Pin LaunchCheck requests to validated DNS

tests/test_full_stack_contract.py

@@ -57,8 +57,8 @@ async def test_acceptance_success_reload_and_receipt(monkeypatch):
     os.environ.pop("DATABASE_URL", None)
     stored = {}
 
-    async def fake_host_allowed(host, port):
-        return False
+    async def fake_public_addresses(host, port):
+        return ("93.184.216.34",)
 
     async def fake_fetch(url, max_redirects, max_bytes):
         return FetchResult(
@@ -92,7 +92,7 @@ async def test_acceptance_success_reload_and_receipt(monkeypatch):
     async def fake_load(tenant, audit_id):
         return stored.get((tenant, audit_id))
 
-    monkeypatch.setattr(launch_agent, "_host_is_disallowed", fake_host_allowed)
+    monkeypatch.setattr(launch_agent, "_resolve_public_addresses", fake_public_addresses)
     monkeypatch.setattr(launch_agent, "_fetch_bounded", fake_fetch)
     monkeypatch.setattr(launch_agent, "_check_robots", fake_robots)
     monkeypatch.setattr(launch_agent, "_save_audit_and_receipt", fake_save)
@@ -146,3 +146,28 @@ async def test_url_policy_rejects_dangerous_inputs(monkeypatch):
 
     monkeypatch.setattr(launch_agent.asyncio, "get_running_loop", lambda: FakeLoop())
     assert (await launch_agent._validate_public_url("https://rebinding.test"))["code"] == "disallowed_private_target"
+
+
+@pytest.mark.asyncio
+async def test_validated_dns_addresses_are_pinned_for_connection(monkeypatch):
+    calls = {"count": 0}
+
+    async def fake_getaddrinfo(host, port, type):
+        calls["count"] += 1
+        return [(None, None, None, None, ("93.184.216.34", port))]
+
+    class FakeLoop:
+        def getaddrinfo(self, host, port, type):
+            return fake_getaddrinfo(host, port, type)
+
+    monkeypatch.setattr(launch_agent.asyncio, "get_running_loop", lambda: FakeLoop())
+    validation = await launch_agent._validate_public_url("https://rebinding.test/path")
+
+    assert validation["ok"] is True
+    assert validation["addresses"] == ("93.184.216.34",)
+    resolver = launch_agent._PinnedResolver(
+        validation["hostname"], validation["addresses"]
+    )
+    resolved = await resolver.resolve(validation["hostname"], validation["port"])
+    assert [item["host"] for item in resolved] == ["93.184.216.34"]
+    assert calls["count"] == 1