fix(network): recheck resolution freshness at socket use

[seonghobae]

Follow-up to #50 / #47.

Buyer/security gap

The stacked prerequisite #50 removes the ordinary public untimed planning bypass, but its FreshConnectionPlan::new checks resolution freshness only when the plan is created. A caller could authorize a plan inside the validity window, delay, and then invoke socket I/O after that authority expired. That preserves a plan-to-connect TOCTOU gap unless freshness is rechecked at actual socket use.

TDD and implemented boundary

The original test-only line established the missing immediate-use boundary before production support. The implementation then:

• retains the exact FreshResolutionSnapshot and socket authority inside the single-use plan;
• exposes connect_at(current_time) so authority-bearing callers re-run destination freshness immediately before socket I/O under the same trusted monotonic clock domain;
• preserves the existing typed DestinationError::ResolutionApprovalExpired / ResolutionUseBeforeApproval outcomes through NetworkError::DestinationNotApproved;
• rejects a supplied socket-use time earlier than the plan's authorization checkpoint;
• keeps connect() only as a fail-closed compatibility surface backed by a process-local monotonic Instant, preventing delayed replay of stale plans; and
• proves explicit success, exclusive-deadline expiry, authorization-time regression, compatibility-path expiry, and unchanged connection-parameter validation.

No DNS lookup, hostname reconnect, ambient proxy/PAC, or wall-clock authority is added.

Live dependency alignment

PR #50 is now at exact head 3f7fe102951a6d5b224b36097d40216cec37b5d9. This branch is already non-destructively aligned to that exact prerequisite: current base metadata is #50 head 3f7fe102951a6d5b224b36097d40216cec37b5d9, current contributor head is 8030c6d843a0f860b465c15b06c822d4c9b47831, and a fresh exact compare reports ahead 8 / behind 0 with merge base equal to the live prerequisite.

The current semantic delta relative to #50 is only two files: crates/originweave-network/src/fresh_connection.rs and crates/originweave-network/tests/fresh_resolution_plan.rs. Earlier references to prerequisite 135851a6050fdc658c111f3256c8f6b55c63c602 and contributor 8b8a5b443ad4620613b79f381db3fbe4d5a5f994 are historical lineage only; they are not current base/head proof.

Current exact-head evidence

On unchanged exact head 8030c6d843a0f860b465c15b06c822d4c9b47831 against exact prerequisite 3f7fe102951a6d5b224b36097d40216cec37b5d9:

• CI run 31980345148: success;
• Rust contracts job 95245964858: success, including repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc;
• Production coverage job 95245964907: success, including exact owned-production function/line/region/branch enforcement;
• fresh ancestry: ahead 8 / behind 0, merge base equal to the exact current feat(network): require fresh resolution authority before socket planning #50 head;
• GitHub reports the Draft mergeable against the current feat(network): require fresh resolution authority before socket planning #50 base;
• formal reviews currently returned: none; and
• inline review threads currently returned: none.

Security/SAST/central review workflows were not produced for this Draft stacked base and are therefore absent, not represented as passing evidence. No predecessor-head, prerequisite-head, skipped, queued, cancelled, synthetic-merge, status-only, or model-only evidence is promoted as current proof.

Scope / governance boundary

No resolver adapter, DNS lookup, wall-clock clock source, proxy/PAC, TLS policy change, HTTP, browser control, persistence, secret, model call, workflow mutation, or release claim is introduced. The explicit path still requires one caller-owned trusted monotonic clock domain; the compatibility path uses a process-local monotonic elapsed-time anchor only to prevent stale replay.

Keep Draft while #50 and #47 remain active. No prerequisite check, review, mergeability, or approval evidence transfers. Passing automation is not independent approval. The active organization ruleset requires one independent approving review, dismissal of stale reviews after pushes, latest-push approval, and resolved review threads for protected-main integration; no bypass actors are configured. The scheduled actor does not merge, self-approve, alter workflows, weaken checks, add secrets, tag, or publish.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c273bac1-323c-447a-9157-b4f46d475029

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}