== Enclave network-test — dedicated-IP identity ==

ports (ENCLAVE_PORTS):  http:8000=8000,tcp:7777=7777
egress (ENCLAVE_EGRESS): socks5h://0x9f8947ecf851683622cedbb0503cf864d4e0d8fd34905bf94ae1fac56c0ce6e8:****@127.0.0.1:1080

[1] identity (SOCKS BND.ADDR, platform-derived):   2a01:4f9:c013:9b52:2205:315a:4fe5:f633
[2] explicit egress fetch (icanhazip.com):        internet sees 2a01:4f9:c013:9b52:2205:315a:4fe5:f633
[3] transparent fetch (unmodified std::net):        internet sees 2a01:4f9:c013:9b52:2205:315a:4fe5:f633
    -> matches [1]: outbound is transparently source-tagged (phase 2 live)

[4] loopback dial 127.0.0.1:8080: DENIED (Permission denied (os error 2)) — raw network closed ✓
[4b] same dial via connect_timeout: phantom Ok, first I/O fails (Socket not connected (os error 53)) — denial holds

On an egress-enabled enclave with the phase-2 toolchain: [1] == [2] == [3],
[4] denied — one stable IPv6 identity in both directions (this page is served
on that same address via the tcp6-relay), with no way to egress off-identity.