(scratch) test: track RFC 4787, and state its requirements as executable contracts

[daniel-noland]

Scratch PR. Parking the specification-compliance line of work so it is pushed and reviewable;
not proposed for merge in this shape. Stacked on #1738.

What is here

Nine commits, continuing the duvet work already in the stack (RFC 4884 and RFC 5382 landed earlier).

Tracking RFC 4787 — the UDP counterpart of RFC 5382, 14 numbered requirements landing on the
same masquerade code that already carries RFC 5382 citations. Cited as the individual RFC, never as
BCP 127: that composite concatenates RFC 4787, RFC 6888 and RFC 7857, whose section numbers collide,
and duvet silently keeps only the last — 42 requirements where the three separately yield 129.

Findings recorded, not fixed. REQ-1 (mapping is address-and-port-dependent), REQ-8 (filtering is
stricter than either branch the RFC offers) and REQ-9 (no hairpinning) are one decision, not three:
this gateway is deliberately not UNSAF-traversal-friendly, or it is not deliberate and is a much
larger piece of work. REQ-13 is the same shape — this dataplane originates no ICMP error at all, and
has no MTU anywhere on the datapath to originate one from. All todo rather than exception,
because nobody has ruled.

Executable contracts. nat/src/masquerade/contract.rs states RFC 4787 REQ-12 as a
Requirement the implementation calls from a debug-only assertion and the test cited type=test
calls directly, so the two citations are provably about the same predicate. SPEC and ID are
const and checked against duvet's extracted requirements at compile time: a citation naming a
requirement its specification does not state now fails the build with E0080.

Errata. The corpus's inline-errata/ was audited. RFC 4787, 5382, 5508, 6888 and 7857 have no
errata of any status; RFC 4884 has one, and it does not touch us.

Open, and deliberately not done here

• The .duvet/ snapshot is not regenerated — duvet is not on PATH outside the dev shell, and
  hand-editing the regression gate would defeat it. RFC 4787 REQ-12 should move to
  [!MUST,implementation,test] on the next duvet report.
• There is no just duvet recipe yet.
• development/code/spec-compliance.md carries a live open-questions list, expected to grow.
• The RFC corpus itself is moving to a separate repository; nothing here depends on it at build
  time, only .duvet/ which is committed.

Checks

cargo test -p dataplane-nat 210 pass, 1 ignored. clippy and fmt clean on dataplane-nat and
dataplane.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 08f82a8c-33c3-4a1e-b6e6-565f686fe219

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
1640	2	1638	0

View the top 2 failed test(s) by shortest run time

dataplane-nat::masquerade::fuzz::a_flow_that_cannot_be_masqueraded_says_so

Stack Traces | 1.44s run time

thread 'masquerade::fuzz::a_flow_that_cannot_be_masqueraded_says_so' (158519) panicked at ..../src/masquerade/fuzz.rs:152:9:
3 flows reached the attribution assertion across 1 configurations; this property has gone vacuous
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

dataplane-routing::router::rio::tests::a_large_answer_arrives_whole

Stack Traces | 11.2s run time

thread 'router::rio::tests::a_large_answer_arrives_whole' (161420) panicked at ..../src/router/rio.rs:1035:18:
rio should answer within the read timeout: Os { code: 11, kind: WouldBlock, message: "Resource temporarily unavailable" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}