mostlyright-data 0.9.2__tar.gz → 0.9.4__tar.gz

{mostlyright_data-0.9.2 → mostlyright_data-0.9.4}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: mostlyright-data
-Version: 0.9.2
+Version: 0.9.4
 Summary: Mostly Right CLI for reproducible, reviewed Parquet datasets
 Project-URL: Homepage, https://mostlyright.md/
 Project-URL: Documentation, https://mostlyright.md/docs/guides/cli/
 Requires-Python: <3.14,>=3.13
 Provides-Extra: build
 Requires-Dist: hatchling==1.28.0; extra == 'build'
-Requires-Dist: uv-build==0.9.26; extra == 'build'
+Requires-Dist: uv-build==0.11.3; extra == 'build'
 Provides-Extra: dev
 Requires-Dist: cmarkgfm>=2025.10.22; extra == 'dev'
 Requires-Dist: croniter==6.2.4; extra == 'dev'
@@ -81,9 +81,9 @@ Description-Content-Type: text/markdown
 
 # mostlyright-data
 
-Mostly Right turns public weather, economic, financial, and satellite data into datasets for
-analysis and prediction. It keeps source links, timestamps, and check results with each dataset
-version.
+Mostly Right turns historical and live public data—weather, economic releases, financial reports,
+and satellite data—into consistent datasets for analysis and prediction. Each dataset includes
+source links, timestamps, and check results.
 
 `mostlyright-data` is the command-line client. It starts hosted research and build work, follows
 run status, and downloads completed Parquet datasets.

{mostlyright_data-0.9.2 → mostlyright_data-0.9.4}/README.md

@@ -1,8 +1,8 @@
 # mostlyright-data
 
-Mostly Right turns public weather, economic, financial, and satellite data into datasets for
-analysis and prediction. It keeps source links, timestamps, and check results with each dataset
-version.
+Mostly Right turns historical and live public data—weather, economic releases, financial reports,
+and satellite data—into consistent datasets for analysis and prediction. Each dataset includes
+source links, timestamps, and check results.
 
 `mostlyright-data` is the command-line client. It starts hosted research and build work, follows
 run status, and downloads completed Parquet datasets.

{mostlyright_data-0.9.2 → mostlyright_data-0.9.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mostlyright-data"
-version = "0.9.2"
+version = "0.9.4"
 description = "Mostly Right CLI for reproducible, reviewed Parquet datasets"
 readme = "README.md"
 requires-python = ">=3.13,<3.14"
@@ -69,6 +69,7 @@ mr-data-catalog-job = "mostlyright.data_harness.thin.workers:catalog_job_main"
 mr-data-crawler = "mostlyright.data_harness.thin.workers:crawler_main"
 mr-data-crawler-job = "mostlyright.data_harness.thin.workers:crawler_job_main"
 mr-data-producer = "mostlyright.data_harness.thin.workers:producer_main"
+mr-data-generic-api = "mostlyright.data_harness.thin.workers:generic_api_probe_main"
 mr-data-verifier = "mostlyright.data_harness.thin.workers:verifier_main"
 # The legacy Cloud Run service entrypoint remains available for rollback. The Job entrypoint is a
 # separate executable so an image revision cannot accidentally start the retired HTTP service.
@@ -80,7 +81,7 @@ mr-data-ingestion-job = "mostlyright.data_harness.thin.workers:ingestion_job_mai
 [project.optional-dependencies]
 build = [
     "hatchling==1.28.0",
-    "uv-build==0.9.26",
+    "uv-build==0.11.3",
 ]
 # Everything the local execution lane needs, and nothing the hosted lane does. Installing this
 # extra is what turns the thin client back into today's full product; `mr-data` detects its

{mostlyright_data-0.9.2 → mostlyright_data-0.9.4}/src/mostlyright/data_harness/acquisition/http.py

@@ -17,8 +17,8 @@ import time
 from collections.abc import Callable, Iterator, Mapping
 from dataclasses import dataclass, replace
 from pathlib import Path, PurePosixPath
-from typing import Protocol
-from urllib.parse import urljoin, urlsplit
+from typing import TYPE_CHECKING, Protocol
+from urllib.parse import unquote_to_bytes, urljoin, urlsplit
 
 try:
     import fcntl
@@ -44,6 +44,11 @@ from mostlyright.data_harness.formats import (
 )
 from mostlyright.data_harness.readers.registry import TOOLBOX, ReaderRegistry
 
+if TYPE_CHECKING:
+    from mostlyright.data_harness.sources.authenticated_https import (
+        AuthenticatedApiKeyConfiguration,
+    )
+
 MAX_HEADER_COUNT = 128
 MAX_HEADER_BYTES = 32_768
 REDIRECT_STATUSES = frozenset({301, 302, 303, 307, 308})
@@ -373,6 +378,276 @@ class _DatagovEchoObject(list[tuple[str, object]]):
     """JSON object retaining duplicate keys for authorization echo inspection."""
 
 
+class AuthenticatedApiKeyAuthorization:
+    """One-use API-key authorization with one owned mutable secret buffer.
+
+    Python's HTTP stack ultimately requires one immutable header string.  That runtime-owned
+    rendering cannot be zeroed by Python code; this carrier narrows it to the transport call,
+    drops every Harness reference immediately afterwards, and zeroes every mutable buffer it owns.
+    """
+
+    __slots__ = ("_closed", "_configuration", "_token", "_validity_check")
+
+    def __init__(
+        self,
+        *,
+        configuration: AuthenticatedApiKeyConfiguration,
+        token: bytes | bytearray | memoryview,
+        validity_check: Callable[[], None] | None = None,
+    ) -> None:
+        # Imported lazily because ``sources.__init__`` exports adapters that depend on this
+        # transport module.  Runtime import at module load would close that established cycle.
+        from mostlyright.data_harness.sources.authenticated_https import (
+            AUTHENTICATED_API_KEY_MAX_TOKEN_BYTES,
+            AuthenticatedApiKeyConfiguration,
+        )
+
+        if not isinstance(configuration, AuthenticatedApiKeyConfiguration):
+            raise AcquisitionSecurityError(
+                "AUTHENTICATED_CONFIG",
+                "validated authenticated API-key configuration is required",
+            )
+        if not isinstance(token, (bytes, bytearray, memoryview)):
+            raise AcquisitionSecurityError(
+                "AUTHENTICATED_TOKEN",
+                "token must be bounded printable ASCII bytes",
+            )
+        borrowed = memoryview(token).cast("B")
+        try:
+            if (
+                not 1 <= len(borrowed) <= AUTHENTICATED_API_KEY_MAX_TOKEN_BYTES
+                or borrowed[0] == ord(" ")
+                or borrowed[-1] == ord(" ")
+                or any(byte < 0x20 or byte > 0x7E for byte in borrowed)
+            ):
+                raise AcquisitionSecurityError(
+                    "AUTHENTICATED_TOKEN",
+                    "token must be 1..4096 printable ASCII bytes without edge whitespace",
+                )
+            self._token = bytearray(borrowed)
+        finally:
+            borrowed.release()
+        self._configuration = configuration
+        self._closed = False
+        self._validity_check = validity_check
+
+    def __repr__(self) -> str:
+        return (
+            "AuthenticatedApiKeyAuthorization("
+            f"configuration_id={self._configuration.configuration_id!r}, token=<redacted>)"
+        )
+
+    __str__ = __repr__
+
+    def __reduce_ex__(self, _protocol: int) -> object:
+        raise TypeError("AuthenticatedApiKeyAuthorization is not serializable")
+
+    def __copy__(self) -> object:
+        raise TypeError("AuthenticatedApiKeyAuthorization is not copyable")
+
+    def __deepcopy__(self, _memo: object) -> object:
+        raise TypeError("AuthenticatedApiKeyAuthorization is not copyable")
+
+    @property
+    def closed(self) -> bool:
+        return self._closed
+
+    def close(self) -> None:
+        _zero_mutable_buffer(self._token)
+        self._closed = True
+
+    def validate_target(self, url: str) -> None:
+        """Check current authority and destination without rendering a header value."""
+
+        from mostlyright.data_harness.sources.authenticated_https import (
+            parse_authenticated_api_key_query,
+        )
+        from mostlyright.data_harness.sources.contracts import SourceContractError
+
+        if self._closed:
+            raise AcquisitionSecurityError(
+                "AUTHENTICATED_TOKEN",
+                "authorization has already been consumed",
+            )
+        if self._validity_check is not None:
+            self._validity_check()
+        token = memoryview(self._token).toreadonly()
+        try:
+            decoded_url = unquote_to_bytes(url)
+        except Exception:
+            decoded_url = b""
+        try:
+            if _contains_octets(url.encode("utf-8", errors="ignore"), token) or _contains_octets(
+                decoded_url, token
+            ):
+                raise AcquisitionSecurityError(
+                    "AUTHENTICATED_SECRET",
+                    "request target contains credential material",
+                )
+        finally:
+            token.release()
+        try:
+            parse_authenticated_api_key_query(
+                {"url": url, "data_format": "csv", "filename": "source.csv"},
+                configuration=self._configuration,
+            )
+        except SourceContractError as error:
+            code = (
+                "AUTHENTICATED_SECRET"
+                if error.code == "AUTHENTICATED_SECRET"
+                else "AUTHENTICATED_ORIGIN"
+            )
+            raise AcquisitionSecurityError(
+                code,
+                "request is outside the configured authenticated HTTPS origin",
+            ) from None
+
+    @contextlib.contextmanager
+    def render_header(self, url: str) -> Iterator[tuple[str, str]]:
+        """Render the unavoidable immutable header only for the surrounding transport call."""
+
+        self.validate_target(url)
+        rendered_octets = bytearray(b"Bearer " if self._configuration.scheme == "bearer" else b"")
+        rendered_octets.extend(self._token)
+        rendered = rendered_octets.decode("ascii", errors="strict")
+        name = "Authorization" if self._configuration.scheme == "bearer" else "X-API-Key"
+        try:
+            yield name, rendered
+        finally:
+            rendered = ""
+            _zero_mutable_buffer(rendered_octets)
+
+    def reject_echoed_headers(self, headers: tuple[tuple[str, str], ...]) -> None:
+        token = memoryview(self._token).toreadonly()
+        try:
+            for name, value in headers:
+                for text in (name, value):
+                    candidate = bytearray(text, "utf-8")
+                    try:
+                        if _contains_json_equivalent_token(candidate, token):
+                            raise AcquisitionSecurityError(
+                                "AUTHENTICATED_SECRET_ECHO",
+                                "authenticated response echoed credential material "
+                                "and was not retained",
+                            )
+                    finally:
+                        _zero_mutable_buffer(candidate)
+        finally:
+            token.release()
+
+    def reject_echoed_response(self, payload: bytes) -> None:
+        token = memoryview(self._token).toreadonly()
+        try:
+            if _contains_json_equivalent_token(payload, token):
+                raise AcquisitionSecurityError(
+                    "AUTHENTICATED_SECRET_ECHO",
+                    "authenticated response echoed credential material and was not retained",
+                )
+        finally:
+            token.release()
+
+
+_JSON_SHORT_ESCAPES = {
+    ord('"'): ord('"'),
+    ord("/"): ord("/"),
+    ord("\\"): ord("\\"),
+    ord("b"): 0x08,
+    ord("f"): 0x0C,
+    ord("n"): 0x0A,
+    ord("r"): 0x0D,
+    ord("t"): 0x09,
+}
+
+
+def _zero_mutable_buffer(value: bytearray) -> None:
+    for index in range(len(value)):
+        value[index] = 0
+
+
+def _contains_octets(
+    value: bytes | bytearray,
+    token: bytes | bytearray | memoryview,
+) -> bool:
+    """Linear-time subsequence search without materializing an immutable token copy."""
+
+    if not token or len(token) > len(value):
+        return False
+    prefix = [0] * len(token)
+    matched = 0
+    for index in range(1, len(token)):
+        while matched and token[index] != token[matched]:
+            matched = prefix[matched - 1]
+        if token[index] == token[matched]:
+            matched += 1
+            prefix[index] = matched
+    matched = 0
+    for byte in value:
+        while matched and byte != token[matched]:
+            matched = prefix[matched - 1]
+        if byte == token[matched]:
+            matched += 1
+            if matched == len(token):
+                return True
+    return False
+
+
+def _contains_json_equivalent_token(
+    value: bytes | bytearray,
+    token: bytes | bytearray | memoryview,
+) -> bool:
+    """Find a token through every bounded reversible ASCII JSON-escape layer.
+
+    Each successful pass strictly shortens the already transport-bounded input.  An additional
+    JSON layer must at least double the escaping backslashes, so ``bit_length + 1`` passes reach a
+    fixed point for every representable nesting depth without an attacker-controlled loop count.
+    Unknown and non-ASCII escapes remain literal.  If that mathematical bound is ever exhausted
+    before a fixed point, fail closed and classify the value as an echo.
+    """
+
+    current: bytes | bytearray = value
+    owned: list[bytearray] = []
+    maximum_passes = max(1, len(value).bit_length() + 1)
+    try:
+        for _ in range(maximum_passes):
+            if _contains_octets(current, token):
+                return True
+            normalized = bytearray()
+            owned.append(normalized)
+            changed = False
+            index = 0
+            while index < len(current):
+                byte = current[index]
+                if byte != ord("\\") or index + 1 >= len(current):
+                    normalized.append(byte)
+                    index += 1
+                    continue
+                escaped = current[index + 1]
+                short = _JSON_SHORT_ESCAPES.get(escaped)
+                if short is not None:
+                    normalized.append(short)
+                    index += 2
+                    changed = True
+                    continue
+                if escaped == ord("u") and index + 6 <= len(current):
+                    digits = current[index + 2 : index + 6]
+                    if all(digit in b"0123456789abcdefABCDEF" for digit in digits):
+                        codepoint = int(digits, 16)
+                        if codepoint <= 0x7F:
+                            normalized.append(codepoint)
+                            index += 6
+                            changed = True
+                            continue
+                normalized.append(byte)
+                index += 1
+            if not changed:
+                return False
+            current = normalized
+        return True
+    finally:
+        for buffer in owned:
+            _zero_mutable_buffer(buffer)
+
+
 def _require_datagov_key_stat(info: os.stat_result) -> None:
     if (
         not stat.S_ISREG(info.st_mode)
@@ -675,6 +950,8 @@ class PinnedTransport(Protocol):
         headers: Mapping[str, str],
         limits: RetrievalLimits,
         byte_range: ByteRange | None = None,
+        method: str = "GET",
+        body: bytes | None = None,
     ) -> TransportResponse:
         """Connect only to approved_ip while verifying target.hostname in TLS.
 
@@ -791,6 +1068,11 @@ class RetrievalHop:
     etag: str | None = None
     last_modified: str | None = None
     peer_attempts: tuple[PeerAttempt, ...] = ()
+    # The ordinary transport digest intentionally remains stable for every existing public
+    # connector.  Authenticated verification additionally needs the complete resolver-approved
+    # set to rederive ``resolution_digest`` without either repeating the request or receiving the
+    # credential, so the pinned retriever retains it alongside (but not inside) ``to_dict``.
+    approved_ips: tuple[str, ...] = ()
 
     def to_dict(self) -> dict[str, object]:
         # Both range keys are always present, ``None`` when the hop ordered no slice, so a hop
@@ -811,6 +1093,23 @@ class RetrievalHop:
             "peer_attempts": [attempt.to_dict() for attempt in self.peer_attempts],
         }
 
+    def authenticated_attestation_dict(self) -> dict[str, object]:
+        """Return the complete secret-free facts proved by the pinned HTTPS boundary."""
+
+        if not self.approved_ips:
+            raise AcquisitionSecurityError(
+                "TRANSPORT_EVIDENCE",
+                "authenticated hop omitted its resolver-approved address set",
+            )
+        return {
+            **self.to_dict(),
+            "approved_ips": list(self.approved_ips),
+            # A hop is constructed only after both checks pass.  Retaining the predicates makes
+            # that invariant explicit and independently parseable in the verifier evidence.
+            "tls_verified": True,
+            "hostname_verified": True,
+        }
+
 
 @dataclass(frozen=True)
 class ProbeTransport:
@@ -884,6 +1183,10 @@ class RetrievedBytes:
     transport_evidence_digest: str
     complete_size_bytes: int | None = None
     rate_observation: DatagovRateObservation | None = None
+    # Link pagination needs the terminal headers while it is in flight.  They deliberately
+    # remain outside ``RetrievalHop`` and its durable digest: publisher-controlled header text
+    # is not receipt evidence and may never be persisted by the adapter.
+    response_headers: tuple[tuple[str, str], ...] = ()
 
     @property
     def total_response_body_size_bytes(self) -> int:
@@ -1189,6 +1492,67 @@ class PinnedHttpsRetriever:
             datagov_response_observed=on_response_observed,
         )
 
+    def retrieve_authenticated(
+        self,
+        url: str,
+        authorization: AuthenticatedApiKeyAuthorization,
+    ) -> RetrievedBytes:
+        """Perform one exact-origin CSV GET and consume ``authorization`` on every outcome."""
+
+        if not isinstance(authorization, AuthenticatedApiKeyAuthorization):
+            raise AcquisitionSecurityError(
+                "AUTHENTICATED_TOKEN",
+                "strict authenticated API-key authorization is required",
+            )
+        try:
+            authorization.validate_target(url)
+            try:
+                retrieved = self._fetch(
+                    url,
+                    byte_range=None,
+                    presence_probe=False,
+                    datagov_authorization=None,
+                    authenticated_authorization=authorization,
+                )
+            except AcquisitionSecurityError as error:
+                if error.code.startswith("AUTHENTICATED_"):
+                    raise
+                raise AcquisitionSecurityError(
+                    "AUTHENTICATED_RETRIEVAL",
+                    "authenticated retrieval failed before content could be retained",
+                ) from None
+            except Exception:
+                raise AcquisitionSecurityError(
+                    "AUTHENTICATED_TRANSPORT",
+                    "authenticated transport failed before content could be retained",
+                ) from None
+            if retrieved.media_type not in DIRECT_FETCH_MEDIA_TYPES["csv"]:
+                raise AcquisitionSecurityError(
+                    "AUTHENTICATED_MEDIA_TYPE",
+                    "authenticated response is not an admitted CSV media type",
+                )
+            return retrieved
+        finally:
+            authorization.close()
+
+    def retrieve_frozen_authenticated_request(
+        self, url: str, *, method: str, headers: Mapping[str, str], body: bytes | None
+    ) -> RetrievedBytes:
+        """Run a prevalidated generic adapter request through the pinned HTTPS machinery."""
+        if method not in {"GET", "POST"} or (method == "GET" and body is not None):
+            raise AcquisitionSecurityError(
+                "AUTHENTICATED_REQUEST", "frozen request method is invalid"
+            )
+        return self._fetch(
+            url,
+            byte_range=None,
+            presence_probe=False,
+            datagov_authorization=None,
+            frozen_headers=headers,
+            frozen_method=method,
+            frozen_body=body,
+        )
+
     def probe_presence(self, url: str) -> bool:
         """Ask one address whether it is published, keep nothing, and answer yes or no.
 
@@ -1246,9 +1610,13 @@ class PinnedHttpsRetriever:
         byte_range: ByteRange | None,
         presence_probe: bool,
         datagov_authorization: DatagovV4Authorization | None,
+        authenticated_authorization: AuthenticatedApiKeyAuthorization | None = None,
         datagov_response_observed: (
             Callable[[int, int, DatagovRateObservation | None], None] | None
         ) = None,
+        frozen_headers: Mapping[str, str] | None = None,
+        frozen_method: str = "GET",
+        frozen_body: bytes | None = None,
     ) -> RetrievedBytes:
         started = float(self._clock())
         current_url = url
@@ -1256,7 +1624,11 @@ class PinnedHttpsRetriever:
         aggregate_response_bytes = 0
         requests = 0
         deadline = started + self._limits.total_timeout_seconds
-        redirect_budget = 0 if datagov_authorization is not None else self._limits.max_redirects
+        redirect_budget = (
+            0
+            if datagov_authorization is not None or authenticated_authorization is not None
+            else self._limits.max_redirects
+        )
         for redirect_count in range(redirect_budget + 1):
             self._check_total_timeout(started)
             target = validate_public_https_url(
@@ -1268,12 +1640,22 @@ class PinnedHttpsRetriever:
                 # A presence probe asks for anything, because it admits anything: sending the
                 # acquisition allowlist would invite a 406 for a run that is published and
                 # fine, which is the same false failure the admission exemption removes.
-                "Accept": "*/*" if presence_probe else _accept_header(self._limits),
+                "Accept": (
+                    "*/*"
+                    if presence_probe
+                    else (
+                        ", ".join(sorted(DIRECT_FETCH_MEDIA_TYPES["csv"]))
+                        if authenticated_authorization is not None
+                        else _accept_header(self._limits)
+                    )
+                ),
                 "Accept-Encoding": "identity",
                 "Connection": "close",
                 "Host": urlsplit(target.normalized_url).netloc,
                 "User-Agent": self._limits.user_agent,
             }
+            if frozen_headers is not None:
+                headers.update(frozen_headers)
             if datagov_authorization is not None:
                 name, value = datagov_authorization.header_for(target.normalized_url)
                 headers[name] = value
@@ -1296,7 +1678,18 @@ class PinnedHttpsRetriever:
                         deadline,
                         remaining_aggregate_bytes=remaining_aggregate_bytes,
                     )
+                    if authenticated_authorization is not None:
+                        attempt_limits = replace(
+                            attempt_limits,
+                            max_redirects=0,
+                            max_requests=1,
+                        )
                 except AcquisitionSecurityError as exc:
+                    if authenticated_authorization is not None:
+                        raise AcquisitionSecurityError(
+                            "AUTHENTICATED_TRANSPORT",
+                            "authenticated transport failed before content could be retained",
+                        ) from None
                     raise PeerAttemptError(
                         exc.code,
                         exc.detail,
@@ -1307,14 +1700,47 @@ class PinnedHttpsRetriever:
                     # One budget, one clock: every peer and limiter wait is bounded by the
                     # same absolute instant. A fallback never starts a second DNS epoch.
                     with self._limiter.acquire(target.hostname, deadline=deadline):
-                        response = self._transport.request(
-                            target,
-                            approved_ip=approved_ip,
-                            headers=headers,
-                            limits=attempt_limits,
-                            byte_range=byte_range,
-                        )
+                        request_headers = headers
+                        if authenticated_authorization is None:
+                            request_kwargs = {"byte_range": byte_range}
+                            if (
+                                frozen_method != "GET"
+                                or frozen_body is not None
+                                or frozen_headers is not None
+                            ):
+                                request_kwargs.update(
+                                    {"method": frozen_method, "body": frozen_body}
+                                )
+                            response = self._transport.request(
+                                target,
+                                approved_ip=approved_ip,
+                                headers=headers,
+                                limits=attempt_limits,
+                                **request_kwargs,
+                            )
+                        else:
+                            request_headers = dict(headers)
+                            try:
+                                with authenticated_authorization.render_header(
+                                    target.normalized_url
+                                ) as (name, value):
+                                    request_headers[name] = value
+                                    response = self._transport.request(
+                                        target,
+                                        approved_ip=approved_ip,
+                                        headers=request_headers,
+                                        limits=attempt_limits,
+                                        byte_range=byte_range,
+                                    )
+                            finally:
+                                request_headers.clear()
+                                name = value = ""
                 except AcquisitionSecurityError as exc:
+                    if authenticated_authorization is not None:
+                        raise AcquisitionSecurityError(
+                            "AUTHENTICATED_TRANSPORT",
+                            "authenticated transport failed before content could be retained",
+                        ) from None
                     if exc.code == "TRANSPORT_FAILURE" and not isinstance(
                         exc, TransportFailureError
                     ):
@@ -1370,6 +1796,13 @@ class PinnedHttpsRetriever:
                     raise PeerAttemptError(
                         failure_code, detail, tuple(peer_attempts), hops=tuple(hops)
                     ) from None
+                except Exception:
+                    if authenticated_authorization is not None:
+                        raise AcquisitionSecurityError(
+                            "AUTHENTICATED_TRANSPORT",
+                            "authenticated transport failed before content could be retained",
+                        ) from None
+                    raise
                 peer_attempts.append(
                     PeerAttempt(
                         approved_ip=approved_ip,
@@ -1447,6 +1880,15 @@ class PinnedHttpsRetriever:
                         aggregate_response_bytes,
                         datagov_rate_observation,
                     )
+            elif authenticated_authorization is not None:
+                authenticated_authorization.reject_echoed_headers(normalized_headers)
+                if response.status in REDIRECT_STATUSES:
+                    raise AcquisitionSecurityError(
+                        "AUTHENTICATED_REDIRECT",
+                        "authenticated responses never follow redirects",
+                    )
+                authenticated_authorization.reject_echoed_response(response.body)
+                datagov_rate_observation = None
             else:
                 datagov_rate_observation = None
             if len(response.body) > attempt_limits.max_response_bytes:
@@ -1520,6 +1962,7 @@ class PinnedHttpsRetriever:
                 etag=self._response_header(response, "etag", peer_attempts, hops),
                 last_modified=self._response_header(response, "last-modified", peer_attempts, hops),
                 peer_attempts=tuple(peer_attempts),
+                approved_ips=target.approved_ips,
             )
             hops.append(hop)
             # The delivery check.  A slice is delivered only when the server answered 206,
@@ -1672,6 +2115,7 @@ class PinnedHttpsRetriever:
                 transport_evidence_digest=evidence_digest,
                 complete_size_bytes=complete_size_bytes,
                 rate_observation=datagov_rate_observation,
+                response_headers=tuple(normalized_headers),
             )
         raise AcquisitionSecurityError("REDIRECT_LIMIT", "redirect loop did not terminate")
 
@@ -1805,6 +2249,8 @@ class StdlibPinnedTransport:
         headers: Mapping[str, str],
         limits: RetrievalLimits,
         byte_range: ByteRange | None = None,
+        method: str = "GET",
+        body: bytes | None = None,
     ) -> TransportResponse:
         outgoing = dict(headers)
         if byte_range is not None:
@@ -1819,7 +2265,7 @@ class StdlibPinnedTransport:
         )
         total = 0
         try:
-            connection.request("GET", target.request_target, headers=outgoing)
+            connection.request(method, target.request_target, body=body, headers=outgoing)
             if connection.sock is not None:
                 connection.sock.settimeout(
                     _remaining_socket_timeout(