Module egress 

Instance-scoped outbound network policy shared by every plugin transport.

Transport adapters submit an EgressRequest, then dial only the pinned addresses returned by AuthorizedEgress. Policy is resolved at each request, while live-connection accounting is shared process-wide by every transport, store, service, and tool registry that represents the same logical plugin instance.

Linkers expose only the imports selected by an admitted instance’s effective grants. This service repeats that grant check at the operation boundary, then applies the common destination, address-class, and capacity policy. The duplicate check is intentional defense in depth: an adapter cannot accidentally turn a linked-but-ungranted import into network access.

What this module does not own

Address classification, the egress pattern grammar, NAT64 translation, and the post-resolution SSRF verdict all live in zeroclaw_infra::net_guard, which is also what the built-in tools use. Nothing here re-implements them: a plugin and a built-in tool must not be able to disagree about whether a destination is reachable.

Structs

AuthorizedEgress

A policy-approved request with pinned addresses and a held connection slot.

EgressHostService

Shared service injected into plugin stores and cloned across transports.

EgressPolicy

One materialized view of canonical operator egress policy.

EgressPolicyResolver

Live point-of-use resolver for canonical operator egress policy.

EgressRequest

Canonical per-operation request presented to the shared egress boundary.

StartTlsState

Host-owned STARTTLS transition guard for one connection.

Enums

EgressError

Failure at the shared plugin egress boundary.

EgressTransport

Protocol family and confidentiality mode requested by a plugin adapter.

StartTlsPhase

Per-connection STARTTLS phase. Transitions never permit plaintext fallback.