Named Network HTTP Access

Validate that applications on the same named isolated network segment can communicate with each other while remaining isolated from the host and other segments. Demonstrate downloads are contained and uploads respect data‑motion and proxy controls.

Preconditions

• Create a named network segment (for example, launch apps with --network=test).
• Data Motion upload controls present for browsers as applicable.

Suite

ID	Canonical IDs	Flow	Procedure	Expected Outcome
INTEG-NAMED-NET-HTTP-01	NET-ISOLATE-04, DM-WEB-02, NET-EGRESS-10	Intra‑segment web access & uploads	1) In sandbox A on --network=test, run python -m http.server 8000 in a working directory with sample files. 2) In sandbox B on --network=test, open the browser and navigate to http://<sandbox-A-ip>:8000 (or the segment alias). Download a file; attempt an upload if server supports it. 3) From the host and from a sandbox on a different segment, attempt to reach the same URL.	Same‑segment access succeeds. Downloads land in overlay/Storage Contexts. Uploads are denied or processed per policy; proxy/pinning still enforced for any outbound egress. Host and cross‑segment attempts fail. Audit shows `action: allow

Evidence Requirements

• network events: action, reason (for denies), proxyEnforced when applicable.
• fileOp events for download writes; dataMotion events for uploads.