Canonical policy from
compliance/cache/latest/test-kits/substitution-observer-runner.yaml.
Callers SHOULD use this constant — overriding the policy is
intended for local-dev workflows (host_literal_policy: 'allow'),
not for loosening deny lists. Runtime enforcement supplements these
contract CIDRs with the SDK's shared address classifier so newly reserved
ranges cannot drift between outbound-fetch implementations. The SDK-only
policy marker is deliberately enumerable so spread-based overrides retain
that behavior.
Canonical policy from
compliance/cache/latest/test-kits/substitution-observer-runner.yaml. Callers SHOULD use this constant — overriding the policy is intended for local-dev workflows (host_literal_policy: 'allow'), not for loosening deny lists. Runtime enforcement supplements these contract CIDRs with the SDK's shared address classifier so newly reserved ranges cannot drift between outbound-fetch implementations. The SDK-only policy marker is deliberately enumerable so spread-based overrides retain that behavior.