ansible-proxy-chain/openspec/changes/archive/2026-04-22-china-direct-bypass/specs/proxy-rules/spec.md

ADDED Requirements

Requirement: Surge rules route China domains to DIRECT

The reference Surge configuration SHALL use Sukka's China domain rulesets to route China-destined domain traffic to DIRECT, bypassing all proxies.

Scenario: China domain hits DIRECT

• WHEN a client request matches Sukka's China domain ruleset (e.g., DOMAIN-SET,https://ruleset.skk.moe/List/domainset/cn.conf)
• THEN Surge routes it via DIRECT policy
• THEN the traffic connects without going through any proxy

Requirement: Surge rules route China IPs to DIRECT

The reference Surge configuration SHALL use Sukka's China IP ruleset to route China IP CIDR traffic to DIRECT.

Scenario: China IP hits DIRECT

• WHEN a client request resolves to a China IP matching Sukka's China IP ruleset (e.g., RULE-SET,https://ruleset.skk.moe/List/ip/domestic.conf)
• THEN Surge routes it via DIRECT policy

Requirement: China rules are placed after service-specific rules

The China direct rules SHALL be placed after AI and streaming service rules in the Surge configuration, so that AI/streaming traffic still routes through the chain even if the destination IP is in China.

Scenario: AI service with China CDN still goes through chain

• WHEN a request to an AI service domain matches the AI ruleset
• AND the destination IP happens to be in a China range
• THEN the AI ruleset matches first (higher priority) and routes through Chain
• THEN the China IP rule does not override the AI routing

Requirement: China domain rules appear before China IP rules

The China DOMAIN-SET and non_ip rules SHALL appear before the China ip rules, following Sukka's prescribed ordering to maintain DNS protection.

Scenario: Correct ordering within China rules

• WHEN the Surge config is loaded
• THEN China DOMAIN-SET and non_ip entries appear before any China ip entries