test(sec-4045): regression gates for the wake SSRF, refusal oracle, register counter, DNS guard and snapshot mode

[stormer78]

Six regression gates for the SEC-4045 PoC steps that PRs #25–#29 fixed but left ungated, plus one fix to a gate that passed for the wrong reason. Tests only — no source behaviour changes.

Gap analysis first

Those PRs already added substantial coverage (tests/api.rs, src/store.rs and src/egress.rs unit tests), so this adds only what was missing:

PoC behaviour	Already gated?	Added here
Web Push endpoint SSRF, unit level	yes — sender::tests::production_policy_never_dials_loopback, egress::tests::webpush_endpoint_rejections	—
SSRF through the dispatch path with a stored record	no	wake_to_a_stored_internal_endpoint_never_dials
Refusal differences as a port-scanning oracle	no	register_refusals_reveal_nothing_about_the_target
Refused registration not counted in gateway_register_total	partly — the cap paths were counted, two refusals were not	refused_registrations_are_never_counted
/metrics off the public router	yes — metrics_is_not_served_on_the_public_router	default_metrics_bind_is_loopback (pins the default the move relies on)
Guarded resolver in isolation	yes — guarded_resolver_refuses_loopback_names	—
Guarded resolver installed in the real client, refusing before the dial	no	hardened_client_refuses_a_name_that_resolves_to_loopback
Snapshot mode at open (0644) and at write	yes	—
Snapshot mode across the whole lifecycle, every loose shape	no	every_loose_snapshot_mode_is_tightened_for_the_whole_lifecycle

A gate that passed for the wrong reason

wake_to_a_stored_internal_endpoint_never_dials originally used an http:// endpoint. The hardened client sets https_only(!policy.allows_loopback()), so reqwest refused that URL client-side before validate_webpush_endpoint was consulted at all. Reverting the endpoint policy to accept anything parseable left the gate green — it was pinning the scheme check twice and the SSRF guard not at all, and would have survived exactly the regression it is named for.

Switched to https, where the scheme check does not apply and the endpoint policy is the only thing between the wake and the listener. The same revert now fails.

This is why each gate below was checked by reverting its fix rather than by reading it.

Red-then-green evidence

Every revert was restored in the same shell invocation and the restore proven with git diff before anything else ran.

every_loose_snapshot_mode_is_tightened_for_the_whole_lifecycle — revert: secretfile::tighten_to_owner_only(&path) removed from Store::open_with_limits.

panicked at src/store.rs:1148:13:
assertion `left == right` failed: open must tighten a snapshot left at 0604
  left: 388
 right: 384

(388 = 0o604, 384 = 0o600.) 1.7s.

hardened_client_refuses_a_name_that_resolves_to_loopback — revert: GuardedResolver::resolve returns every resolved address unfiltered.

test egress::tests::hardened_client_refuses_a_name_that_resolves_to_loopback ... FAILED
panicked at src/egress.rs:789:9

5.0s.

wake_to_a_stored_internal_endpoint_never_dials (after the fix above) — revert: validate_webpush_endpoint accepts anything parseable.

panicked at tests/api.rs:1128:5:
  left: 1
 right: 0

One connection reached the listener. 5.3s.

Hermetic when red, not only when green

Every socket-using gate binds loopback only and asserts on a listener it owns that accepted nothing. Reverting a fix to watch one go red cannot send traffic off the machine — the slowest red run above is 5.3s against 127.0.0.1. The link-local, CGNAT and private-range vectors live in is_public_ip_table, which performs no I/O at all.

This matters because the first cut of the equivalent tests in vti-didcomm-js was hermetic only while passing: reverted, its unroutable vectors dialed the real network for 181–226s per file.

Two repo-specific traps these avoid

• /metrics is on the management router, so the gates build the public and management routers over one shared AppState, as the existing tests do.
• Snapshot writes are debounced, so anything asserting on file contents calls flush() first.

Verification

cargo fmt --all --check clean, cargo clippy --all-targets -- -D warnings clean, cargo test 83 passed / 0 failed (59 unit + 24 integration).

Not gated

Nothing from the PoC harness is left unrepresented, but two of the six gates were not proven by revert in this pass — register_refusals_reveal_nothing_about_the_target and refused_registrations_are_never_counted. They assert on the dispatch-level reason string and the counter respectively, both of which are covered by narrower existing unit tests; I would rather say they are unproven than imply a revert check I did not run.