Bind provider DNS policy to the actual connection

[salmonumbrella]

What changed

Docbank now applies one transport policy to an exact scheme, host, port, CIDR set, proxy mode, and optional TLS roots or SPKI pins. It resolves once per connection attempt, rejects the entire DNS answer set if any address escapes policy, and dials only the validated IPs while preserving the original Host and TLS identity.

Redirects, destination drift, ambient proxies, and unbounded connect or TLS work are refused. The default local GLM-OCR client now uses the same boundary.

Why

Checking a hostname and then handing it back to the standard dialer leaves a second DNS lookup and ambient proxy behavior outside the reviewed boundary. Resolution must stay bound to the socket that actually receives provider bytes.

Usage

Build provider HTTP clients from an explicit egress policy. The same policy must approve every resolved address for each connection attempt; retries can move only across that approved set.

There is no user-facing command change.

Part of #176 (R3). Stacks on #190.

[roborev-ci]

roborev: Combined Review (a40fd9e)

Code review found two medium-severity issues; no high or critical findings.

Medium

• document/internal/formatdetect/detect.go:189 — CountPDFPages requires a traditional trailer token even though format detection accepts PDF cross-reference streams. Valid PDF 1.5+ files that store /Root in an /XRef stream and omit the traditional trailer will fail media inspection as malformed. Resolve /Root from the cross-reference stream dictionary when startxref points to an /XRef object, and add a valid xref-stream PDF inspection test covering a catalog and page tree.

• document/evidence_codec.go:227 — Complete source evidence cannot represent the supported image, audio, or video families. Validation rejects these families, and EvidenceUnitTime is not allowed for any family, forcing providers processing authorized media inputs to return degraded provenance. Define valid evidence-unit mappings, such as image regions/pages and audio/video time ranges, and test complete rendition results for each supported media family.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 21m37s

[roborev-ci]

roborev: Combined Review (58ca706)

No Medium, High, or Critical findings were identified.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 20m28s

[roborev-ci]

roborev: Combined Review (8cdcbf7)

The changes are broadly sound, but three medium-severity issues remain around OCR egress enforcement, rendition limits, and EPUB reference validation.

Medium

• document/glmocr/client.go:91 — Supplying ClientConfig.HTTPClient bypasses the exact-host, loopback-CIDR, and proxy-disabled transport. Only timeout and redirect behavior are overridden, so a custom transport could send OCR payloads elsewhere. Always install the constrained transport, reject custom transports, or replace HTTPClient injection with narrowly scoped resolver/TLS test hooks.

• document/provider.go:128, document/profile.go:28, document/evidence_codec.go:28 — MaxUnits is included in processing-profile fingerprints but omitted from RenditionAuthorization, allowing ValidateRenditionResult to accept results above the configured ceiling. Profiles permit up to 1,000,000 units, while evidence and catalog storage reject values above 100,000. Carry and enforce MaxUnits in each authorization, then align the limits across profile, evidence, and catalog handling.

• document/media/inspect.go:543, document/media/inspect.go:676 — EPUB external-reference detection covers only a subset of XML attributes and scans standalone CSS using raw substring matching. External references in poster, data, srcset, inline styles, <style> blocks, or escaped CSS can remain eligible, while harmless archive-local CSS URLs may be rejected. Parse XHTML URI-bearing attributes and CSS syntax, resolve relative references against archive entries, and reject only external, escaping, or missing targets.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 31m20s