Block the Azure WireServer address

[jeremy]

Summary

• block 168.63.129.16/32, Azure WireServer's fixed host-node virtual IP, across classification, pinning, and non-pinning APIs
• keep the deny rule exact: adjacent public addresses remain allowed, while literal and mixed-DNS paths are regression-tested
• document that this is an Azure platform/fabric alias rather than an RFC special-use range
• bump the fixed release to 0.1.2 because v0.1.1 is already published and immutable

Assessment

Microsoft documents 168.63.129.16 as a fixed host-node WireServer address used across Azure regions and clouds for platform communication. It is distinct from IMDS at 169.254.169.254, but is still an internal platform endpoint and must not be treated as a public fetch target.

Affected versions: 0.1.1 and earlier when used on Azure. Patched version: 0.1.2.

Verification

• 184 tests, 541 assertions; 100% line and branch coverage
• full suite on Ruby 3.1.6, 3.2.9, 3.3.11, 3.4.10, and 4.0.6
• bundle exec rubocop
• actionlint -color
• authenticated zizmor --persona=pedantic .
• hermetic Ruby 3.4.10 / RubyGems 4.0.18 build and package verification for surfguard-0.1.2.gem
• independent policy, patch, and release-state reviews found no remaining actionable issue

Release note

Security fix: block Azure WireServer at 168.63.129.16, a fixed Azure platform/fabric alias outside the RFC special-use ranges. On Azure, Surfguard 0.1.1 and earlier could classify this host-only service address as public. Upgrade to 0.1.2.

Primary reference: https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16

[Copilot]

Pull request overview

Blocks Azure WireServer’s fixed platform IP from all Surfguard resolution paths and prepares release 0.1.2.

Changes:

• Adds the exact 168.63.129.16/32 deny rule.
• Tests literal, adjacent-address, and mixed-DNS behavior.
• Documents the policy and bumps the gem version.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
lib/surfguard.rb	Adds the Azure WireServer deny rule.
test/surfguard_test.rb	Adds classification and resolution regressions.
README.md	Documents the Azure-specific policy.
lib/surfguard/version.rb	Bumps the release to 0.1.2.
Gemfile.lock	Synchronizes the locked package version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.