[drk-ram]

What changed

The egress annotator in the AGT Guardian now inspects every URL in a shell command instead of only the first. It answers the origin when all URLs agree, and the unresolvable sentinel when they differ or when the command carries --resolve, --connect-to, a proxy or unix-socket option, or a proxy environment prefix. An allowlisted decoy in a Referer header or -e value no longer hides the real destination.

Which issue does this implement

Closes #470

• This is an editorial correction (typo, grammar, link, formatting) with no change in
  meaning, so it needs no issue

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI
• main, because every changed path is on the documentation lane allowlist in
  CONTRIBUTING.md

Type of change

• Specification change (schema, hooks, events, AgBOM)
• Reference implementation or adapter
• Documentation
• Tooling or CI
• Governance (licensing, security policy, contributor docs)

I tested this

• I synced my branch with the base branch before opening this
• uv run pytest -v passes on my machine
• uv run mkdocs build --strict passes on my machine

Commands and results, on Windows x64 with Bun 1.4.4 (ACS_OPA_PATH set):

• bun test packages/guardian/test/annotate-egress.test.ts: 88 pass, 0 fail
• bun test packages/guardian/test/server.test.ts: the six new end-to-end denial tests pass. One test fails, "strips this repo's absolute root out of a real error message", which this change does not touch (Windows path handling).
• bun run typecheck: clean
• uv run pytest -q: 1200 passed, 10 failed, 20 errors. The failures and errors are symlink, subprocess and timing tests in test_fetch_roadmap, test_overrides, test_pr_intake_workflow, test_publish_schemas and test_closing_choice, which this Windows machine cannot run. This change touches only TypeScript under reference-implementations/agt.
• uv run mkdocs build --strict: passes

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

• This change has no security impact

This closes an egress-gate bypass: a command with an allowlisted URL in a header or option value was allowed although the request went to an off-list host. The change only narrows what the annotator allows. It over-blocks any command that carries a URL and a proxy or --resolve style option, which is the direction the module already chooses to fail in.

[github-actions]

Thanks for this. It is queued rather than ignored. A lead has not reviewed this pull request yet. A lead will read it when they have time, and we can't promise a date. Nothing here is rejected. If a check below fails, please fix it. A pull request that waits a long time may be closed, and you can reopen it later.