security: require exact bytes for request stream accounting

[seonghobae]

Test-first request-resource hardening

Fixes #79 with a bounded non-workflow repair from exact protected-main base 10d0c51daf2ad278d66f43be479df8cf6b08ba6d.

Exact tree and TDD evidence

• Protected-main base: 10d0c51daf2ad278d66f43be479df8cf6b08ba6d.
• Immutable test-only RED: 07de0d2dbb8b9e2587c4809d5f189c21840b4615 adds synchronous/asynchronous regressions for lying and raising bytes subclasses, arbitrary non-exact-byte chunks, hostile cleanup, and ordinary exact-byte acceptance. The pre-fix implementation used isinstance(chunk, bytes) before len(chunk), so those subclass cases failed for the intended reason.
• Production GREEN: be670b5a9d81a3de253727eaf6897c8f6e0d1525 requires type(chunk) is bytes before length accounting or downstream delivery on both request-stream paths.
• Documentation GREEN: 05d47777fa09a80a2314266ba22d4ba3270a3056 records the runtime trust boundary and APA 7th references to RFC 9110, RFC 9112, CWE-400 v4.20, CWE-444 v4.20, and the HTTPX developer/transport interfaces.
• Exact current head: 94e8c4578fd7f8b54faa4f3090f72666dee1a2ab; its final test-only refinement exhausts and explicitly closes the positive exact-byte fixtures without changing production behavior.

Implemented boundary

• accept only exact built-in bytes before invoking len() or yielding a request chunk downstream;
• reject bytes subclasses, bytearray, and arbitrary malformed objects before resource accounting or HTTPCore delivery;
• close or asynchronously close rejected sources and mask dependency-injected cleanup failures behind the stable generic EgressNotAllowedError("egress URL is not allowed") boundary;
• preserve cumulative finite request-byte budgets, exact Content-Length equality, single-consumption semantics, early declared-length rejection, authority validation, HTTP framing checks, TLS identity, proxy isolation, and timeout behavior;
• remain provider-neutral and standalone/importable without changing the public API, dependency graph, network authority, release behavior, or review-agent credential contract;
• update [Unreleased] without a version bump.

Exact-current-head verification

CI run 31130730734 succeeded on exact head 94e8c4578fd7f8b54faa4f3090f72666dee1a2ab:

• Python 3.10, 3.11, 3.12, and 3.13: success;
• Python 3.13: 749 tests passed;
• production coverage: 1,620/1,620 statements and 554/554 branches, 100% with zero misses or partial branches;
• Ruff, compileall, and hourly product-guard self-test: success;
• wheel and source-distribution package acceptance: success.

SAST Semgrep run 31130735048 and Security Scan run 31130735078 also succeeded on the same exact head. The aggregate Security Scan is not accepted as complete dependency-review evidence until the organization-owned fail-closed exact-head repair in ContextualWisdomLab/.github#799 is integrated and this head is revalidated through that repaired gate.

Scope and remaining gates

Changed paths are exactly:

• src/egressweave/request_body_safety.py
• tests/test_request_stream_chunk_validation.py
• docs/research/request-body-resource-limits.md
• CHANGELOG.md

This PR changes no .github path, workflow, dependency, credential, permission, protected ref, release/package/tag/publication path, destination authority, TLS/proxy policy, or public API shape.

Keep this PR Draft until the central dependency-review repair is integrated and exact-current-head security evidence is rerun. Then require completed current-head automated review, independent non-author approval, branch protection, and every repository policy gate. Missing, queued, skipped, stale-head, synthetic-merge, or fail-open evidence is not acceptance. Do not merge, auto-merge, release, publish, rebase, or retarget before those gates.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 08ba191c-a5f0-42c2-aebe-4296a9c9c489

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Complete only the bounded GREEN changelog/validation tail on exact current head 05d47777fa09a80a2314266ba22d4ba3270a3056; stop without writing if the branch head differs.

The immutable test-only RED commit is 07de0d2dbb8b9e2587c4809d5f189c21840b4615. Production GREEN is be670b5a9d81a3de253727eaf6897c8f6e0d1525: both bounded request wrappers now require type(chunk) is bytes before len() or downstream yield. Documentation GREEN is 05d47777fa09a80a2314266ba22d4ba3270a3056 and records RFC 9110/CWE-400/HTTPX integration rationale.

Modify only CHANGELOG.md. Prepend one concise [Unreleased] → Security entry stating that synchronous and asynchronous outbound request streams now reject bytes subclasses and other non-exact-byte chunks before length accounting/downstream delivery, close the malformed source, mask hostile cleanup failures, and preserve existing valid-byte budget and exact Content-Length semantics. Do not change the package version.

After that single-file change, run the focused request-stream chunk regressions plus the complete repository test/100% production statement+branch coverage/public-docstring/Ruff/compile/package contract available on the branch. Report the resulting exact head and test evidence in this PR conversation. Do not modify tests, production code, docs, .github, workflows, dependencies, credentials, permissions, model/review identities, protected refs, release/package/tag/publication behavior, or any other path. Do not merge, mark Ready, auto-merge, rebase, retarget, publish, or release.

[seonghobae]

@opencode-agent Supersede the previous request because the branch head advanced by a test-only cleanup refinement. Complete only the bounded GREEN changelog/validation tail on exact current head 94e8c4578fd7f8b54faa4f3090f72666dee1a2ab; stop without writing if the branch head differs.

The immutable RED remains 07de0d2dbb8b9e2587c4809d5f189c21840b4615; production GREEN remains be670b5a9d81a3de253727eaf6897c8f6e0d1525; documentation GREEN remains 05d47777fa09a80a2314266ba22d4ba3270a3056. 94e8c4578fd7f8b54faa4f3090f72666dee1a2ab only makes the positive exact-byte fixtures exhaust and explicitly close their sources.

Modify only CHANGELOG.md. Prepend one concise [Unreleased] → Security entry stating that synchronous and asynchronous outbound request streams now reject bytes subclasses and other non-exact-byte chunks before length accounting/downstream delivery, close the malformed source, mask hostile cleanup failures, and preserve existing valid-byte budget and exact Content-Length semantics. Do not change the package version.

After that single-file change, run the focused request-stream chunk regressions plus the complete repository test/100% production statement+branch coverage/public-docstring/Ruff/compile/package contract available on the branch. Report the resulting exact head and test evidence in this PR conversation. Do not modify tests, production code, docs, .github, workflows, dependencies, credentials, permissions, model/review identities, protected refs, release/package/tag/publication behavior, or any other path. Do not merge, mark Ready, auto-merge, rebase, retarget, publish, or release.

[seonghobae]

@opencode-agent Complete the bounded GREEN tail on exact current head 94e8c4578fd7f8b54faa4f3090f72666dee1a2ab; stop without writing if the branch head differs.

Modify only CHANGELOG.md. Prepend one concise [Unreleased] → Security entry stating that synchronous and asynchronous outbound request streams reject bytes subclasses and other non-exact-byte chunks before length accounting or downstream delivery, close malformed sources, mask hostile cleanup failures, and preserve valid exact-byte budget and exact Content-Length semantics. Do not change the package version.

After the one-file change, run the focused request-stream regressions and the complete repository contract: Python 3.10–3.13, Ruff, complete pytest, 100% production statement and branch coverage, public docstrings, compileall, package acceptance, SAST, and Security Scan. Keep the PR draft until the new exact head is green. Do not modify production code, tests, docs, .github, workflows, dependencies, credentials, permissions, review-agent identities, refs, release/package/tag/publication behavior, or any other path. Do not merge, auto-merge, rebase, retarget, publish, or release.

[seonghobae]

@opencode-agent Complete only the remaining bounded changelog tail on exact current head 94e8c4578fd7f8b54faa4f3090f72666dee1a2ab; stop without writing if the branch head differs.

The exact current PR diff still contains only docs/research/request-body-resource-limits.md, src/egressweave/request_body_safety.py, and tests/test_request_stream_chunk_validation.py; CHANGELOG.md is still absent. Exact-head CI 31130730734, SAST 31130735048, and Security Scan 31130735078 are green for the existing three-file tree, but this branch is not complete because the standing release contract requires the changelog entry.

Modify only CHANGELOG.md. Under [Unreleased] → Security, add one concise entry that synchronous and asynchronous outbound request streams reject bytes subclasses and other non-exact-byte chunks before length accounting or downstream delivery, perform best-effort malformed-source cleanup without exposing hostile cleanup failures, and preserve valid exact-byte budget plus declared Content-Length semantics. Do not change the version or any other path.

After that single-file change, run the focused request-stream regressions and complete repository test/100% production statement+branch coverage/public-docstring/Ruff/compile/package contract. Report the resulting exact head and evidence here. Keep Draft; do not merge, mark Ready, auto-merge, rebase, retarget, publish, release, or change .github, workflows, credentials, permissions, dependencies, model/review identities, protected refs, or publication behavior.

[seonghobae]

@opencode-agent Complete the already-declared bounded scope on exact PR head 94e8c4578fd7f8b54faa4f3090f72666dee1a2ab; do nothing if the head or base 10d0c51daf2ad278d66f43be479df8cf6b08ba6d has changed.

The implementation/tests/docs are present and exact-head CI/SAST/Security Scan are green, but the PR body explicitly requires a concise [Unreleased] Security entry and CHANGELOG.md is not among the current three changed paths. Add only that missing changelog entry, describing that request-stream accounting now accepts exact built-in bytes chunks before length accounting and rejects malformed/subclass chunks fail-closed while masking hostile cleanup failures. No version bump.

Do not touch production code, tests, research docs, .github, dependencies, credentials, permissions, base/head refs, release behavior, or PR ready/merge state. After the changelog-only commit, leave Draft and require fresh exact-current-head CI, SAST/Security Scan, automated review, independent approval, branch protection, and policy evidence. Do not rebase, merge, auto-merge, publish, or add any write-capable workflow.

[seonghobae]

Superseded by #85 on the identical branch and exact head d89a82ae0fcb9d440404a3608824190d313aab1a. No commit was rewritten, rebased, retargeted, or force-updated. Historical exact-head CI/security evidence remains auditable here, but reviews and approvals do not transfer; #85 must collect fresh PR-scoped checks and qualifying independent approval.