feat(network): add policy DNS correlation store

architecture/sandbox.md

@@ -72,9 +72,16 @@ its guarded single-request relay while sharing authorization, request context,
 policy-pinning, and destination boundaries.
 Adapter-specific response and OCSF event shapes remain at the protocol boundary.
 Policy authors may use `protocol: tcp` as an explicit spelling of the existing
-L4 passthrough behavior. Omitting `protocol` remains equivalent. The egress
-intent reserves a transparent TCP adapter and a policy-DNS-pinned address, but
-DNS serving and transparent TCP capture are not active yet.
+L4 passthrough behavior. Omitting `protocol` remains equivalent. The network
+supervisor contains a dormant policy-DNS boundary for explicit TCP endpoints:
+it snapshots eligible endpoint identities from one policy generation, resolves
+eligible names only through an explicitly supplied trusted resolver, filters
+answers through the shared destination controls, and publishes expiring
+synthetic-address mappings with separate mapping generations. Refreshes retain
+their synthetic identity, and policy reload, expiry, wrong ports, missing
+mappings, or pool exhaustion fail closed. The pinned connector never resolves
+the name again. No DNS listener is exposed to workloads, resolver configuration
+is not injected, and transparent TCP capture is not active in this increment.
 
 Provider credential placeholders are resolved through the live provider state
 for each HTTP request, after destination and L7 policy admission. A static

crates/openshell-supervisor-network/Cargo.toml

@@ -27,6 +27,7 @@ bytes = { workspace = true }
 flate2 = "1"
 glob = { workspace = true }
 hex = "0.4"
+hickory-proto = "0.26.1"
 ipnet = "2"
 miette = { workspace = true }
 prost-types = { workspace = true }

crates/openshell-supervisor-network/data/sandbox-policy.rego

@@ -921,6 +921,31 @@ _matching_endpoint_records := [record |
 	record := records[_]
 ]
 
+# Endpoints eligible for policy DNS are a policy-data snapshot, not an
+# authorization decision. In particular, they do not depend on input.exec or
+# grant access to any process. Only endpoints that explicitly opt into raw TCP
+# and provide a resolvable host plus concrete ports are materialized.
+policy_dns_eligible_endpoint_records := [record |
+	some policy_name
+	policy := data.network_policies[policy_name]
+	some endpoint_index
+	ep := policy.endpoints[endpoint_index]
+	lower(object.get(ep, "protocol", "")) == "tcp"
+	object.get(ep, "host", "") != ""
+	ports := object.get(ep, "ports", [])
+	count(ports) > 0
+	every port in ports {
+		is_number(port)
+		port >= 1
+		port <= 65535
+	}
+	record := {
+		"policy_name": policy_name,
+		"endpoint_index": endpoint_index,
+		"endpoint": ep,
+	}
+]
+
 matched_endpoint_config := _matching_endpoint_configs[0] if {
 	count(_matching_endpoint_configs) > 0
 }

crates/openshell-supervisor-network/src/lib.rs

@@ -12,6 +12,7 @@ pub mod identity;
 pub mod inference_routes;
 pub mod l7;
 pub mod opa;
+pub(crate) mod policy_dns;
 pub mod policy_local;
 pub mod procfs;
 pub mod proxy;