{"row":{"n":"0008","slug":"nep-0008-egress-permit-bound","file":"nep-0008-egress-permit-bound.md","headline":"The sandboxed egress proxy is the permit's exact projection","title":"The sandboxed egress proxy is the exact projection of `permits.net.http` — exact-host allowlists, proxy-side DNS, a normative port floor, one allowlist per run, and no dead grants","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 through NEP-0006 hardened WHAT the boundary refuses; NEP-0007\nmade the refusal attributable.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Rationale","anchor":"rationale"},{"title":"Backwards Compatibility","anchor":"backwards-compatibility"},{"title":"Reference Implementation","anchor":"reference-implementation"},{"title":"Deferred (P2, by decision)","anchor":"deferred-p2-by-decision"},{"title":"Copyright","anchor":"copyright"}],"words":1189,"sha256":"7193b92df0e733bf9f0a85d812e697187c2cbdcf6a357db61f5ee8d02a988017"},"prev":{"n":"0007","slug":"nep-0007-trace-format-and-equivalence","file":"nep-0007-trace-format-and-equivalence.md","headline":"The trace leaves the private dialect: a normative journal, a required witness, a differential oracle","title":"The run journal is a versioned chapter of the spec, every permit decision is a required trace frame, and check ⇔ run agreement is proven by a differential oracle","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 through NEP-0006 hardened WHAT the boundary refuses.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1095,"sha256":"730f680968ff38df66acbeecd1d2647a6528789cd0f9bb2d526f01296c5ec3dc"},"next":{"n":"0009","slug":"nep-0009-effective-path-identity","file":"nep-0009-effective-path-identity.md","headline":"A path grant names an effective path identity, re-judged at dispatch","title":"A path grant names an effective path identity, re-judged at dispatch — escape is refused, never rewritten, on every enforcement arm","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 decided WHAT the boundary grants; NEP-0008 projected that\njudgment onto network egress.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Rationale","anchor":"rationale"},{"title":"Backwards Compatibility","anchor":"backwards-compatibility"},{"title":"Reference Implementation","anchor":"reference-implementation"},{"title":"Deferred (named follow-ons)","anchor":"deferred-named-follow-ons"},{"title":"Copyright","anchor":"copyright"}],"words":1005,"sha256":"03c85cceb829958b2f7cba3598090dc657252d8d96445a73f088d742d4ee32f3"},"total":18}

[{"k":"h","depth":1,"text":"NEP-0008 · The sandboxed egress proxy is the permit's exact projection","id":"nep-0008--the-sandboxed-egress-proxy-is-the-permits-exact-projection"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"NEP"},{"k":"text","text":": 0008 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint · 0005 the environment permit · 0006 the data-as-code sink · 0007 the trace and the equivalence oracle)"}],[{"k":"strong","text":"Title"},{"k":"text","text":": The sandboxed egress proxy is the exact projection of "},{"k":"code","text":"permits.net.http"},{"k":"text","text":" — exact-host allowlists, proxy-side DNS, a normative port floor, one allowlist per run, and no dead grants"}],[{"k":"strong","text":"Author"},{"k":"text","text":": Thibaut Melen (SuperNovae Studio)"}],[{"k":"strong","text":"Status"},{"k":"text","text":": Draft"}],[{"k":"strong","text":"Type"},{"k":"text","text":": Standards Track"}],[{"k":"strong","text":"Created"},{"k":"text","text":": 2026-07-23"}]]},{"k":"h","depth":2,"text":"Abstract","id":"abstract"},{"k":"p","inline":[{"k":"text","text":"NEP-0003 through NEP-0006 hardened WHAT the boundary refuses; NEP-0007\nmade the refusal attributable. This NEP hardens the network egress of the\nsandboxed "},{"k":"code","text":"exec"},{"k":"text","text":" step: the loopback egress proxy the engine spawns for a\n"},{"k":"code","text":"net.http"},{"k":"text","text":" allowlist IS the permit, projected — nothing more may pass,\nnothing declared may silently fail. Five laws make the projection exact:\nthe allowlist is exact-host (the "},{"k":"code","text":"*."},{"k":"text","text":" glob is refused at check), DNS is\nresolved by the proxy and never by the client, the dangerous-port floor\nrides beneath every permit, one run carries one allowlist, and a\nfloor-blocked entry is a dead grant flagged at check. The proxy stays\nTLS-blind by design: it observes the CONNECT authority and byte counts,\nnever the content — and it journals every verdict."}]},{"k":"h","depth":2,"text":"Motivation","id":"motivation"},{"k":"p","inline":[{"k":"text","text":"The wildcard is the measured attack surface, not a convenience. The 2026\nsandbox-egress incident record (the srt network-allowlist bypasses · « one\noutside report is luck, two is implementation ») shows the "},{"k":"code","text":"*."},{"k":"text","text":" grant\ndelegating the permit to the zone operator: "},{"k":"code","text":"*.github.io"},{"k":"text","text":" is every tenant\nof a shared-hosting zone, including an attacker's. A contract whose\neffective authority depends on who else lives in the zone is ambient\nauthority — the exact property the contract system exists to eliminate\n(invariant 1 · zero ambient authority). The bare "},{"k":"code","text":"*"},{"k":"text","text":" remains legal as the\nexplicit, visible, non-stealthy escape ("},{"k":"code","text":"NetPolicy::Allow"},{"k":"text","text":"); what dies is\nthe stealthy middle."}]},{"k":"p","inline":[{"k":"text","text":"Second, the engine's DNS-rebinding fix (per-address floor check inside\nthe dial loop · no resolve-then-connect window) shipped as a stopgap:\nthe code said yes while the module doc still documented the hole as\naccepted and the spec's « DNS-rebinding stays covered » sentence did not\nname the exec arm. This NEP turns the stopgap into law — a divergence\nbetween doc and code is a finding, never a stable state."}]},{"k":"p","inline":[{"k":"text","text":"Third, dead grants. An exact entry naming a floor-blocked target (cloud\nmetadata, RFC1918, link-local, CGN) can never take effect — the floor\nrefuses it at dial — yet nothing flagged it at check: the contract lied\nby omission. NEP-0005 established the dead-grant teaching for the env\nplane ("},{"k":"code","text":"NIKA-AUTH-009"},{"k":"text","text":"); this NEP applies it to the net plane\n("},{"k":"code","text":"NIKA-AUTH-011"},{"k":"text","text":")."}]},{"k":"h","depth":2,"text":"Specification","id":"specification"},{"k":"p","inline":[{"k":"text","text":"The law (MUST):"}]},{"k":"list","ordered":true,"items":[[{"k":"strong","text":"Exact-host allowlists."},{"k":"text","text":" Every "},{"k":"code","text":"permits.net.http"},{"k":"text","text":" entry is an exact\nhost name or literal. An entry carrying a "},{"k":"code","text":"*"},{"k":"text","text":" in any position other\nthan the whole bare-"},{"k":"code","text":"*"},{"k":"text","text":" entry is refused at check\n("},{"k":"code","text":"NIKA-AUTH-010"},{"k":"text","text":" · "},{"k":"code","text":"security_error"},{"k":"text","text":"). The bare "},{"k":"code","text":"*"},{"k":"text","text":" stays legal and\nkeeps its meaning (explicit full egress, "},{"k":"code","text":"NetPolicy::Allow"},{"k":"text","text":")."}],[{"k":"strong","text":"Proxy-side DNS."},{"k":"text","text":" Under a "},{"k":"code","text":"net.http"},{"k":"text","text":" allowlist, the confined\nclient's own resolver fails closed (the OS fence refuses it); the\nproxy resolves and re-checks EVERY resolved address against the SSRF\nfloor inside the dial loop. A permitted name resolving to a blocked\naddress refuses at dial ("},{"k":"code","text":"NIKA-SEC-005"},{"k":"text","text":") — there is no\nresolve-then-connect window."}],[{"k":"strong","text":"The port floor is normative."},{"k":"text","text":" The engine's dangerous-egress-port\ndenylist applies beneath every permit; no permit overrides it."}],[{"k":"strong","text":"One run, one allowlist."},{"k":"text","text":" A run projecting two distinct "},{"k":"code","text":"net.http"},{"k":"text","text":"\nsets refuses fail-closed at the second projection\n("},{"k":"code","text":"conflicting_boundary"},{"k":"text","text":"). There is no ambient merge of egress\nboundaries inside one run."}],[{"k":"strong","text":"No dead grants."},{"k":"text","text":" An exact entry naming a private / link-local /\nCGN / metadata / otherwise non-public address is an inert dead grant,\nrefused at check under the floor parity ("},{"k":"code","text":"NIKA-SEC-005"},{"k":"text","text":" — the engine\nhas enforced this class since the floor parity pass; this NEP graves\nthe rule in the spec text and adds the reference-oracle mirror and\nfixture). The only declassifiable target stays the exact loopback\nliteral (01-envelope §exact-loopback declassification · the closed\nvocabulary: bare "},{"k":"code","text":"localhost"},{"k":"text","text":", a "},{"k":"code","text":"127/8"},{"k":"text","text":" literal, "},{"k":"code","text":"::1"},{"k":"text","text":")."}],[{"k":"strong","text":"Attestation."},{"k":"text","text":" The proxy journals every verdict — allowed, refused,\nand relayed byte counts per connection — through the run journal's\negress observer events. The proxy is TLS-blind: content is never\nobserved, terminated, or injected (a voluntary MITM is REFUSED as an\narchitecture)."}]]},{"k":"h","depth":2,"text":"Rationale","id":"rationale"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"Exact-host over bounded-globs."},{"k":"text","text":" A maintained denylist of shared\nzones ("},{"k":"code","text":"*.github.io"},{"k":"text","text":", "},{"k":"code","text":"*.workers.dev"},{"k":"text","text":", …) is perpetual debt and can\nnever be complete. Refusing the glob form is total and measured free:\na full sweep of the tracked fixture corpus found zero "},{"k":"code","text":"*."},{"k":"text","text":" usage in\n"},{"k":"code","text":"net.http"},{"k":"text","text":" (0/73 files at the decision date). Re-admission, if ever\nneeded, comes through a future NEP with a lint — never silently."}],[{"k":"strong","text":"Proxy-side DNS over client-side filtering."},{"k":"text","text":" Checking the name\nstatically and resolving at the client leaves the rebinding window\n(the name resolves differently at dial). Checking each resolved\naddress inside the dial loop closes the window without trusting the\nclient's resolver at all — the fence makes the confined client's DNS\nfail-closed, so the proxy is the only resolver by construction."}],[{"k":"strong","text":"TLS-blind as a feature."},{"k":"text","text":" The voluntary-MITM alternative (terminating\nTLS at the proxy to inspect content) would put the engine in the\ncontent path, expand the TCB with a root-of-trust installation, and\nbreak certificate pinning. The blind proxy keeps the honest envelope:\nhost, port, byte counts — which is exactly what the receipt may claim."}],[{"k":"strong","text":"One allowlist per run."},{"k":"text","text":" Keying proxies per boundary set is\nmechanically simple but multiplies the enforcement surfaces a reviewer\nmust hold in their head; the single boundary keeps the projection\nauditable. A composition need (two tasks, two sets) is served by two\nruns — or by a future NEP."}]]},{"k":"h","depth":2,"text":"Backwards Compatibility","id":"backwards-compatibility"},{"k":"p","inline":[{"k":"text","text":"Breaking by design, measured empty: the "},{"k":"code","text":"*."},{"k":"text","text":" form in "},{"k":"code","text":"net.http"},{"k":"text","text":" was\naccepted before this NEP and is now refused at check. The tracked\nfixture corpus (73 files) and the pack templates carried zero such\nentries at the decision date. Authors depending on a glob move to exact\nhost lists, or to the explicit bare "},{"k":"code","text":"*"},{"k":"text","text":" where full egress is genuinely\nintended."}]},{"k":"h","depth":2,"text":"Reference Implementation","id":"reference-implementation"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"The engine lane ("},{"k":"code","text":"feat/f-p5-egress-permit-bound"},{"k":"text","text":"): the check finding\n("},{"k":"code","text":"NIKA-AUTH-010"},{"k":"text","text":" wildcard refusal), the proxy metering events (relayed\nbyte counts), and the module-doc truth (the rebinding refusal is law,\nnot an accepted limit). The dead-grant class (law 5) already rides the\nfloor parity ("},{"k":"code","text":"NIKA-SEC-005"},{"k":"text","text":") and stays untouched."}],[{"k":"text","text":"Conformance fixtures: "},{"k":"code","text":"tests/core/authority/025-net-http-wildcard-refused"},{"k":"text","text":"\n("},{"k":"code","text":"NIKA-AUTH-010"},{"k":"text","text":") and "},{"k":"code","text":"tests/core/authority/026-net-dead-grant-floor-blocked"},{"k":"text","text":"\n("},{"k":"code","text":"NIKA-SEC-005"},{"k":"text","text":"), with the reference oracle mirroring both laws."}]]},{"k":"h","depth":2,"text":"Deferred (P2, by decision)","id":"deferred-p2-by-decision"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Port sets in the permit form ("},{"k":"code","text":"{host, ports}"},{"k":"text","text":") and a distinct\n"},{"k":"code","text":"net.tcp"},{"k":"text","text":" dimension — the port floor (law 3) suffices for v1."}],[{"k":"text","text":"The credential-injection proxy mode (reverse-proxy TLS origination with\nkeyring-held credentials and session tokens · the nono Mode-2 pattern) —\na second proxy, not a hardening of this one; the plain-HTTP "},{"k":"code","text":"405"},{"k":"text","text":" seam\nis the documented attachment point."}],[{"k":"text","text":"Per-set keyed egress proxies (the composition escape from law 4)."}]]},{"k":"h","depth":2,"text":"Copyright","id":"copyright"},{"k":"p","inline":[{"k":"text","text":"This document is placed in the public domain under CC0-1.0, as every NEP."}]}]

NEP-0008

The sandboxed egress proxy is the permit's exact projection

Draft · Standards Track · opened 2026-07-23 · 1189 words

NEP-0008 · The sandboxed egress proxy is the permit's exact projection #

NEP: 0008 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint · 0005 the environment permit · 0006 the data-as-code sink · 0007 the trace and the equivalence oracle)
Title: The sandboxed egress proxy is the exact projection of permits.net.http — exact-host allowlists, proxy-side DNS, a normative port floor, one allowlist per run, and no dead grants
Author: Thibaut Melen (SuperNovae Studio)
Status: Draft
Type: Standards Track
Created: 2026-07-23

Abstract #

NEP-0003 through NEP-0006 hardened WHAT the boundary refuses; NEP-0007 made the refusal attributable. This NEP hardens the network egress of the sandboxed exec step: the loopback egress proxy the engine spawns for a net.http allowlist IS the permit, projected — nothing more may pass, nothing declared may silently fail. Five laws make the projection exact: the allowlist is exact-host (the *. glob is refused at check), DNS is resolved by the proxy and never by the client, the dangerous-port floor rides beneath every permit, one run carries one allowlist, and a floor-blocked entry is a dead grant flagged at check. The proxy stays TLS-blind by design: it observes the CONNECT authority and byte counts, never the content — and it journals every verdict.

Motivation #

The wildcard is the measured attack surface, not a convenience. The 2026 sandbox-egress incident record (the srt network-allowlist bypasses · « one outside report is luck, two is implementation ») shows the *. grant delegating the permit to the zone operator: *.github.io is every tenant of a shared-hosting zone, including an attacker's. A contract whose effective authority depends on who else lives in the zone is ambient authority — the exact property the contract system exists to eliminate (invariant 1 · zero ambient authority). The bare * remains legal as the explicit, visible, non-stealthy escape (NetPolicy::Allow); what dies is the stealthy middle.

Second, the engine's DNS-rebinding fix (per-address floor check inside the dial loop · no resolve-then-connect window) shipped as a stopgap: the code said yes while the module doc still documented the hole as accepted and the spec's « DNS-rebinding stays covered » sentence did not name the exec arm. This NEP turns the stopgap into law — a divergence between doc and code is a finding, never a stable state.

Third, dead grants. An exact entry naming a floor-blocked target (cloud metadata, RFC1918, link-local, CGN) can never take effect — the floor refuses it at dial — yet nothing flagged it at check: the contract lied by omission. NEP-0005 established the dead-grant teaching for the env plane (NIKA-AUTH-009); this NEP applies it to the net plane (NIKA-AUTH-011).

Specification #

The law (MUST):

Exact-host allowlists. Every permits.net.http entry is an exact host name or literal. An entry carrying a * in any position other than the whole bare-* entry is refused at check (NIKA-AUTH-010 · security_error). The bare * stays legal and keeps its meaning (explicit full egress, NetPolicy::Allow).
Proxy-side DNS. Under a net.http allowlist, the confined client's own resolver fails closed (the OS fence refuses it); the proxy resolves and re-checks EVERY resolved address against the SSRF floor inside the dial loop. A permitted name resolving to a blocked address refuses at dial (NIKA-SEC-005) — there is no resolve-then-connect window.
The port floor is normative. The engine's dangerous-egress-port denylist applies beneath every permit; no permit overrides it.
One run, one allowlist. A run projecting two distinct net.http sets refuses fail-closed at the second projection (conflicting_boundary). There is no ambient merge of egress boundaries inside one run.
No dead grants. An exact entry naming a private / link-local / CGN / metadata / otherwise non-public address is an inert dead grant, refused at check under the floor parity (NIKA-SEC-005 — the engine has enforced this class since the floor parity pass; this NEP graves the rule in the spec text and adds the reference-oracle mirror and fixture). The only declassifiable target stays the exact loopback literal (01-envelope §exact-loopback declassification · the closed vocabulary: bare localhost, a 127/8 literal, ::1).
Attestation. The proxy journals every verdict — allowed, refused, and relayed byte counts per connection — through the run journal's egress observer events. The proxy is TLS-blind: content is never observed, terminated, or injected (a voluntary MITM is REFUSED as an architecture).

Rationale #

Exact-host over bounded-globs. A maintained denylist of shared zones (*.github.io, *.workers.dev, …) is perpetual debt and can never be complete. Refusing the glob form is total and measured free: a full sweep of the tracked fixture corpus found zero *. usage in net.http (0/73 files at the decision date). Re-admission, if ever needed, comes through a future NEP with a lint — never silently.
Proxy-side DNS over client-side filtering. Checking the name statically and resolving at the client leaves the rebinding window (the name resolves differently at dial). Checking each resolved address inside the dial loop closes the window without trusting the client's resolver at all — the fence makes the confined client's DNS fail-closed, so the proxy is the only resolver by construction.
TLS-blind as a feature. The voluntary-MITM alternative (terminating TLS at the proxy to inspect content) would put the engine in the content path, expand the TCB with a root-of-trust installation, and break certificate pinning. The blind proxy keeps the honest envelope: host, port, byte counts — which is exactly what the receipt may claim.
One allowlist per run. Keying proxies per boundary set is mechanically simple but multiplies the enforcement surfaces a reviewer must hold in their head; the single boundary keeps the projection auditable. A composition need (two tasks, two sets) is served by two runs — or by a future NEP.

Backwards Compatibility #

Breaking by design, measured empty: the *. form in net.http was accepted before this NEP and is now refused at check. The tracked fixture corpus (73 files) and the pack templates carried zero such entries at the decision date. Authors depending on a glob move to exact host lists, or to the explicit bare * where full egress is genuinely intended.

Reference Implementation #

The engine lane (feat/f-p5-egress-permit-bound): the check finding (NIKA-AUTH-010 wildcard refusal), the proxy metering events (relayed byte counts), and the module-doc truth (the rebinding refusal is law, not an accepted limit). The dead-grant class (law 5) already rides the floor parity (NIKA-SEC-005) and stays untouched.
Conformance fixtures: tests/core/authority/025-net-http-wildcard-refused (NIKA-AUTH-010) and tests/core/authority/026-net-dead-grant-floor-blocked (NIKA-SEC-005), with the reference oracle mirroring both laws.

Deferred (P2, by decision) #

Port sets in the permit form ({host, ports}) and a distinct net.tcp dimension — the port floor (law 3) suffices for v1.
The credential-injection proxy mode (reverse-proxy TLS origination with keyring-held credentials and session tokens · the nono Mode-2 pattern) — a second proxy, not a hardening of this one; the plain-HTTP 405 seam is the documented attachment point.
Per-set keyed egress proxies (the composition escape from law 4).

Copyright #

This document is placed in the public domain under CC0-1.0, as every NEP.

This proposal in the spec repo The specification it amends