fix(notifications): scope credentials and NAT64 resolution

[ammarheidari]

Corrective authority

Post-merge exact-head review of W66 Slice 1 PR #240 found two P1 security gaps:

1. caller-selected env/file credential locators could bind unrelated server secrets;
2. network-specific RFC6052 NAT64 prefixes could embed prohibited IPv4 destinations in DNS answers.

Correction

• replace env/file destination references with opaque pre-provisioned NotificationCredentialBindingId;
• resolver requests bind the credential ID to exact destination ID + provider, allowing infrastructure authorization at resolution time;
• secret values remain separate/redacted;
• add server-owned NotificationAddressPolicy with configured RFC6052 NAT64 prefixes (/32,/40,/48,/56,/64,/96);
• pinned DNS answers are validated against both the baseline address policy and configured NAT64 extraction;
• NotificationPinnedEndpoint requires the address policy, so connection-time validation cannot be skipped;
• no outbound adapter/network execution is introduced.

Safety

• destination profile cannot name an environment variable or filesystem path;
• no raw secret becomes profile state;
• DNS answers are pinned and policy-checked before any future adapter may connect;
• correction remains contract-only.

Exact head: e89a7d8aea8ad83dffc84d2e39033e2808561db3.

Refs #215 and corrects post-merge findings on #240.

Final authorization-context remediation

• protected-main parent: c27ae8dcec597bfd20f406fd50e4bbc2bc8d0193;
• canonical exact head: c89a9f5fb3bf88ad47e14e9fbe2c3818077b0c36;
• destination profiles store only opaque pre-provisioned credential binding IDs;
• credential resolution is bound to destination ID, provider and immutable profile revision fingerprint (including normalized endpoint and binding);
• endpoint resolver owns the deployment address policy; callers cannot downgrade NAT64 policy;
• pinned endpoint carries the address-policy fingerprint used for validation;
• configured RFC6052 NAT64 prefixes are server-owned and embedded IPv4 addresses are checked against the same prohibited-address policy;
• no outbound adapter or network execution is introduced;
• fresh exact-head CI, CODEOWNER approval and Codex review required.

Standard NAT64 policy closeout

• protected-main parent: c27ae8dcec597bfd20f406fd50e4bbc2bc8d0193;
• canonical exact head: fb952781d5dccd0ae053ae764f602722c2752a97;
• configured NAT64 prefixes are decoded before baseline transition-space denial;
• public embedded IPv4 under configured standard/network-specific NAT64 is admitted;
• prohibited embedded IPv4 remains rejected;
• resolver still owns the authoritative policy and pinned results retain its fingerprint;
• fresh exact-head gates required.

NAT64 overlap closeout

• canonical exact head: 2b68a032c60f620f995aced0ed104efbb43c478c;
• configured NAT64 prefixes are required to be non-overlapping;
• policy decision is independent of prefix-list order;
• one address has exactly one authoritative RFC6052 decoding;
• public embedded IPv4 remains admitted only under its configured prefix; prohibited embedded IPv4 remains denied;
• fresh exact-head gates required.

Implicit NAT64 decoding closeout

• canonical exact head: f2c240b70736ec933405edad79cb69132a183076;
• all applicable standard NAT64 decodings are checked in addition to configured prefixes;
• any prohibited embedded IPv4 from any applicable decoding fails closed;
• safe configured decoding cannot bypass implicit local-use/well-known decoding;
• non-NAT64 transition forms remain always denied;
• fresh exact-head gates required.

Canonical exact-head reconciliation

• protected-main parent: c27ae8dcec597bfd20f406fd50e4bbc2bc8d0193;
• exact head: 2d8122900ff091298b1a60e50f676e1b103431d2;
• one DCO-signed commit;
• all prior incremental remediation is included;
• fresh exact-head CI, CODEOWNER approval and Codex review are required before merge.

Final canonical security gate

• protected-main parent: c27ae8dcec597bfd20f406fd50e4bbc2bc8d0193;
• canonical exact head: e89a7d8aea8ad83dffc84d2e39033e2808561db3;
• one DCO-signed commit;
• malformed configured RFC6052 prefix matches fail closed instead of falling back to native IPv6 admission;
• implicit standard NAT64 + configured NAT64 decodings are all checked;
• configured NAT64 prefixes are non-overlapping and policy order cannot change the result;
• credential resolution remains bound to immutable profile revision context;
• fresh exact-head CI, CODEOWNER approval and Codex review required.

[ammarheidari]

@codex review

Please review exact corrective head 147e37aed5d8c23ef0416bb2741601ceaff04a45, especially credential binding authorization context and configured NAT64 extraction/pinned DNS policy.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T19:04:02.579324Z	e89a7d8	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 147e37aed5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review final corrective head c89a9f5fb3bf88ad47e14e9fbe2c3818077b0c36, focusing on endpoint-revision credential authorization and resolver-owned NAT64 policy.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c89a9f5fb3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review final W66 corrective head fb952781d5dccd0ae053ae764f602722c2752a97, especially configured standard/network-specific NAT64 handling.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb952781d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review final W66 corrective head 2b68a032c60f620f995aced0ed104efbb43c478c, especially overlap-free NAT64 policy determinism.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b68a032c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review final W66 corrective head f2c240b70736ec933405edad79cb69132a183076, focusing on all-applicable NAT64 decoding safety.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f2c240b707

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Please review canonical exact W66 corrective head 2d8122900ff091298b1a60e50f676e1b103431d2.

[ammarheidari]

@codex review

Please review canonical exact W66 corrective head e89a7d8aea8ad83dffc84d2e39033e2808561db3, especially malformed RFC6052 handling and all-applicable NAT64 decoding.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: e89a7d8aea

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ammarheidari]

@codex review

Re-review exact canonical head e89a7d8aea8ad83dffc84d2e39033e2808561db3. Previous findings were remediated; please review the current head only.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a4ec6302b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate the reserved u octet for /96 prefixes

When an operator configures a /96 prefix whose byte 8 is nonzero, this condition skips the reserved u-octet check even though RFC 6052 requires bits 64–71 to be zero for /96 network-specific prefixes as well. The constructor consequently accepts a malformed prefix and the policy can admit synthesized addresses beneath it as valid; reject such /96 prefixes during construction or apply the u-octet validation to them here.

Useful? React with 👍 / 👎.