[bd-c3]

Description

Introduces the networking skill category and implements the networking/geo_ip_rotator skill bundle. The skill provides sovereign AI agents and multi-jurisdictional workflows with policy-governed egress proxy rotation, multi-region web inspection, and downstream client context injection.

Key Capabilities & File Mapping

• Egress Routing & Multi-Region Inspection: 5 actions (fetch_via_geo, compare_regions, resolve_egress, get_proxy_context, list_supported_regions) implemented in skills/networking/geo_ip_rotator/skill.py and engine.py.
• SSRF Containment: Pre-flight validation blocking IPv4/IPv6 loopback, cloud metadata (169.254.169.254), RFC 1918 subnets, carrier-grade NAT, numeric IP evasion, and hop-by-hop redirects in ssrf.py.
• Data Sovereignty & Cryptographic Receipts: Legal jurisdiction classification (EU GDPR, UK GDPR, APPI, etc.), jurisdiction fencing (allow_eea_only, blocked_countries), and SHA-256 verifiable receipts in sovereignty.py.
• Regional Header Synthesis: Automatic injection of authentic regional Accept-Language, client hints, and platform markers in headers.py.
• Pluggable Providers: Format adapters for generic, brightdata, oxylabs, smartproxy, iproyal and downstream emitters for requests, httpx, aiohttp, playwright, urllib, and curl in providers.py.
• Deterministic Mock Simulation: Zero-dependency offline simulation with 16 realistic regional profiles, localized pricing, and GDPR cookie consent detection in mock_db.py.
• Testing & Verification: 20 unit tests in skills/networking/geo_ip_rotator/test_skill.py, 6 stress/penetration simulations in tests/skills/networking/test_geo_ip_rotator_simulations.py, and smoke-tested demo in examples/geo_ip_rotator_demo.py.

Type of Change

• New Skill — new registry bundle under skills/
• Skill Upgrade — changes to an existing skill under skills/
• Bug Fix — incorrect runtime or framework behavior
• Documentation — docs, README, CONTRIBUTING only
• Framework Feature — skillware/core/ loader, env, adapters
• CLI — skillware/cli.py, docs/usage/cli.md
• Examples — examples/*.py, agent loops, examples/README.md
• Packaging — PyPI wheel, pyproject.toml, MANIFEST.in
• RFC / meta — templates, labels, CI, or large design doc

Checklist (all PRs)

• Linked GitHub issue (Fixes #437)
• Scope matches the issue — no unrelated refactors
• Contribution complies with Legal notice and code ownership (original work, MIT license grant, no malicious logic)
• python -m black --check ., flake8, and ruff check . pass locally (or CI-equivalent subset)
• pytest skills/ and pytest tests/ pass locally when relevant (1,272 passed, 0 failed)
• CHANGELOG.md updated under [Unreleased] when user-visible behavior changes
• examples/README.md updated if this PR adds, renames, or removes a runnable script
• Ran pytest tests/test_registry_docs.py when skills, examples index, or agent-loops matrix changed
• Ran pytest tests/test_skill_docs.py when catalog Usage Examples or provider snippets changed

New or updated skill

Bundle and metadata

• Skill at skills/networking/geo_ip_rotator/
• manifest.yaml: name, version, tier: core, shape: middleware, target: [software], tags, real issuer
• Optional: parameters, outputs, env_vars, constitution, presentation

Effect, Directive, Assurance

• Deterministic skill.py (Effect; no ad-hoc LLM-generated execution paths)
• instructions.md (Directive) explains when and how to use the skill
• card.json (Presentation) issuer matches manifest when present
• test_skill.py (Assurance) covers execution, SSRF containment, and schema expectations
• SkillLoader.load_skill("networking/geo_ip_rotator") succeeds

Documentation and catalog

• docs/skills/networking/geo_ip_rotator.md, category hub in docs/skills/networking/README.md, row in docs/skills/README.md, and docs/sitemap.md
• Usage Examples for Gemini, Claude, OpenAI, DeepSeek, Ollama per skill usage template

Constitution and safety (skills only)

• SSRF Hardening: Rejects loopback, private subnets, cloud metadata endpoints, octal/hex numeric IP encodings, and redirects targeting internal networks.
• Data Sovereignty Fences: Enforces geographic isolation policies (allow_eea_only, blocked_countries) prior to dispatching outbound traffic.
• Resource Limits: Implements bounded chunk streaming (max_bytes ceiling, 5 MB default / 10 MB maximum) to prevent memory exhaustion and decompression attacks.
• Credential Sandboxing: Proxy credentials resolve strictly through self.credential() without raw ambient environment reads.
• Auditability: Produces verifiable SHA-256 cryptographic execution receipts capturing timestamps, target URLs, and egress node metadata.

Related Issues

Fixes #437

[rosspeili]

Hey @bd-c3, thanks a lot for this, this is clearly among the top tier prs that have followed contributing and/or ai native workflow in detail to ensure everything is addressed before opening a pr.

On top of that I see several key things that were not even in the issue scope, yet were considered and implemented with a thinking ahead mindset. Well done <3

Merging as is. <3