# URL-fetch policy: reproduction

`fetch_policy.py` is original MIT-licensed source. It has no target-taking command-line interface and does not run a request on import. Its shipped allowlist contains reserved example names only. It is a constrained instructional implementation, not a reviewed production fetching service.

## Runtime pin

Executed with CPython 3.12.14. The official release tag `v3.12.14` resolves to source commit `2abcf904b8dac8c999d2b3aac76681abb333798a` in `https://github.com/python/cpython.git`. The runtime's embedded metadata does not expose a build commit; the measurement record therefore identifies the release source commit separately and includes the executable's SHA-256. A reproducible binary build from that commit was not established.

For reuse rather than exact comparison, install the latest CPython 3.12 patch release and rerun the suite. The runner warns on a version mismatch and continues; its record names the actual version and does not attribute the pinned release commit to another version.

No additional package is required. No Python runtime, third-party library or compiled file is included in this example directory.

## Exact local test command

From the root of the complete downloaded package, using the pinned Python runtime:

```sh
PYTHONDONTWRITEBYTECODE=1 python3 data/examples/url-boundary-tests/run_local.py --output local-test-results
```

The published runner imports this exact source file, starts a temporary server on the loopback interface, and refuses non-fixture connections and external DNS with a Python audit hook. It also runs the redirect-recorder cases. It never opens a real target, expands a real short link or submits an address to a provider. The script writes into a fresh timestamped subdirectory of the requested local output directory. It refuses the published data/measurements directory and never overwrites the delivered measurements. No private harness is needed. Do not deploy the runner or enable its fixture substitutions in a service. Fixed loopback and address-category literals are test constants, not discovered machine addresses; ephemeral bind details are never written into results.

Expected terminal output:

```text
P22: 18 strict refusals and 24 fixture cases passed
P16: 9 observations and 19 local requests passed
```

## Distinguish policy checks from the test transport

The unmodified `check_address` refuses 18 representative categories. Documentation addresses are included among those refusals. For later successful-path tests only, the local runner temporarily grants exactly `192.0.2.10` and `198.51.100.20`, then asserts that the connector receives the selected numeric address and the numeric-only resolution flag before mapping that selection to the temporary local server.

This substitution is visible in `fixture_boundary` in the measurement JSON. It tests policy control flow, selected connection arguments and real local HTTP exchanges. It is not a successful public-network fetch, a real DNS result or a TLS test. The strict classifier is restored when the suite finishes.

The changing-answer resolver first offers a documentation address and would offer a prohibited address on its second call. One request makes only one resolver call. A same-host redirect makes a new call for the new hop, receives the prohibited answer and stops before a second connection. Mixed and empty answers are refused without a connection.

## Recorded cases

- Eleven syntax/allowlist failures stop before resolution or connection.
- Every raw `?` or `#` delimiter is refused, whether empty or non-empty.
- Deprecated IPv6 site-local addresses are refused explicitly. The well-known NAT64 sample is refused through the runtime's reserved classification.
- Ordinary local requests and an allowed next-host redirect return fixture bodies.
- Changed next-hop, mixed and empty address answers are refused.
- Unlisted-host and relative redirects are refused before a next request.
- A redirect loop, oversized response and delayed response hit their configured hop, byte or time limits.
- Transfer coding and duplicate response headers are refused.

The record is `data/measurements/url-fetch-policy-boundaries.json` in the complete package. It includes source and runner hashes, the runtime pin, per-case limits, resolver-call counts, selected-address arguments, response status and process-level network counts. It contains no actual local bind address or ephemeral port. Network counters are copied from the audit hook and the zero-attempt assertions run against those measured values; no counter is overwritten. The earlier P9 records remain in data/measurements/earlier-runs/P9, with a note that their overwritten zero fields are not measurements.

## Scope to preserve

The implementation accepts only absolute HTTP(S) URLs matching its explicit origin tuples, fixed GET requests without query or fragment delimiters, absolute redirects and a restricted HTTP/1 response with a single Content-Length. It does not handle browser navigation, cookies, credentials, compressed bodies, transfer coding, retries or proxy configuration. The HTTPS branch uses a default TLS context and explicit hostname but was not exercised. External DNS behavior, organization-specific routing and deployment security review remain unverified. Existing parser datasets were read, not changed or rerun.

## NAT64 boundary

The pinned runtime marks the well-known 64:ff9b::/96 prefix reserved because it is inside ::/8. The policy consequently refuses every IPv4-only destination synthesized using that prefix, including public IPv4 destinations. This is not an embedded-IPv4 classifier. Operator-assigned NAT64 prefixes are not identified or decoded; they may wrap an internal IPv4 address without recognition here. The suite tests a classification representative only, not a DNS64/NAT64 network. A deployment still needs its own egress and translation-prefix policy.