test(gateway): require URI path-segment route boundaries

[seonghobae]

Security finding

Refs #180. The pre-repair route selector used raw lexical prefix matching, so /api could capture /apix and /api/admin could capture /api/administrator, binding a request to the wrong Wardnet route/enforcement/upstream authority before later controls executed.

Hostile RED and minimum causal repair

Exact RED 93d097626d96f9adaffc267f47be162c397355f3 changed only crates/waf-ids-core/tests/route_path_segment_boundary.rs; hosted CI 34129793580 / rust 101766902311 failed because lexical siblings were selected as routes while root/trailing-slash controls passed. The production repair remains limited to crates/waf-ids-core/src/lib.rs::select_route: an enabled route matches only an exact configured path or slash-delimited descendant; root catch-all, disabled-route handling and longest-valid-match semantics remain unchanged. RouteConfig wire shape and EgressWeave transport authority are untouched.

Protected-base adoption — refreshed 2026-09-11 KST

Protected/default main is exact f8260f1e03836039ff9463dd99fa982e4e270c4b. Reverse-direction restack #309 adopted protected #155 normally, without force or destructive rebase, producing current exact head abbaff14a452671238c83c1325da22e15f9ee2ac on that protected base.

Exact-current gates

All predecessor results are historical after #309. Current exact execution is terminal for the principal lanes:

• CI 34569413771: SUCCESS;
• Fuzz 34569413780: SUCCESS;
• Security Scan 34569413792: SUCCESS;
• SAST Semgrep 34569413795: SUCCESS;
• required CodeQL PR 34569413791: FAILURE at the delegated current-head terminal-verdict settlement boundary.

The earlier queued snapshot is superseded. Do not churn source or rerun already-successful lanes. .github#1929 owns the reproduced central CodeQL settlement defect; .github#712 remains runner/materialization owner only for genuine pre-checkout failures. A failed required workflow is non-passing and not eligible for routine or guarded bypass.

Live ruleset 18156473 still carries the generic one-approval solo-maintainer mismatch tracked by .github#772; self/model approval and routine administrator bypass are not substitutes.

Keep Draft until the unchanged exact head has terminal-valid required CodeQL, zero valid unresolved review findings/threads, current hostile route-boundary and coverage evidence, fresh protected-base compatibility and every then-live package/SBOM/provenance/governance gate. No force push/destructive rebase, gate weakening, mutable foreign dependency, source copy, cross-service SQL or predecessor-evidence reuse.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Writer repair note (exact-head evidence): two attempted causal GREEN writes (5392ac6f57a2bde362d1f500c64588aafe127de1, 52e54ae4abd6da0f2492260dd81e976871a86c15) were rejected by review because they rewrote unrelated source formatting/comments instead of changing only the route predicate. Both were immediately neutralized by ordinary, non-force revert commits. Current head 209053f72f778e383fa2949039ab3b8e1890555a points to tree 12552fe3cd938b6a3ab6f0ad3d912c96ba11a49f, exactly the same tree as the verified RED head 93d097626d96f9adaffc267f47be162c397355f3; the PR net diff is again only crates/waf-ids-core/tests/route_path_segment_boundary.rs and production behavior remains intentionally RED. Do not reuse checks from the intermediate heads or claim GREEN. The authorized next change remains the minimal select_route predicate only, followed by exact-current CI/Fuzz/SAST/Security/CodeQL/review evidence.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Fresh exact-current execution has settled on unchanged abbaff14a452671238c83c1325da22e15f9ee2ac against protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b:

• CI 34569413771: SUCCESS
• Fuzz 34569413780: SUCCESS
• Security Scan 34569413792: SUCCESS
• SAST Semgrep 34569413795: SUCCESS
• required CodeQL 34569413791: FAILURE only at delegated terminal-verdict settlement. Detect 103168126964 succeeds; compatibility 103169388754 successfully reads current-head state then fails at terminal enforcement; later dispatch 103171009025 succeeds.

Exact consumer evidence is now handed to canonical .github#1929 comment 5630606713. Keep Draft: the hostile route-segment repair is repository/security GREEN on this head, but a later dispatch is not terminal CodeQL evidence and cannot be promoted over the failed required workflow. No no-op source churn, local workflow copy, routine bypass, or predecessor evidence transfer.