values['private_ipv4'] + '/' + mask, strict=False))
+    _identity(values)
+    return values
+
+
+def _binding(inventory, values, expected_host):
+    records = inventory['host_records']
+    bridges = {'docker0'}
+    for network in inventory['networks']:
+        if network['Driver'] == 'bridge':
+            bridges.add('br-' + network['Id'][:12])
+            bridges.add((network.get('Options') or {}).get('com.docker.network.bridge.name', ''))
+    facts = {}
+    for row in records:
+        facts.setdefault((row['kind'], row['subnet']), set()).add(row['device'])
+    if values['public_ipv4'] != expected_host:
+        return 'public_address_mismatch', 'unverified'
+    public = facts.get(('address_local', values['public_ipv4'] + '/32'), set())
+    if len(public) != 1 or public & bridges or any(not device or device.startswith('br-') for device in public):
+        return 'public_address_unobserved', 'unverified'
+    local = facts.get(('address_local', values['private_ipv4'] + '/32'), set())
+    network = facts.get(('address_network', values['private_subnet']), set())
+    if (len(local) != 1 or local != network or local & bridges
+            or any(not device or device.startswith('br-') for device in local)):
+        return 'private_address_mismatch', 'unverified'
+    gateways = facts.get(('route_gateway', values['private_gateway'] + '/32'), set())
+    return '', 'observed' if local & gateways else 'not_observed'
+
+
+def observe(inventory, expected_host, fetch=None):
+    """Called only by explicit provider diagnostics; fetch(path, deadline) permits offline fixtures."""
+    result = dict.fromkeys(IDENTITY, '')
+    result.update(provider='digitalocean', status='unverified', reason='expected_host_unverified',
+                  private_gateway_route='unverified')
+    try:
+        _address(expected_host)
+    except (ValueError, TypeError):
+        return result
+    if (not isinstance(inventory, dict) or inventory.get('complete') is not True
+            or not isinstance(inventory.get('host_records'), list) or not isinstance(inventory.get('networks'), list)):
+        return dict(result, reason='host_inventory_unverified')
+    try:
+        values = _read_values(fetch or _fetch, time.monotonic() + 10)
+    except Exception as error:
+        reason = str(error) if isinstance(error, MetadataFailure) else 'metadata_invalid'
+        if isinstance(error, (socket.timeout, TimeoutError)):
+            reason = 'metadata_timeout'
+        elif isinstance(error, OSError):
+            reason = 'metadata_unavailable'
+        if reason not in REASONS['unavailable'] | REASONS['unverified']:
+            reason = 'metadata_invalid'
+        return dict(result, reason=reason, status='unavailable' if reason in REASONS['unavailable'] else 'unverified')
+    try:
+        reason, route = _binding(inventory, values, expected_host)
+    except Exception:
+        return dict(result, reason='host_inventory_unverified')
+    result.update(values, status='mismatch' if reason else 'verified', reason=reason, private_gateway_route=route)
+    return result
+
+
+def validate_provider(receipt):
+    fields = set(IDENTITY) | {'provider', 'status', 'reason', 'private_gateway_route'}
+    if (not isinstance(receipt, dict) or set(receipt) != fields
+            or any(not isinstance(value, str) for value in receipt.values())
+            or receipt['provider'] != 'digitalocean' or receipt['status'] not in REASONS
+            or receipt['reason'] not in REASONS[receipt['status']]):
+        raise ValueError()
+    if receipt['status'] in ('unavailable', 'unverified'):
+        if any(receipt[field] for field in IDENTITY) or receipt['private_gateway_route'] != 'unverified':
+            raise ValueError()
+        return
+    _identity(receipt)
+    routes = ('observed', 'not_observed') if receipt['status'] == 'verified' else ('unverified',)
+    if receipt['private_gateway_route'] not in routes:
+        raise ValueError()

package/backend-action/network_provider_test_fixture.py

@@ -0,0 +1,30 @@
+"""Safe in-memory metadata and HTTP socket fixtures; no external reads."""
+import copy
+import io
+from unittest.mock import MagicMock, Mock
+
+from network_provider import PATHS, observe, validate_provider
+
+PUBLIC = '138.197.36.107'
+VALUES = {'droplet_id': b'123456789', 'region': b'nyc3\n', 'public_ipv4': PUBLIC.encode(),
+          'private_ipv4': b'10.116.0.2', 'netmask': b'255.255.240.0', 'private_gateway': b'10.116.0.1'}
+INVENTORY = {'complete': True, 'networks': [], 'host_records': [
+    {'subnet': PUBLIC + '/32', 'kind': 'address_local', 'device': 'eth0'},
+    {'subnet': '10.116.0.2/32', 'kind': 'address_local', 'device': 'eth1'},
+    {'subnet': '10.116.0.0/20', 'kind': 'address_network', 'device': 'eth1'},
+]}
+
+
+def fixture(values=None, inventory=None, expected=PUBLIC):
+    answers = dict(VALUES, **(values or {}))
+    fetch = Mock(side_effect=lambda path, deadline: answers[next(key for key in PATHS if PATHS[key] == path)])
+    result = observe(copy.deepcopy(INVENTORY) if inventory is None else inventory, expected, fetch)
+    validate_provider(result)
+    return result, fetch
+
+
+def connection(wire):
+    fake = MagicMock()
+    fake.__enter__.return_value = fake
+    fake.recv.side_effect = io.BytesIO(wire).read
+    return fake

package/backend-action/network_readback.py

@@ -4,13 +4,10 @@ import ipaddress
 from network_runtime import NetworkFailure
 
 
-def verify_host_overlap(inventory, created, subnet):
+def expected_host_records(subnet, gateway):
+    """Exact kernel/address records of an ordinary IPv4 bridge, without a device exemption."""
     selected = ipaddress.IPv4Network(subnet)
-    records = inventory.get('host_records', [])
-    if set(inventory.get('host_excluded', [])) - {row['subnet'] for row in records}:
-        raise NetworkFailure('created_network_overlap')
-    pool = created['IPAM']['Config'][0]
-    gateway = str(ipaddress.IPv4Network(pool['Gateway']))
+    gateway = str(ipaddress.IPv4Network(gateway))
     broadcast = str(selected.broadcast_address) + '/32'
     first = str(selected.network_address) + '/32'
     expected = {'route_connected': {subnet}, 'route_local': {gateway},
@@ -18,6 +15,15 @@ def verify_host_overlap(inventory, created, subnet):
                 'address_local': {gateway}, 'address_broadcast': {broadcast}}
     for kind in ('route_connected_source', 'route_local_source', 'route_broadcast_source'):
         expected[kind] = {gateway}
+    return expected
+
+
+def verify_host_overlap(inventory, created, subnet):
+    selected = ipaddress.IPv4Network(subnet)
+    records = inventory.get('host_records', [])
+    if set(inventory.get('host_excluded', [])) - {row['subnet'] for row in records}:
+        raise NetworkFailure('created_network_overlap')
+    expected = expected_host_records(subnet, created['IPAM']['Config'][0]['Gateway'])
     bridge = 'br-' + created['Id'][:12]
     for row in records:
         if selected.overlaps(ipaddress.IPv4Network(row['subnet'])):

package/backend-action/network_selected.py

@@ -0,0 +1,96 @@
+"""Project-owned existing bridge overlap evidence; never allocation or address-policy authorization."""
+import ipaddress
+import re
+
+from network_pools import PRIVATE
+from network_readback import expected_host_records
+
+LIMIT = 256
+REASONS = frozenset({'', 'selected_ownership_unverified', 'selected_bridge_unsupported',
+                     'host_records_incomplete', 'selected_bridge_records_missing', 'overlap_evidence_limit'})
+KINDS = frozenset({'route_other', 'route_connected', 'route_local', 'route_broadcast',
+                   'route_other_source', 'route_connected_source', 'route_local_source', 'route_broadcast_source',
+                   'route_gateway', 'route_src', 'address_network', 'address_local', 'address_peer',
+                   'address_broadcast', 'resolver'})
+
+
+def profile(network, inventory, project):
+    """Bind only an unambiguous ordinary Compose name/project/key and its actual IPAM gateway."""
+    labels = network['Labels']
+    key = labels.get('com.docker.compose.network', '')
+    if (labels.get('com.docker.compose.project') != project or not re.fullmatch(r'[A-Za-z0-9_.-]{1,128}', key)
+            or network['Name'] != project + '_' + key
+            or sum(n['Name'] == network['Name'] for n in inventory['networks']) != 1
+            or sum(n['Id'] == network['Id'] for n in inventory['networks']) != 1):
+        return None, 'selected_ownership_unverified'
+    ipam = network['IPAM']
+    if (network['Driver'] != 'bridge' or network['Scope'] != 'local' or network['EnableIPv6']
+            or network['Options'] or ipam['Driver'] != 'default' or ipam['Options']
+            or len(ipam['Config']) != 1):
+        return None, 'selected_bridge_unsupported'
+    pool = ipam['Config'][0]
+    try:
+        subnet = ipaddress.IPv4Network(pool['Subnet'], strict=True)
+        gateway = ipaddress.IPv4Address(pool['Gateway'])
+        if (set(pool) - {'Subnet', 'Gateway', 'IPRange', 'AuxiliaryAddresses'}
+                or pool.get('IPRange') not in (None, '') or pool.get('AuxiliaryAddresses') not in (None, {})
+                or subnet.prefixlen > 30
+                or not any(subnet.subnet_of(space) for space in PRIVATE) or gateway not in subnet
+                or gateway in (subnet.network_address, subnet.broadcast_address)):
+            raise ValueError()
+    except (KeyError, ValueError, TypeError):
+        return None, 'selected_bridge_unsupported'
+    return {'subnet': subnet, 'gateway': str(gateway), 'bridge': 'br-' + network['Id'][:12]}, ''
+
+
+def pool_membership(inventory, subnet):
+    if inventory['pool_failure'] or inventory['pool_source'] not in ('engine_info', 'versioned_moby_builtin'):
+        return 'unverified'
+    return ('inside_verified_pools' if any(subnet.subnet_of(ipaddress.IPv4Network(p['base']))
+                                         for p in inventory['pools']) else 'outside_verified_pools')
+
+
+def host_overlaps(records, selected):
+    expected = expected_host_records(str(selected['subnet']), selected['gateway'])
+    own, conflicts = set(), set()
+    for row in records:
+        if not selected['subnet'].overlaps(ipaddress.IPv4Network(row['subnet'])):
+            continue
+        if row['device'] == selected['bridge'] and row['subnet'] in expected.get(row['kind'], set()):
+            own.add((row['subnet'], row['kind']))
+        else:
+            relation = 'selected_bridge' if row['device'] == selected['bridge'] else 'foreign_device'
+            conflicts.add((row['subnet'], row['kind'], relation if row['device'] else 'unattributed'))
+    return own, [{'subnet': subnet, 'kind': kind, 'device_relation': relation}
+                 for subnet, kind, relation in sorted(conflicts)]
+
+
+def selected_validation(inventory, network, project):
+    """A clear snapshot does not establish a reservation outside the verified daemon pool bases."""
+    selected, reason = profile(network, inventory, project)
+    result = {'ownership': 'unverified' if reason == 'selected_ownership_unverified' else 'matched',
+              'overlap': 'unverified', 'reason': reason, 'pool_membership': 'unverified',
+              'bridge': '', 'gateway': '', 'self_record_count': 0, 'docker_conflicts': [], 'host_conflicts': []}
+    if selected is None:
+        return result
+    subnet = selected['subnet']
+    result.update(bridge=selected['bridge'], gateway=selected['gateway'],
+                  pool_membership=pool_membership(inventory, subnet))
+    docker = sorted({p['Subnet'] for n in inventory['networks'] if n['Id'] != network['Id']
+                     for p in n['IPAM']['Config'] if ipaddress.ip_network(p['Subnet']).version == 4
+                     and subnet.overlaps(ipaddress.IPv4Network(p['Subnet']))})
+    records = inventory['host_records']
+    own, host = host_overlaps(records, selected)
+    required = {(str(subnet), 'route_connected'), (str(subnet), 'address_network'),
+                (selected['gateway'] + '/32', 'route_local'), (selected['gateway'] + '/32', 'address_local')}
+    if (inventory.get('complete') is not True
+            or set(inventory['host_excluded']) != {row['subnet'] for row in records}):
+        reason = 'host_records_incomplete'
+    elif not required.issubset(own):
+        reason = 'selected_bridge_records_missing'
+    elif len(docker) > LIMIT or len(host) > LIMIT:
+        reason = 'overlap_evidence_limit'
+    result.update(reason=reason, self_record_count=len(own), docker_conflicts=docker[:LIMIT],
+                  host_conflicts=host[:LIMIT], overlap='conflict' if docker or host else
+                  ('unverified' if reason else 'clear'))
+    return result

package/backend-action/network_selected_receipt.py

@@ -0,0 +1,60 @@
+"""Closed public validation for selected-network overlap evidence, with no raw host records."""
+import ipaddress
+
+from network_selected import KINDS, LIMIT, REASONS, pool_membership
+from network_pools import PRIVATE
+
+
+def validate_selected(result, network, inventory):
+    fields = {'ownership', 'overlap', 'reason', 'pool_membership', 'bridge', 'gateway',
+              'self_record_count', 'docker_conflicts', 'host_conflicts'}
+    if (not isinstance(result, dict) or set(result) != fields or result['reason'] not in REASONS
+            or result['ownership'] not in ('matched', 'unverified')
+            or result['overlap'] not in ('clear', 'conflict', 'unverified')
+            or result['pool_membership'] not in ('inside_verified_pools', 'outside_verified_pools', 'unverified')
+            or type(result['self_record_count']) is not int or not 0 <= result['self_record_count'] <= 16384):
+        raise ValueError()
+    for field in ('docker_conflicts', 'host_conflicts'):
+        if not isinstance(result[field], list) or len(result[field]) > LIMIT:
+            raise ValueError()
+    if (result['ownership'] == 'matched'
+            and network['name'] != inventory['project'] + '_' + network['key']):
+        raise ValueError()
+    unsupported = result['reason'] in ('selected_ownership_unverified', 'selected_bridge_unsupported')
+    if unsupported:
+        if (result['overlap'] != 'unverified' or result['bridge'] != '' or result['gateway'] != ''
+                or result['self_record_count'] or result['docker_conflicts'] or result['host_conflicts']
+                or result['pool_membership'] != 'unverified'):
+            raise ValueError()
+        if (result['ownership'] == 'unverified') != (result['reason'] == 'selected_ownership_unverified'):
+            raise ValueError()
+        return
+    if (result['ownership'] != 'matched' or network['driver'] != 'bridge'
+            or result['bridge'] != 'br-' + network['id'][:12] or not isinstance(result['gateway'], str)
+            or len(network['subnets']) != 1):
+        raise ValueError()
+    subnet = ipaddress.IPv4Network(network['subnets'][0], strict=True)
+    gateway = ipaddress.IPv4Address(result['gateway'])
+    if (subnet.prefixlen > 30 or not any(subnet.subnet_of(space) for space in PRIVATE)
+            or gateway not in subnet or gateway in (subnet.network_address, subnet.broadcast_address)
+            or result['pool_membership'] != pool_membership(inventory, subnet)):
+        raise ValueError()
+    validate_overlaps(result, subnet)
+
+
+def validate_overlaps(result, subnet):
+    for value in result['docker_conflicts']:
+        if not isinstance(value, str) or not subnet.overlaps(ipaddress.IPv4Network(value, strict=True)):
+            raise ValueError()
+    for row in result['host_conflicts']:
+        if (not isinstance(row, dict) or set(row) != {'subnet', 'kind', 'device_relation'}
+                or not isinstance(row['subnet'], str)
+                or row['kind'] not in KINDS
+                or row['device_relation'] not in ('selected_bridge', 'foreign_device', 'unattributed')
+                or not subnet.overlaps(ipaddress.IPv4Network(row['subnet'], strict=True))):
+            raise ValueError()
+    conflict = bool(result['docker_conflicts'] or result['host_conflicts'])
+    if ((result['overlap'] == 'conflict') != conflict
+            or (result['overlap'] == 'clear' and (result['reason'] or result['self_record_count'] < 4))
+            or (result['overlap'] == 'unverified' and not result['reason'])):
+        raise ValueError()

package/backend-action/network_test_fixture.py

@@ -28,9 +28,10 @@ class Host:
         self.calls = []
         self.pool_failure = ''
         self.lose_reply = False
+        self.compose_version = '2.39.4'
 
     def inventory(self, command, require_pools=True):
-        return {'docker_version': '28.0.4', 'compose_version': '2.39.4', 'observed_at': '2026-09-15T00:00:00Z',
+        return {'docker_version': '28.0.4', 'compose_version': self.compose_version, 'observed_at': '2026-09-15T00:00:00Z',
                 'python_version': '3.8.20', 'pool_source': 'fixture', 'pool_failure': self.pool_failure,
                 'pools': [{'base': '172.28.0.0/22', 'size': 16}], 'networks': copy.deepcopy(self.networks),
                 'host_excluded': [], 'host_records': [],

package/backend-action/test_network_diagnostics.py

@@ -7,6 +7,7 @@ from unittest.mock import patch
 from identity_diagnostics import ReaderFailure
 from network_diagnostics import SCHEMA, decode, diagnose, remote_source
 from network_test_fixture import Host
+from test_network_selected import fixture
 
 
 class DiagnosticTests(unittest.TestCase):
@@ -43,6 +44,25 @@ class DiagnosticTests(unittest.TestCase):
                     'observed_at': '2026-09-15T00:00:00+00:00', 'complete': False}
         self.assertEqual(decode(1, json.dumps(evidence).encode(), 'fixture'), evidence)
 
+    def test_optional_metadata_failure_keeps_independent_selected_network_observation(self):
+        inventory, selected = fixture()
+        metadata = dict.fromkeys(('droplet_id', 'region', 'public_ipv4', 'private_ipv4',
+                                  'private_subnet', 'private_gateway'), '')
+        metadata.update(provider='digitalocean', status='unavailable', reason='metadata_timeout',
+                        private_gateway_route='unverified')
+        source = remote_source('fixture', '138.197.36.107', 'digitalocean').decode().replace(
+            'inventory = collect(run, require_pools=False)', 'inventory = ' + repr(inventory)).replace(
+            "observe(inventory, '138.197.36.107')", repr(metadata))
+        result = subprocess.run([sys.executable, '-'], input=source.encode(), stdout=subprocess.PIPE,
+                                stderr=subprocess.PIPE, timeout=5)
+        self.assertEqual(result.returncode, 0, result.stderr.decode())
+        evidence = decode(0, result.stdout, 'fixture')
+        self.assertEqual(evidence['host_identity'], metadata)
+        self.assertEqual(evidence['networks'][0]['validation']['overlap'], 'clear')
+        evidence['host_identity']['secret'] = 'PRIVATE_SENTINEL'
+        with self.assertRaises(ReaderFailure):
+            decode(0, json.dumps(evidence).encode(), 'fixture')
+
     def test_unrecognized_fields_codes_and_transport_results_are_not_published(self):
         evidence = {'schema': SCHEMA, 'ok': False, 'project': 'fixture', 'failure': 'host_rules_unsupported'}
         for changed in ({**evidence, 'secret': 'PRIVATE_SENTINEL'}, {**evidence, 'failure': 'PRIVATE_SENTINEL'},

package/backend-action/test_network_prepare.py

@@ -85,6 +85,27 @@ class PreparationTests(unittest.TestCase):
         self.assertEqual(set(values), {'172.28.1.0/24', '172.28.2.0/24'})
         self.assertEqual(len(host.calls), 2)
 
+    def test_reviewed_compose_majors_allocate_and_others_refuse_before_create(self):
+        for version in ('2.39.4', 'v2.40.3', '5.0.0', '5.3.1', 'v5.5.1'):
+            host = Host()
+            host.compose_version = version
+            result = prepare(config('first'), 'first', **host.arguments())
+            self.assertTrue(result['ok'])
+            self.assertEqual(result['compose_version'], version)
+            self.assertEqual(host.networks[-1]['Labels']['com.docker.compose.version'], version)
+            self.assertNotIn('com.docker.compose.config-hash', host.networks[-1]['Labels'])
+            self.assertEqual(len(host.calls), 1)
+        for version in ('1.29.2', '3.0.0', '4.1.0', '6.0.0', '5.3', '25.0.0'):
+            host = Host()
+            host.compose_version = version
+            with self.assertRaisesRegex(NetworkFailure, 'compose_version_unsupported'):
+                prepare(config('first'), 'first', **host.arguments())
+            self.assertEqual(host.calls, [])
+            host.networks.append(network('existing', '172.29.0.0/16'))
+            preserved = prepare(config('existing'), 'existing', **host.arguments())
+            self.assertEqual(preserved['networks'][0]['state'], 'preserved')
+            self.assertEqual(host.calls, [])
+
     def test_full_effective_pool_and_unknown_provenance_refuse_expansion(self):
         for unknown in (False, True):
             host = Host()

package/backend-action/test_network_provider.py

@@ -0,0 +1,162 @@
+"""Offline metadata fixtures: no real socket, deployment host, cloud API or credentials."""
+import copy
+import json
+import socket
+import unittest
+from unittest.mock import Mock, patch
+
+from network_provider import MetadataFailure, ORIGIN, PATHS, _fetch, observe, validate_provider
+from network_provider_test_fixture import INVENTORY, PUBLIC, VALUES, connection, fixture
+
+
+class ProviderTests(unittest.TestCase):
+    def test_identity_and_private_gateway_route_are_separate(self):
+        result, fetch = fixture()
+        self.assertEqual(result['status'], 'verified')
+        self.assertEqual(result['private_subnet'], '10.116.0.0/20')
+        self.assertEqual(result['private_gateway_route'], 'not_observed')
+        self.assertEqual([call.args[0] for call in fetch.call_args_list], list(PATHS.values()))
+        self.assertEqual(len(fetch.call_args_list), 6)
+        inventory = copy.deepcopy(INVENTORY)
+        inventory['host_records'].append({'subnet': '10.116.0.1/32', 'kind': 'route_gateway', 'device': 'eth1'})
+        self.assertEqual(fixture(inventory=inventory)[0]['private_gateway_route'], 'observed')
+        inventory['host_records'][-1]['device'] = 'eth2'
+        result = fixture(inventory=inventory)[0]
+        self.assertEqual((result['status'], result['private_gateway_route']), ('verified', 'not_observed'))
+        self.assertNotIn('policy', json.dumps(result))
+
+    def test_expected_host_requires_literal_ipv4_and_matching_kernel_address(self):
+        for expected in ('host.example', '::1', '138.197.036.107', 123, None):
+            result, fetch = fixture(expected=expected)
+            self.assertEqual(result['reason'], 'expected_host_unverified')
+            fetch.assert_not_called()
+        result, _ = fixture(expected='138.197.36.108')
+        self.assertEqual((result['status'], result['reason']), ('mismatch', 'public_address_mismatch'))
+        self.assertEqual(result['droplet_id'], '123456789')
+        inventory = copy.deepcopy(INVENTORY)
+        inventory['host_records'].pop(0)
+        self.assertEqual(fixture(inventory=inventory)[0]['reason'], 'public_address_unobserved')
+        for inventory in ({}, dict(INVENTORY, complete=False)):
+            result, fetch = fixture(inventory=inventory)
+            self.assertEqual(result['reason'], 'host_inventory_unverified')
+            fetch.assert_not_called()
+
+    def test_private_identity_requires_one_matching_nonbridge_device(self):
+        variants = []
+        for index, device in ((1, 'eth2'), (2, 'eth2'), (1, ''), (1, 'br-fixture')):
+            inventory = copy.deepcopy(INVENTORY)
+            inventory['host_records'][index]['device'] = device
+            variants.append(inventory)
+        inventory = copy.deepcopy(INVENTORY)
+        inventory['host_records'].append(dict(inventory['host_records'][1], device='eth2'))
+        variants.append(inventory)
+        inventory = copy.deepcopy(INVENTORY)
+        inventory['networks'] = [{'Driver': 'bridge', 'Id': 'a' * 64,
+                                  'Options': {'com.docker.network.bridge.name': 'eth1'}}]
+        variants.append(inventory)
+        inventory = copy.deepcopy(INVENTORY)
+        inventory['host_records'][2]['subnet'] = '10.116.0.0/24'
+        variants.append(inventory)
+        for inventory in variants:
+            with self.subTest(inventory=inventory):
+                self.assertEqual(fixture(inventory=inventory)[0]['reason'], 'private_address_mismatch')
+
+    def test_malformed_leaves_are_closed_and_never_retained(self):
+        changes = [('droplet_id', b'0'), ('droplet_id', b'123456789012345678901'),
+                   ('region', b'PRIVATE_SENTINEL'), ('region', b'nyc3\x00'),
+                   ('public_ipv4', b'138.197.036.107'), ('public_ipv4', b'::1'),
+                   ('private_ipv4', b'8.8.8.8'), ('private_ipv4', b'10.116.0.0'),
+                   ('private_gateway', b'10.116.16.1'), ('private_gateway', b'10.116.0.2'),
+                   ('private_gateway', b'10.116.15.255'), ('netmask', b'255.0.255.0'),
+                   ('netmask', b'0.0.15.255'), ('netmask', b'20'), ('netmask', b'255.255.255.255'),
+                   ('droplet_id', b'PRIVATE_SENTINEL' * 10), ('region', b'\xff')]
+        for field, value in changes:
+            with self.subTest(field=field, value=value):
+                result, _ = fixture({field: value})
+                self.assertEqual(result['status'], 'unverified')
+                self.assertEqual(result['droplet_id'], '')
+                self.assertNotIn('PRIVATE_SENTINEL', json.dumps(result))
+        for error, reason in ((socket.timeout('PRIVATE_SENTINEL'), 'metadata_timeout'),
+                              (OSError('PRIVATE_SENTINEL'), 'metadata_unavailable'),
+                              (MetadataFailure('PRIVATE_SENTINEL'), 'metadata_invalid')):
+            result = observe(INVENTORY, PUBLIC, Mock(side_effect=error))
+            validate_provider(result)
+            self.assertEqual(result['reason'], reason)
+            self.assertNotIn('PRIVATE_SENTINEL', json.dumps(result))
+
+    def test_transport_is_fixed_bounded_and_has_no_redirect_or_proxy_path(self):
+        fake = connection(b'HTTP/1.0 200 OK\r\nContent-Length: 3\r\n\r\n123')
+        with patch('network_provider.socket.socket', return_value=fake) as factory, \
+                patch('network_provider.time.monotonic', return_value=0), \
+                patch.dict('os.environ', {'HTTP_PROXY': 'http://PRIVATE_SENTINEL:80'}):
+            self.assertEqual(_fetch(PATHS['droplet_id'], 10), b'123')
+        factory.assert_called_once_with(socket.AF_INET, socket.SOCK_STREAM)
+        fake.connect.assert_called_once_with(ORIGIN)
+        fake.sendall.assert_called_once_with(
+            b'GET /metadata/v1/id HTTP/1.0\r\nHost: 169.254.169.254\r\nConnection: close\r\n\r\n')
+        self.assertTrue(all(0 < call.args[0] <= 2 for call in fake.settimeout.call_args_list))
+        self.assertTrue(all(call.args[0] <= 129 for call in fake.recv.call_args_list))
+        for path in ('/metadata/v1.json', '/metadata/v1/user-data', '/metadata/v1/auth-token',
+                     '/metadata/v1/id?x=1', 'http://other/metadata/v1/id'):
+            with patch('network_provider.socket.socket') as factory, self.assertRaises(MetadataFailure):
+                _fetch(path, 10)
+            factory.assert_not_called()
+
+    def test_http_refusals_headers_and_body_limits_do_not_leak_content(self):
+        cases = [(b'HTTP/1.0 404 Missing\r\n\r\nPRIVATE_SENTINEL', 'metadata_missing'),
+                 (b'HTTP/1.0 302 Found\r\nLocation: http://other/\r\n\r\n', 'metadata_unavailable'),
+                 (b'HTTP/1.0 200 OK\r\nX: ' + b'a' * 8192 + b'\r\n\r\n', 'metadata_response_limit'),
+                 (b'HTTP/1.0 200 OK\r\n' + b'X: a\r\n' * 17 + b'\r\n', 'metadata_response_limit'),
+                 (b'HTTP/1.0 200 OK\r\n\r\n' + b'a' * 129, 'metadata_response_limit'),
+                 (b'HTTP/1.0 200 OK\r\nContent-Length: 129\r\n\r\n', 'metadata_response_limit'),
+                 (b'HTTP/1.0 200 OK\r\nContent-Length: 3\r\n\r\n12', 'metadata_invalid'),
+                 (b'HTTP/1.0 200 OK\r\nContent-Length: 1\r\nContent-Length: 1\r\n\r\n1', 'metadata_invalid'),
+                 (b'HTTP/1.0 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n', 'metadata_invalid'),
+                 (b'HTTP/1.0 200 OK\r\nContent-Encoding: gzip\r\n\r\n', 'metadata_invalid')]
+        for wire, reason in cases:
+            with self.subTest(reason=reason), patch('network_provider.socket.socket', return_value=connection(wire)), \
+                    patch('network_provider.time.monotonic', return_value=0):
+                result = observe(INVENTORY, PUBLIC)
+            validate_provider(result)
+            self.assertEqual(result['reason'], reason)
+            self.assertNotIn('PRIVATE_SENTINEL', json.dumps(result))
+
+    def test_deadlines_stop_slow_leaves_and_bound_the_whole_sequence(self):
+        clock = [0]
+        def slow(path, deadline):
+            clock[0] += 2.1
+            return b'123'
+        with patch('network_provider.time.monotonic', side_effect=lambda: clock[0]):
+            fetch = Mock(side_effect=slow)
+            self.assertEqual(observe(INVENTORY, PUBLIC, fetch)['reason'], 'metadata_timeout')
+        self.assertEqual(fetch.call_count, 1)
+        clock[0] = 0
+        def steady(path, deadline):
+            clock[0] += 1.9
+            return VALUES[next(key for key in PATHS if PATHS[key] == path)]
+        with patch('network_provider.time.monotonic', side_effect=lambda: clock[0]):
+            fetch = Mock(side_effect=steady)
+            self.assertEqual(observe(INVENTORY, PUBLIC, fetch)['reason'], 'metadata_timeout')
+        self.assertEqual(fetch.call_count, 6)
+        self.assertEqual(fetch.call_args.args[1], 10)
+
+    def test_receipt_rejects_extra_fields_bad_types_and_contradictory_states(self):
+        result, _ = fixture()
+        changes = ({'secret': 'PRIVATE_SENTINEL'}, {'droplet_id': 123}, {'region': []},
+                   {'private_gateway': 1}, {'private_subnet': '10.116.0.2/20'},
+                   {'provider': 'other'}, {'reason': 'PRIVATE_SENTINEL'}, {'status': 'unverified'},
+                   {'private_gateway_route': 'unverified'}, {'public_ipv4': '138.197.036.107'})
+        for changed in changes:
+            with self.subTest(changed=changed), self.assertRaises(ValueError):
+                validate_provider(dict(result, **changed))
+        failure = observe(INVENTORY, 'hostname', Mock())
+        for changed in ({'droplet_id': '123'}, {'private_gateway_route': 'not_observed'}, {'public_ipv4': None}):
+            with self.assertRaises(ValueError):
+                validate_provider(dict(failure, **changed))
+        mismatch, _ = fixture(expected='138.197.36.108')
+        with self.assertRaises(ValueError):
+            validate_provider(dict(mismatch, private_gateway_route='observed'))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/backend-action/test_network_selected.py

@@ -0,0 +1,153 @@
+"""Existing bridge evidence with full pools, foreign collisions and untrusted public receipts."""
+import copy
+import json
+import subprocess
+import sys
+import unittest
+
+from identity_diagnostics import ReaderFailure
+from network_diagnostics import decode, remote_source
+from network_selected import KINDS, selected_validation
+from network_test_fixture import Host, network
+
+
+def fixture():
+    inventory = Host().inventory(None)
+    selected = network('fixture', '10.253.55.0/28')
+    inventory.update(complete=True, pool_source='engine_info', networks=inventory['networks'] + [selected])
+    bridge = 'br-' + selected['Id'][:12]
+    records = [('10.253.55.0/28', 'route_connected'), ('10.253.55.1/32', 'route_connected_source'),
+               ('10.253.55.1/32', 'route_local'), ('10.253.55.15/32', 'route_broadcast'),
+               ('10.253.55.0/28', 'address_network'), ('10.253.55.1/32', 'address_local'),
+               ('10.253.55.15/32', 'address_broadcast')]
+    inventory['host_records'] = [{'subnet': subnet, 'kind': kind, 'device': bridge} for subnet, kind in records]
+    inventory['host_excluded'] = sorted({row['subnet'] for row in inventory['host_records']})
+    inventory['excluded'] += inventory['host_excluded']
+    return inventory, selected
+
+
+class SelectedTests(unittest.TestCase):
+    def test_self_routes_do_not_conflict_or_prove_an_outside_pool_reservation(self):
+        inventory, selected = fixture()
+        # No spare capacity in the only pool; that does not determine existing-network overlap.
+        inventory['pools'] = [{'base': '172.28.0.0/24', 'size': 24}]
+        result = selected_validation(inventory, selected, 'fixture')
+        self.assertEqual((result['ownership'], result['overlap'], result['reason']), ('matched', 'clear', ''))
+        self.assertEqual(result['self_record_count'], 7)
+        self.assertEqual(result['pool_membership'], 'outside_verified_pools')
+        inventory['pools'] = [{'base': '10.253.55.0/28', 'size': 28}]
+        self.assertEqual(selected_validation(inventory, selected, 'fixture')['pool_membership'],
+                         'inside_verified_pools')
+        inventory['pool_failure'] = 'pool_provenance_unknown'
+        self.assertEqual(selected_validation(inventory, selected, 'fixture')['overlap'], 'clear')
+        self.assertEqual(selected_validation(inventory, selected, 'fixture')['pool_membership'], 'unverified')
+
+    def test_identical_foreign_docker_prefix_is_preserved_after_self_exclusions(self):
+        inventory, selected = fixture()
+        inventory['networks'].append(network('foreign', '10.253.55.0/28'))
+        result = selected_validation(inventory, selected, 'fixture')
+        self.assertEqual(result['overlap'], 'conflict')
+        self.assertEqual(result['docker_conflicts'], ['10.253.55.0/28'])
+        self.assertNotIn('foreign', json.dumps(result))
+
+    def test_foreign_routes_and_dns_inside_self_subnet_are_never_excused(self):
+        for kind, device in (('route_connected', 'vpn0'), ('route_other', 'tailscale0'),
+                             ('route_gateway', 'eth0'), ('resolver', ''), ('route_other', 'self')):
+            inventory, selected = fixture()
+            bridge = 'br-' + selected['Id'][:12]
+            inventory['host_records'].append({'subnet': '10.253.55.1/32', 'kind': kind,
+                                              'device': bridge if device == 'self' else device})
+            with self.subTest(kind=kind, device=device):
+                result = selected_validation(inventory, selected, 'fixture')
+                self.assertEqual(result['overlap'], 'conflict')
+                self.assertEqual(result['host_conflicts'][0]['kind'], kind)
+                self.assertNotIn('device', result['host_conflicts'][0])
+
+    def test_missing_route_provenance_and_missing_bridge_facts_do_not_claim_clear(self):
+        for change, reason in (('missing', 'selected_bridge_records_missing'),
+                               ('incomplete', 'host_records_incomplete')):
+            inventory, selected = fixture()
+            if change == 'missing':
+                inventory['host_records'] = []
+                inventory['host_excluded'] = []
+            else:
+                inventory['host_excluded'].append('10.108.0.0/20')
+            result = selected_validation(inventory, selected, 'fixture')
+            self.assertEqual((result['overlap'], result['reason']), ('unverified', reason))
+            inventory['networks'].append(network('foreign', '10.253.55.0/24'))
+            self.assertEqual(selected_validation(inventory, selected, 'fixture')['overlap'], 'conflict')
+
+    def test_ownership_and_unsupported_bridge_shapes_never_exempt_host_records(self):
+        changes = [({'Name': 'custom'}, 'selected_ownership_unverified'),
+                   ({'Labels': {'com.docker.compose.project': 'fixture'}}, 'selected_ownership_unverified'),
+                   ({'Driver': 'overlay'}, 'selected_bridge_unsupported'),
+                   ({'EnableIPv6': True}, 'selected_bridge_unsupported'),
+                   ({'Options': {'com.docker.network.bridge.name': 'custom0'}}, 'selected_bridge_unsupported')]
+        for settings, reason in changes:
+            inventory, selected = fixture()
+            selected.update(settings)
+            with self.subTest(settings=settings):
+                result = selected_validation(inventory, selected, 'fixture')
+                self.assertEqual((result['overlap'], result['reason']), ('unverified', reason))
+                self.assertEqual(result['self_record_count'], 0)
+        inventory, selected = fixture()
+        inventory['networks'].append(copy.deepcopy(selected))
+        self.assertEqual(selected_validation(inventory, selected, 'fixture')['reason'],
+                         'selected_ownership_unverified')
+        inventory, selected = fixture()
+        selected['IPAM']['Config'][0].update(IPRange='', AuxiliaryAddresses={})
+        self.assertEqual(selected_validation(inventory, selected, 'fixture')['overlap'], 'clear')
+        selected['IPAM']['Config'][0]['IPRange'] = '10.253.55.8/29'
+        self.assertEqual(selected_validation(inventory, selected, 'fixture')['reason'],
+                         'selected_bridge_unsupported')
+
+    def test_truncated_evidence_retains_conflict_without_unbounded_host_records(self):
+        inventory, selected = fixture()
+        for index in range(300):
+            inventory['host_records'].append({'subnet': '10.253.55.1/32', 'kind': 'route_other',
+                                              'device': 'vpn%d' % index})
+        # Different device names collapse to the same safe public relation, not raw private inventory.
+        result = selected_validation(inventory, selected, 'fixture')
+        self.assertEqual(result['overlap'], 'conflict')
+        self.assertEqual(len(result['host_conflicts']), 1)
+        self.assertNotIn('vpn', json.dumps(result))
+        for index in range(16):
+            for kind in KINDS:
+                inventory['host_records'].append({'subnet': '10.253.55.%d/32' % index,
+                                                  'kind': kind, 'device': 'vpn0'})
+        for kind in KINDS:
+            inventory['host_records'].append({'subnet': '10.253.55.0/31', 'kind': kind, 'device': 'vpn0'})
+            inventory['host_records'].append({'subnet': '10.253.55.0/30', 'kind': kind, 'device': 'vpn0'})
+        inventory['host_excluded'] = sorted({row['subnet'] for row in inventory['host_records']})
+        result = selected_validation(inventory, selected, 'fixture')
+        self.assertEqual((result['overlap'], result['reason']), ('conflict', 'overlap_evidence_limit'))
+        self.assertEqual(len(result['host_conflicts']), 256)
+
+    def test_streamed_v2_receipt_binds_selected_network_and_rejects_false_clear_or_secret_fields(self):
+        inventory, selected = fixture()
+        source = remote_source('fixture').decode().replace(
+            'inventory = collect(run, require_pools=False)', 'inventory = ' + repr(inventory))
+        process = subprocess.run([sys.executable, '-'], input=source.encode(), stdout=subprocess.PIPE,
+                                 stderr=subprocess.PIPE, timeout=5)
+        self.assertEqual(process.returncode, 0, process.stderr.decode())
+        receipt = decode(0, process.stdout, 'fixture')
+        self.assertEqual(receipt['networks'][0]['validation']['overlap'], 'clear')
+        for changed in ({'bridge': 'br-' + 'f' * 12}, {'self_record_count': 0},
+                        {'pool_membership': 'inside_verified_pools'},
+                        {'gateway': 184352513},
+                        {'secret': 'PRIVATE_SENTINEL'}, {'docker_conflicts': ['10.253.55.0/28']},
+                        {'host_conflicts': [{'subnet': '10.253.55.1/32', 'kind': 'PRIVATE_SENTINEL',
+                                             'device_relation': 'foreign_device'}]}):
+            bad = copy.deepcopy(receipt)
+            bad['networks'][0]['validation'].update(changed)
+            with self.subTest(changed=changed), self.assertRaises(ReaderFailure):
+                decode(0, json.dumps(bad).encode(), 'fixture')
+        for changed in ({'name': 'another_default'}, {'driver': 'overlay'}, {'subnets': [184352512]}):
+            bad = copy.deepcopy(receipt)
+            bad['networks'][0].update(changed)
+            with self.subTest(changed=changed), self.assertRaises(ReaderFailure):
+                decode(0, json.dumps(bad).encode(), 'fixture')
+
+
+if __name__ == '__main__':
+    unittest.main()

package/docs/BACKEND_NETWORKS.md

@@ -28,10 +28,21 @@ fingerprint. A later change to its network contract refuses before Compose rathe
 ignoring authored IPAM or replacing a network that may carry active workloads. An app requiring a
 different network must implement that deliberate migration in its own deployment.
 
-The helper intentionally does not manufacture `com.docker.compose.config-hash`. Compose 2 accepts a
-network with the correct project/network labels and no hash. A wrong hash can trigger replacement.
-Its own fingerprint protects replay, including configuration changes. Other Compose major versions
-require compatibility review before new-network preparation is admitted.
+The helper intentionally does not manufacture `com.docker.compose.config-hash`. Compose 2 and Compose 5
+accept a network with the correct project/network labels and no hash. A wrong hash can trigger
+replacement. Its own fingerprint protects replay, including configuration changes. New-network
+preparation admits Compose 2.x and 5.x; any other major version refuses with
+`compose_version_unsupported` until it has been reviewed. Existing selected networks are preserved
+under every Compose version because preservation never allocates.
+
+Compose 5 review (2026-09-17, docker/compose tags v5.0.0, v5.3.1 and v5.5.1 against v2.40.3):
+`resolveOrCreateNetwork` in `pkg/compose/create.go` at v5.0.0 and v5.3.1 returns the inspected
+network when its `com.docker.compose.network` label matches and its config-hash label is empty or
+equal (`hash == "" || hash == expected`), the same branch as v2.40.3; the remaining differences are
+Docker client types, IPAM parsing and event emission. v5.5.1 moved reuse into `reconcileNetworks`
+in `pkg/compose/reconcile.go`, whose observed state is scoped by the project label and which leaves a
+network with no recorded hash untouched (`observed.ConfigHash == ""`). docker/compose carries no v3 or
+v4 tags, and Compose 1 (`docker-compose`) stays unreviewed.
 
 ## Address-space proof
 
@@ -68,12 +79,55 @@ existing deployment identity but skips source sync, environment installation and
 package modules travel over SSH stdin and execute in memory; no helper file is installed on the host.
 
 The `backend-network-diagnostics-<job>-<attempt>` artifact contains `result.json` with schema
-`gowalk-cicd/backend-network-diagnostics.v1`. It records:
+`gowalk-cicd/backend-network-diagnostics.v2`. It records:
 
 - Docker, Compose and Python versions with a UTC timestamp;
 - effective pool bases/sizes, their provenance and any typed pool refusal;
 - inventory completeness, network count and excluded IPv4 prefixes;
-- only the selected project's network IDs, names, Compose keys, subnets and endpoint counts.
+- only the selected project's network IDs, names, Compose keys, subnets and endpoint counts;
+- a `validation` for each selected network, separating observed IPv4 overlap from verified pool membership.
+
+Selected-network validation binds an unambiguous automatic Compose name to its project/key labels.
+It supports local ordinary IPv4 bridges with one RFC1918 subnet, an explicit usable gateway and no
+custom options. Other shapes report `unverified`; labels alone never exempt a host route. The exact
+network ID determines the bridge device, and only its expected kernel connected/local/broadcast and
+address records count as self records. Connected and local routes and addresses must actually appear.
+Foreign Docker prefixes, foreign host routes, resolver addresses and unexpected records on the selected
+bridge remain conflicts even when their prefix is identical to a self record. The public receipt retains
+only overlapping prefixes, fixed host-record kinds and device relationships, never foreign project names
+or raw host inventory. Each conflict list is limited to 256 entries; a truncated list retains `conflict`.
+
+`validation.overlap` is `clear`, `conflict` or `unverified`. `pool_membership` independently reports
+`inside_verified_pools`, `outside_verified_pools` or `unverified`; it does not measure spare capacity.
+Top-level `ok:true` means the inventory read completed, so consumers must inspect each validation.
+An outside-pool network can have a clear observed overlap check while still lacking an address-policy
+reservation. This receipt does not authorize that range or certify destinations hidden behind a default
+route. Establish any deliberate host-local reservation through the owning infrastructure policy and
+recheck the live network before asserting permanent suitability. Provider metadata can establish a
+host's identity and attached private subnet; it does not delegate another range to Docker.
+
+For a DigitalOcean deployment, select `diagnostic-provider: digitalocean` on that same workflow.
+The default `none` performs no provider read. The optional `host_identity` reads only six fixed leaves
+from `169.254.169.254:80` on the already verified deployment host: Droplet ID, region, public interface 0
+IPv4 address, and private interface 0 IPv4 address/netmask/gateway. It never requests an index, bulk
+metadata, user data, tokens or credentials. The reader allows no proxy, redirect, retry, authentication
+or destination override; it bounds each response to 128 body bytes and 8 KiB/16 header fields, with
+two seconds per request and ten seconds overall.
+
+Positive binding requires the returned public address to equal the configured literal IPv4 deployment
+host and a kernel local address. The returned private address and derived subnet must match the same
+unique non-bridge kernel interface. A usable private gateway is retained as a metadata fact; its absence
+from kernel gateway records does not invalidate host identity or claim that the gateway is being used.
+`host_identity.status` separates `verified`, `mismatch`, `unavailable` and `unverified`; failure of this
+optional read never rewrites the independently observed network-overlap result. Interface slot 0 is
+not a VPC/peering inventory. Current supported Tailscale kernel routes remain part of the overlap check;
+no Tailscale preferences, state files, account data or control-plane route claims are fetched.
+
+These facts can support a deliberate current host-local reservation by the authorized infrastructure
+owner, recorded against the exact host, existing network ID, subnet, gateway and diagnostic revision.
+Such a decision must state its host-local routing scope and require revalidation before future routing
+or advertisement changes. It does not invent a historical provider delegation, expand daemon pools,
+modify a network or turn a route snapshot into global address-space proof.
 
 A routing refusal can retain safe engine/pool metadata with `complete:false` and `ok:false`. Such
 partial evidence never admits allocation. A successful diagnostic is a readback, not a deployment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.154",
+  "version": "1.0.156",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-backend.yml

@@ -24,6 +24,11 @@ on:
         type: string
         description: For diagnostics, UTC YYYY-MM-DDTHH:MM:SSZ within the previous 24 hours
         required: false
+      diagnostic-provider:
+        type: choice
+        description: Optional host metadata for network diagnostics; never address-space authorization
+        default: none
+        options: [none, digitalocean]
 
 permissions:
   contents: read
@@ -65,6 +70,7 @@ jobs:
         with:
           operation: ${{ inputs.operation || 'deploy' }}
           diagnostic-since: ${{ inputs.diagnostic-since }}
+          diagnostic-provider: ${{ inputs.diagnostic-provider || 'none' }}
           ssh-key: ${{ secrets.BACKEND_DEPLOY_SSH_KEY }}
           host: ${{ vars.BACKEND_DEPLOY_HOST || '138.197.36.107' }}
           app-name: ${{ vars.BACKEND_APP_NAME || github.event.repository.name }}