[c8m6]

Summary

Clients that address an HTTP compatibility API and a second protocol at the same IP currently reach only HTTP. Add an opt-in IPv4 TCP/UDP relay companion through ruby bin/acl-with-relay, with a fixed configured upstream and bounded exchanges. The HTTP engine, HTTP mapping schema, default command, and runtime gem dependencies remain unchanged.

The supervisor stops both children on termination or when either service exits. For privileged listen ports, a separate Ruby interpreter copy grants only NET_BIND_SERVICE to the relay; HTTP runs with inherited capabilities cleared and no-new-privileges enabled. High ports work with all capabilities dropped.

Related issues

None.

Validation

• bundle exec rspec --format progress: 205 examples, 0 failures. The 21 focused companion examples also passed after the final test-harness cleanup adjustment.
• bundle exec rubocop --force-exclusion --cache false: 27 files, no offenses.
• bundle exec bundler-audit check --update: no vulnerable Ruby dependencies reported by the updated database.
• Final image built locally with Docker; script/validate-image api-compatibility-layer:dns-relay-review passed. This includes the existing HTTP smoke test and shared-address HTTP/DNS write/read tests on TCP/UDP ports 1053 and 53, concurrent clients, TCP framing, SIGTERM/SIGINT cleanup, unchanged non-root UIDs, and per-child capability checks.
• The port-53 companion smoke test also passed under rootless Podman, including capability checks.
• Trivy 0.74.0 scanned the final image and the unchanged script/trivy-gate passed: 163 reported findings in total, with zero fixable HIGH/CRITICAL findings. Reports were retained locally; this is not a claim that the image has no findings.
• bash -n script/validate-image, git diff --check, and a synthetic-data check passed.

Compatibility and documentation

Activation is explicit. Existing HTTP-only deployments continue using ruby bin/acl. README documents the companion variables, IPv4-only forwarding, five-second exchange/connection lifetime, 32-client limit, low-port capability requirements, and an isolated synthetic deployment example.

The relay forwards bytes without interpreting DNS or adding records, caching, or recursive resolution. Its DNS test upstream supplies complete CNAME/address replies; correct upstream records and CNAME resolution remain deployment requirements. No claim is made that an existing mock server's DNS semantics are repaired by forwarding alone. Known consumer limitation: Mockly v0.13.1 matches the requested DNS record type directly and does not resolve an A/AAAA query through a CNAME-only record. That upstream behavior needs a separate solution before the original consumer flow can pass end to end. No running consumer environment was reconfigured, and no release or image publication was performed.

Checklist

• The change is focused and follows the repository's AGENTS.md conventions; the HTTP core remains protocol independent.
• Relevant tests, linting, and security checks passed, with scan findings and deployment limits described above.
• Affected documentation and examples are up to date.
• No credentials, production data, private keys, or sensitive endpoints are included.
• Any new third-party material has documented provenance and a compatible license. No third-party code is vendored; the standard Debian capability build utility is removed from the final filesystem.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-21T12:01:20.340036Z	4fecdfe	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.