docs(backlog): record egress allowlist (027ff1f) in RETRO

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

BACKLOG.md

@@ -33,9 +33,9 @@ matching bullets below are superseded; only the noted follow-ups remain live:
 - **C-A1** brief echo-back gate — `1df7af5` *(follow-up: `planner.md` brief_echo + `role_pipeline` metadata to activate)*
 - **C-A2** stage-level plan checkpointing — `1a1b5cc`
 - **B §4** architect contradiction-check (display-only) — `eae0a0c` *(follow-up: decision emit hook + in-session L3 embedding)*
-- **D** dedicated `SourceFetched`/`LowQualityExtraction` events — `b098d87`
+- **D** dedicated `SourceFetched`/`LowQualityExtraction` events — `b098d87`; dynamic per-session egress allowlist — `027ff1f` *(follow-up: thread sessionId into `NetworkHostRule`; batch fetch-approval still unbuilt)*
 
-**Not yet started (verifiable, Kotlin):** B §5 reviewer static-first infra; D batch fetch-approval + dynamic egress allowlist; B §2 plan-derived diff manifest; G narration-lane lag; H freestyle follow-ups.
+**Not yet started (verifiable, Kotlin):** B §5 reviewer static-first infra; D batch fetch-approval; B §2 plan-derived diff manifest; G narration-lane lag; H freestyle follow-ups.
 **Blocked in this sandbox:** E tui-go items (Go toolchain absent); F live-QA gates + D §6 web approval client (need local model / SearXNG / network / GPU).
 
 ---

RETRO.md

@@ -22,12 +22,14 @@ Nine tracks, each compiled + unit-tested green before commit.
 | `1a1b5cc` | Stage-level plan checkpointing: `StageCheckpointPassed/FailedEvent` + `StageCheckpointReconciler` + `emitStageCheckpoint` (gated on a locked plan) | C-A2 |
 | `eae0a0c` | Architect contradiction-check (display-only): `PossibleContradictionFlaggedEvent` + L3-backed `ArchitectContradictionChecker` | B §4 |
 | `b098d87` | Dedicated `SourceFetchedEvent` / `LowQualityExtractionEvent` (promoted from `ToolExecutionCompletedEvent` metadata; additive), emitted from `SandboxedToolExecutor` | D |
+| `027ff1f` | Dynamic per-session egress allowlist: `EgressHostsGrantedEvent` + `EgressAllowlist` union helper + `EgressAllowlistProjection`; `NetworkHostRule` delegates to the union | D |
 
 ### Follow-ups created this pass (refiled into BACKLOG)
 - **C-A1 activation** — `planner.md` must emit a `brief_echo` block and `role_pipeline.toml` must set `briefEcho="true"` / `briefEchoSource` for the gate to fire live (model-dependent → live-QA).
 - **C-A3 producer** — nothing emits `CritiqueOutcomeCorrelatedEvent` yet; the calibration projection has no live feed until a reviewer-loop producer records finding outcomes.
 - **B §4 wiring** — `ArchitectContradictionChecker` is unwired: needs an architect-decision emit hook on the server side, and prior decisions embedded into L3 in-session (today they only land at session end).
 - **A §4 llama wiring** — `LlamaServerHealthProbe` is unregistered: an `HttpClient` + tokens/sec telemetry aren't exposed to the health-monitor scope yet (`// TODO(wiring)` in `Main.kt`).
+- **D egress wiring** — `NetworkHostRule` consults the session set via a pure helper but is fed `emptySet()`: `ToolCallAssessmentInput` carries no `sessionId`, so going live needs session context threaded into the assessment input (`// TODO(wiring)` in `NetworkHostRule.kt`). Batch fetch-approval (approve a source list → one `EgressHostsGrantedEvent`) still unbuilt — needs approval-flow surgery.
 
 ### Environment note
 - A `~/.gradle/gradle.properties` machine-local override was added on this box (`-Xmx768m`, `parallel=false`, kotlin daemon `-Xmx640m`) because the repo's `-Xmx4G` OOM-killed the foreground process on a 1.9 GB machine. **Not committed** — repo defaults intact for higher-RAM machines.