[lance0]

Issue #305 also asks for source-prefix selection. Add optional same-family src_prefix CIDRs to manual FlowSpec discard and police rules across the API, dashboard, CLI and rule previews.

guardrails.allow_src_prefix_match is enforced and remains false by default. Sources are canonicalized and participate in scope, ownership, immutable withdrawal and reconciliation identity. Source-free hashes and stored JSON remain unchanged; explicit /0 remains distinct from omission. Both speakers encode IPv4 and offset-zero IPv6 type 2 and refuse an entire inventory containing an unrepresentable source. Blackholes reject source criteria. Detectors and playbooks do not choose sources.

The dashboard confirms controller capability before each source-prefix submission. ADR031 and the upgrade guide cover controller-first upgrades, drain-before-downgrade requirements and evidence limits. Redirect-to-IP remains the separate design in #306.

Validation at a6b62c3:

• Complete native Linux just gate passed on 2026-10-22 with Node 26.12.0 and Bun 1.4.3: strict Clippy in both feature configurations, 502 GoBGP-only and 541 all-feature unit tests, 250 API tests per configuration, PostgreSQL/ownership/lease controls, all three locked Rust 1.89 matrices, release build, frontend lint/types/472 tests/build, Python, alert rules, proto checksum and dependency policy.
• Rust advisory checks pass with the documented optional SQLx/MySQL RSA exception; Bun reports no vulnerabilities.
• Released GoBGP 4.10.0 and rustbgpd 0.79.0 fixtures passed, including raw receiving-peer source checks, exact sibling deletion and restart recovery. No Linux-gated cases were omitted from their explicit fixture runs.
• The source-drop negative control fails the opt-in API test with 201 instead of 422. Full commit/diff and independent lifecycle reviews found no remaining actionable findings.
• All 16 exact-head hosted checks passed: CI and FRR matrix, including both images and five existing FRR scenarios.

The native Linux result supersedes the earlier macOS gate limitation for delivery. Router source-prefix filtering and scrubber enforcement are not qualified by these checks.

Refs #305.

[Copilot]

🔵 Needs a closer look

Persisted routing identities and exact withdrawal behavior across both backends warrant final human review despite extensive coverage and reported passing CI.

No open issues 🎉

What changed in this PR

Adds opt-in source-prefix matching to manual FlowSpec discard and police rules across the controller, both BGP backends and operator interfaces. Scrubber redirection remains outside this PR.

Changes:

• Validates and canonicalizes same-family source CIDRs while preserving source-free identities and enforcing the default-off guardrail.
• Includes source prefixes in encoding, ownership, withdrawal and reconciliation, with lifecycle and interoperability coverage.
• Adds capability-gated dashboard submission, source-scope displays and upgrade/downgrade guidance.

File	Description
tests/​integration.rs	Tests API opt-in, validation, persistence and independent withdrawal.
tests/​integration_rustbgpd.rs	Tests source components against released rustbgpd.
tests/​integration_rustbgpd_peer.rs	Extends peer and restart fixtures with source-scoped rules.
tests/​integration_gobgp.rs	Tests source components against released GoBGP.
tests/​common/​speaker_contract.rs	Adds source variants and exact-withdrawal checks.
tests/​common/​peer_receipt.rs	Decodes source components in receiving-peer evidence.
src/​scheduler/​reconcile.rs	Tests source-aware reconciliation and immutable withdrawal retries.
src/​guardrails/​mod.rs	Enforces and tests the source-prefix opt-in.
src/​guardrails/​blackhole.rs	Rejects source criteria for blackhole intent.
src/​error.rs	Names the required source-prefix guardrail in errors.
src/​domain/​withdrawal.rs	Tests canonical identities, ownership and exact withdrawal.
src/​domain/​mitigation.rs	Adds canonical source-prefix serialization.
src/​domain/​flowspec.rs	Adds source validation and versioned source-aware identities.
src/​domain/​blackhole.rs	Rejects stored blackholes containing source criteria.
src/​config/​settings.rs	Makes the existing source-prefix flag effective.
src/​bin/​prefixdctl.rs	Displays source prefixes in match summaries.
src/​bgp/​rustbgpd.rs	Encodes and strictly decodes source components.
src/​bgp/​rustbgpd_tests.rs	Tests source-aware RPC identity and inventory failure.
src/​bgp/​gobgp.rs	Encodes and validates source-prefix read-back.
src/​bgp/​gobgp_tests.rs	Tests codecs, matching and whole-inventory refusal.
src/​bgp/​announcer.rs	Adds source capability reporting and match comparison.
src/​api/​openapi.rs	Checks source-field schema coverage.
src/​api/​handlers.rs	Accepts and returns source CIDRs; rejects them for blackholes.
frontend/​lib/​api.ts	Adds source types and capability checks before submission.
frontend/​components/​dashboard/​flowspec-rule-dialog.tsx	Adds source input, validation and request mapping.
frontend/​components/​dashboard/​flowspec-preview.tsx	Includes source scope in summaries and rule previews.
frontend/​app/​(dashboard)/​mitigations/​[id]/​page.tsx	Displays the mitigation’s source prefix.
frontend/​__tests__/​amplification-surfaces.test.tsx	Tests source displays, validation and compatibility safeguards.
FEATURES.md	Documents manual source matching and automatic-selection limits.
docs/​reference/​speaker-backends.md	Documents source capabilities and strict decoding limits.
docs/​reference/​configuration.md	Explains opt-in behavior and source restrictions.
docs/​reference/​cli.md	Documents source-aware CLI output.
docs/​reference/​api.md	Documents source requests, responses and capability checks.
docs/​how-to/​upgrading.md	Adds source-rule draining and downgrade precautions.
docs/​adr/​README.md	Indexes the source-prefix decision.
docs/​adr/​031-source-prefix-matches.md	Records design, compatibility and qualification limits.
configs/​prefixd.yaml	Clarifies the existing default-off setting in a comment.
CHANGELOG.md	Records the feature and compatibility requirements.

_{Review effort: Balanced}