[sodejm]

Scope

Issue #284 requires comprehensive, scoped host and service inventory. This change adds bounded explicit target lists and IPv4/IPv6 CIDR expansion; separate TCP and UDP port selection, including a deliberate full TCP range; normalized observation provenance; raw protocol evidence with confidence; coverage and diff reporting; and durable interruption/resume semantics.

The scanner validates authorization, scope, budget, cancellation, and target identity before each stage. It reserves probe attempts durably before dispatch, records completions in an append-only journal, releases orderly undispatched reservations, and leaves uncertain effects pending reconciliation without redispatch. Canonical IP identity prevents equivalent IPv6 literals from causing duplicate probes.

Live UDP sends an empty datagram unless the plan selects a nonrecursive root NS query. DNS identification requires a matching, structurally valid response. Responses retain length and digest rather than body content; silence remains unknown and refusal is closed. TCP can observe up to 512 bytes of a server-first banner after a bounded wait without an application payload. Optional TLS on 443/8443 records version and cipher without peer verification. These observations do not establish operating system, exploitability, or a product version absent protocol evidence.

The final review repair preserves TCP and UDP import identity independently, rejects unsupported imported protocols, retains meaningful Nmap service names without inventing product/version evidence, makes offline fixtures protocol-aware, requires explicit DNS evidence provenance, counts UDP timeouts accurately, and enforces both the configured probe budget and a hard Cartesian materialization cap. Coverage accounting now uses bounded set membership for quarantined endpoints.

Safety and recovery

• Target expansion is capped by ScanBudget.max_targets; overlapping or equivalent targets fail closed before dispatch.
• Probe reservations are batched for practical full-range throughput while preserving pre-dispatch durability.
• Plans above 131,070 materialized target/protocol/port tuples fail before Cartesian coverage state is built. The separate 256 MiB checkpoint canonical-size limit still applies after assessments and other variable-length evidence are present.
• Journal and lock open/load/append/unlink operations reject symbolic links, hard links, non-regular files, wrong ownership, non-private modes, directory swaps, truncated records, and compaction crash windows. The checkpoint directory must remain protected from same-authority mutation while a lock is held.
• Scope, plan, and resume identity mismatches fail closed. DNS shifts quarantine the affected target.
• Input JSON remains capped at 4 MiB and uses canonical decoding.

Validation

Current pushed revision: 5a49c45107042bea9312d73fb0fe04868a1e5072.

• The worktree-owned pre-push gate passed without bypass: 2,365 tests passed, 23 skipped, 2 warnings, 288 subtests passed; all COPS checks, Ruff lint and format, issue coverage for [Proposal]: Comprehensive scoped host and service inventory #284, and dependency/security checks passed. pip-audit reported no known vulnerabilities.
• Focused active-discovery suite: 87 tests passed.
• Focused native loopback regression: 1 test passed.
• Package validation: all 18 package checks passed.
• Repository baseline: make check passed in the repository virtual environment.
• Disposable Linux loopback full TCP range: 65,535 planned, attempted, and completed; 0 skipped, timed out, unassessed, or pending reconciliation; checkpoint reload equal; journal retired. Scanner elapsed 24.618 seconds, approximately 30.9 seconds wall time under one CPU and 512 MiB.
• Default unprivileged disposable lab covered IPv4 and IPv6 loopback TCP open/closed, UDP open/unknown, a nonstandard server-first SSH banner, cancellation/resume without duplicate dispatch, DNS-shift quarantine, remediation diff, an unreachable route control, and cleanup.
• Opt-in Linux CAP_NET_ADMIN lab observed closed before packet drop, timeout/filtered uncertainty during the drop, and closed after rule removal, with cleanup.
• Native Windows CI covers checkpoint save, journal replay, resume, compaction, and removal, with link/reparse rejection where the runner permits creation.

Hosted checks and current-head independent review are tracked on this pull request and must be green before merge.

Remaining platform boundaries

• Routed IPv6 and production firewall behavior require validation in an authorized target environment; local evidence is loopback and synthetic-route bounded.
• Full-range performance was measured only in isolated Linux loopback and is not a WAN timing claim.
• The controlled TCP packet-drop case is opt-in and requires Linux CAP_NET_ADMIN; the default unprivileged lab reports that path unavailable and retains conservative unknown/filtered classification.
• Same-authority mutation of the protected checkpoint directory during a lock lifetime is outside the lock's guarantee; operators must restrict directory access.

No release or deployment is included.

Refs #284

[sodejm]

Final delivery record for exact head f103f6440013e8bfb71781e6395793c05b0740cb:

• Integrated current main at 1d8f3e4112618c1cab9f78c73675c94ab76625b9 while preserving the bounded active-discovery and service-evidence scope.
• Added native checkpoint portability coverage, lock-path identity hardening, and egress process serialization, including native Windows CI coverage.
• The installed pre-push gate passed at this exact head: 2,358 tests passed, 23 skipped, 288 subtests, 79% coverage; package validation, the repository make check gate, issue coverage, Ruff, pip-audit, and the guarded push receipt all passed.
• Every hosted check is green at this exact head, including Python 3.11/3.13 validation, Windows 3.11/3.13 SOC tests, Windows/macOS/Linux operator smoke, Linux bubblewrap isolation, CodeQL, dependency scanning, secret scanning, linting, and issue coverage.
• Security and operator documentation was updated in the threat model and package README. The checkpoint directory must be protected from same-authority mutation. A same-authority writer that can replace checkpoint pathnames during the lock lifetime remains outside the lock's protection boundary.
• Issue [Proposal]: Comprehensive scoped host and service inventory #284 remains open: routed IPv6 and production-firewall behavior still require separately authorized external evidence.

The user authorized a rebase merge once the exact-head gate was fully green and clean.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-16T16:30:18.723478Z	5a49c45	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f103f64400

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sodejm]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[sodejm]

Final delivery evidence for exact head 5a49c45107042bea9312d73fb0fe04868a1e5072:

• The final review repair separates imported TCP and UDP plans, rejects unsupported import protocols, preserves meaningful productless Nmap service names, makes synthetic fixtures protocol-aware and DNS-evidence-bound, reports UDP timeouts, enforces configured and Cartesian materialization limits, and removes quadratic quarantine coverage accounting.
• The worktree-owned pre-push hook ran without bypass and passed: 2,365 tests, 23 skipped, 288 subtests; all package, Ruff, issue coverage, documentation, and dependency/security gates passed. The focused active-discovery suite passed 87 tests, the native loopback regression passed, all 18 package checks passed, and make check passed in the repository virtual environment.
• The five current review findings have fix/evidence replies and are resolved. The PR body now describes the exact head, validation, materialization cap, checkpoint size boundary, and same-authority checkpoint-directory residual risk.
• Hosted checks and independent exact-head review remain required before merge.

The user authorized a rebase merge only after the exact-head hosted CI, current-head independent review, review-thread, draft, and mergeability gates are all clean. This comment records that authorization; it does not waive any gate.

Residual boundaries remain documented: routed IPv6 and production firewall behavior require authorized environment evidence, loopback performance is not a WAN claim, and same-authority mutation of the protected checkpoint directory during a lock lifetime is outside the lock guarantee. No issue closure, release, or deployment is included.