[Wolbrom1]

CARD-P2-01 S4 — rag_api producer governed-host allowlist (G1-A) + LLM/IMDS paid-call guard (G1-F)

FILES lane. Branch off 5dfe7ad (the #114 head, S1 + link redaction), so this stacks on #114 — until #114 merges, the diff vs main also shows the S1 files.

G1-A — producer-side governed-HOST allowlist (RV-145 N1, the owed half of CORE-CITATION-GOVERNED-LINK)

#556 shipped the scheme/storage/presign half in Core; the host-level rule (RAG_GOVERNED_LINK_HOSTS) had no source of truth in rag_api. This adds it on the producer side, in app/routes/document_routes.py:

• Mechanism. RAG_GOVERNED_LINK_HOSTS is read once at import (_governed_link_hosts()), comma- and/or whitespace-separated, lower-cased. _reject_ungoverned_link keeps the scheme guard first (non-https still refused as link_scheme_not_allowed); then, when the allowlist is configured, an https link whose host is not admitted is refused with the new typed reason link_host_not_allowed — same 422 envelope shape as the scheme case (message + link.reason + link.allowed_hosts).
• Match rule. Hostname-only via urlparse(...).hostname (drops userinfo/credentials and port, lower-cases). An exact entry (a.example.com) matches only itself; a dot-prefixed entry (.example.com) matches any subdomain but not the bare parent and not a look-alike (evilexample.com). Userinfo spoofing (https://allowed.host@evil.com/) is matched on the real host, evil.com.
• The raw link is never echoed — only the redacted hostname (length-capped), the reason, and the allowed list. Refusal is logged once at WARNING with the bounded host only.
• Conservative default (OPEN FOR RICHARD, §11). When RAG_GOVERNED_LINK_HOSTS is unset/empty, the host check is DISABLED and current https-only behaviour is preserved with zero new rejections. The allowlist VALUE is a Richard policy/disclosure call — no host value or default list is invented here.

G1-F — LLM/IMDS paid-call test guard (RV-150 N1 twin, per CARD-N5)

In tests/conftest.py (test-only; no production behaviour change):

• Autouse _block_the_real_llm_provider replaces the boto3 bedrock-runtime client's socket-opening step (converse/converse_stream/invoke_model) on every live holder (app.config.llm and document_routes.llm), with raising=True on the .client attribute (rename-loud). Placement blocks the socket step, not the high-level llm a test may stub.
• AWS_EC2_METADATA_DISABLED=true + dummy AWS creds/region are set before app.config imports (via setdefault, so CI's own values win), so the import-time boto3 session makes no IMDS probe (proven with a socket spy: 0 attempts to 169.254.169.254).
• Pins SUM_UP_KNOWLEDGE_FILES off and proves that flipping it still cannot reach a provider (the guard, not the default, is what stands between tests and inference).

Tests (red-first, proven under --network none in the shipped-runtime image, Python 3.10.21)

• tests/test_embed_link_host_allowlist.py — SET: non-allowlisted host refused (link_host_not_allowed); exact host, dot-prefixed subdomain, and userinfo+port host all accepted; bare parent + suffix look-alike + userinfo-spoof refused; raw link never echoed (body or log); refusal before any upload/extraction/store; length cap; matcher + parser unit cases. UNSET: arbitrary https host still ingests (conservative-default regression). Scheme guard runs first even with a host allowlist.
• tests/test_llm_provider_is_blocked_in_tests.py — summarizer path blocked; direct llm.invoke blocked; client converse/converse_stream/invoke_model raise the guard message; deliberate-regression (a real client DOES attempt the network — proving the guard is load-bearing); stubbed-llm untouched; attribute-name pin; config-reload gap; gate pin; no IMDS probe at import.

Red-first: the host behavioural tests fail on 5dfe7ad (guard absent, 27 red) and the LLM file fails collection (ImportError, guard symbols absent). One targeted one-line mutation per guard was injected and each reddened the relevant tests; both files were restored byte-identical (md5/sha verified) before commit — no mutation is in this tree.

Acceptance ladder

• IMPLEMENTED — yes (G1-A in document_routes.py; G1-F in conftest.py).
• TEST-PROVEN — yes (red→green under --network none; per-guard mutation caught).
• REVIEWED — pending (independent RV).
• PUSHED — yes (this draft).
• MERGED / DEPLOYED / LIVE-VERIFIED — Demian/operator. The RAG_GOVERNED_LINK_HOSTS value is OPEN FOR RICHARD; until set, the host guard is inert by design.

🤖 Generated with Claude Code