fix(network): recheck resolution freshness at socket use

[seonghobae]

Follow-up to #50 / #47.

Buyer/security gap

The stacked prerequisite #50 removes the ordinary public untimed planning bypass, but its FreshConnectionPlan::new checked resolution freshness only when the plan was created. A caller could authorize a plan inside the validity window, delay, and then invoke socket I/O after that authority expired. That preserved a plan-to-connect TOCTOU gap.

TDD and RCA evidence

This draft is stacked on exact #50 head f8b43bc94444986ab23aa4ef3086e446a0b39295.

RED was established at exact test-only head 25bcc848b008fef8d3f2bd98de38afafbd10b3b4: repository contracts and rustfmt passed, then cargo check --locked --workspace --all-targets failed because the public production boundary had no connect_at socket-use freshness recheck.

The implementation was then refined after inspecting the existing destination error taxonomy and real first-party TLS consumers. Rather than duplicate freshness errors or leave an unsafe compatibility bypass, current exact head ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e now:

• retains the exact FreshResolutionSnapshot and socket authority inside the single-use plan;
• exposes connect_at(current_time) so authority-bearing callers re-run destination freshness immediately before socket I/O under the same trusted monotonic clock domain;
• preserves the existing typed DestinationError::ResolutionApprovalExpired / ResolutionUseBeforeApproval outcomes through NetworkError::DestinationNotApproved instead of inventing a parallel taxonomy;
• rejects a supplied socket-use time earlier than the plan's own authorization checkpoint;
• keeps the existing connect() compatibility surface only as a fail-closed path: plan creation anchors a process-local monotonic Instant, and the method adds actual elapsed time to the admitted authorization time before delegating to connect_at, so delayed legacy callers cannot replay a stale plan indefinitely; and
• proves the compatibility path expires with a short-lived real monotonic test, while the explicit path proves success, deadline expiry, authorization-time regression, and unchanged connection-parameter validation.

No DNS lookup, hostname reconnect, ambient proxy/PAC, or wall-clock authority was added.

Exact-head evidence

On unchanged exact head ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e against exact prerequisite #50 head f8b43bc94444986ab23aa4ef3086e446a0b39295:

• CI run 31418337788: success;
• repository Python contracts: success;
• cargo fmt --all --check: success;
• locked workspace/all-target check: success;
• all workspace tests: success;
• strict Clippy: success;
• rustdoc/API documentation: success;
• exact owned production function/line/region/branch coverage: success;
• CodeRabbit exact-head commit status: success;
• GitHub reports the PR mergeable; and
• no formal reviews or inline review threads are currently returned.

No predecessor-head result is transferred to this exact head.

Scope boundary

No resolver adapter, DNS lookup, wall-clock clock source, proxy/PAC, TLS policy change, HTTP, browser control, persistence, secret, model call, workflow mutation, or release claim is introduced. The explicit path still requires one caller-owned trusted monotonic clock domain; the compatibility path uses only a process-local monotonic elapsed-time anchor to prevent stale replay.

Keep Draft while #50 and #47 remain active. Canonical whole-product documentation remains owned by PR #44; this active PR must not be described as protected-main shipped truth.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 195cf21d-f0cc-49fe-8eb6-17d533ab754d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}