Structural validation of rewrite_to at construction. Right call — the guard proves the value cannot restructure the netloc that becomes the signed @authority, which is the correct invariant for the one non-signing layer that synthesizes that authority. Real bug: bare ::1 against a ported URL produced https://::1:9000/hook, and _canon_authority's rsplit(":", 1) mis-splits that into a wrong signature rather than a failed request.

Things I checked

• __post_init__ on a frozen=True dataclass mutates via object.__setattr__ — correct for frozen dataclasses. Happy path unchanged: default host.docker.internal is ASCII, no structural chars, not an IP, no colon → stored verbatim.
• Structural char set is complete for authority boundaries. _STRUCTURAL_CHARS covers every RFC 3986 gen-delim that moves a boundary (/ ? # @ [ ]), plus \ (WHATWG-normalized to /), % (RFC 6874 zone IDs and percent-encoded delimiters like %2F/%40 that _normalize_pct would later decode), and the ord < 0x21 or == 0x7F control/whitespace sweep. The absent sub-delims (! $ & ' ( ) * + , ; =) are legal reg-name chars that neither urlsplit nor _canon_authority split on — not a gap. security-reviewer: clean, no netloc-boundary bypass survives.
• Bracket-unwrap can't smuggle. inner = value[1:-1] strips one outer pair only, and inner is still scanned for [/], so [[::1]], [::1]evil], [a]b[c] all reject.
• : handling is correct: excluded from the structural set so IPv6 literals survive, then re-caught after a failed ip_address() parse as an embedded port — which apply_hooks' port guard would otherwise flag.
• Signed-authority spelling is RFC-correct. Bracketing bare IPv6 and folding to compressed lowercase matches RFC 3986 §3.2.2 / RFC 5952 §4, and canonicalize_authority("https://[2001:db8::1]:9000/hook") returns [2001:db8::1]:9000 — stable and verifiable by a conformant receiver running the same canonicalization. ad-tech-protocol-expert: sound.
• Correctly does not route IP literals through _idna_canonicalize.canonicalize_host (which returns IPv6 unbracketed, being a comparison helper) — canonicalize_host is only called on the non-ASCII IDN branch, where the input is guaranteed non-IP. Clean separation.
• Docker-legal underscore names (my_service, host_gateway, _dns-sd._udp.local) accepted structurally rather than rejected by IDNA — the right decision, and pinned by test_rewrite_to_accepts_docker_legal_service_names so a future IDNA "tidy-up" fails loudly.
• Public surface: DockerLocalhostRewrite is a public export; the change rejects previously-malformed values and normalizes valid ones. No signature change, no removed export, no required↔optional flip. fix(webhooks): is the correct semver signal.
• Test plan: make ci-local reported 5911 passed; 9 of the 25 signing conformance tests fail against the pre-fix module (verified by the author in a throwaway worktree, not by reasoning). No unchecked manual boxes.

Follow-ups (non-blocking — file as issues)

• rewrite_to=\"[]\" stores an empty host. [] is non-empty so it clears the if not value guard, unwraps to inner=\"\", and — empty structural scan, ip_address(\"\") raises, no colon, \"\".isascii() is True — lands stored as \"\". rewrite_url then emits https://:9000/hook, and apply_hooks' scheme/port re-check passes because neither changed, so a malformed empty authority reaches SSRF/signing. Self-inflicted operator config and SSRF stays authoritative, so it's Low — but a one-line if not inner: re-check right after the unwrap closes it. (Flagged independently by security-reviewer.)
• IPv4-mapped spelling is Python-canonical, not RFC 5952 §5. ::ffff:127.0.0.1 folds to [::ffff:7f00:1] (pure hextet) rather than the SHOULD-form mixed [::ffff:127.0.0.1]. Both are valid RFC 3986 IPv6address, and it doesn't break AdCP signing because canonicalize_authority never re-folds IPs — the only theoretical break is a receiver that independently RFC-5952-normalizes before verifying. Worth a one-line docstring note that the spelling is Python-canonical.

Minor nits (non-blocking)

1. PR body and commit name the wrong method. The "Placement" section says validation lives in validate_for_sender "rather than __post_init__" — but the code puts it in __post_init__. The body's reasoning ("covers direct apply_hooks use and hooks not attached to a sender — strictly broader") describes __post_init__ exactly, so the code is the better choice and the prose is the thing that's wrong. An interesting inversion — the shipped code is broader than its own changelog claims. Fix the body/commit to say __post_init__ so a future auditor reasons about the right entry point.
2. Comment implies the IP-parse rejects zone IDs; the structural filter does. The zone-ID comment reads as though ipaddress.ip_address catches fe80::1%eth0, but % is in _STRUCTURAL_CHARS and rejects it several lines earlier — ip_address (which would accept the scoped form) is never reached. Cosmetic.
3. Unconditional signing import. from adcp.signing._idna_canonicalize import canonicalize_host runs at the top of __post_init__ even on the default/ASCII and pure-IP paths that never call it; moving it into the non-ASCII branch would spare them the coupling. No circular-import risk. Low priority.

Approving on the strength of the structural-over-syntactic invariant plus the signing-canonicalization round-trip test. Follow-ups noted.

The construction guard still accepts inputs that normalize to an empty host. Reproduced on current main + this PR:\n\n- DockerLocalhostRewrite(rewrite_to="[]").rewrite_to == ""\n- rewrite_url("https://localhost:9000/hook") returns "https://:9000/hook"\n- DockerLocalhostRewrite(rewrite_to=".").rewrite_to == ""\n\nThe first passes because unwrapping happens after the initial non-empty check; the second passes because the ASCII branch strips all trailing dots without rechecking. Please reject an empty inner value and an empty post-normalization value, with regression coverage for both. The focused suite otherwise passes (29 tests).

Clean fix. Right shape: rewrite_to is the one non-signing layer that synthesizes the netloc that later becomes the signed @authority, so structural validation at construction is exactly where a mis-split turns into a wrong signature instead of a failed request. Fail-closed beats fail-open here.

Things I checked

• The structural-before-parse ordering is load-bearing. _STRUCTURAL_CHARS (webhook_transport_hooks.py:46) scans inner before ipaddress.ip_address, so % catches RFC 6874 zone IDs (fe80::1%eth0) before ipaddress would accept the scoped form. Every URL-boundary char is covered — /@?# terminators, @ userinfo, \ (WHATWG backslash normalization), [], plus control chars via ord < 0x21 / 0x7F. : is correctly excluded and handled by the IP-literal parse / non-IP port check.
• The two empty-host routes the follow-up commit closes. "[]" (webhook_transport_hooks.py:113, non-empty until brackets come off) and "." / ".." (single-dot strip, not rstrip('.'), so ".." → "." → empty label) both used to assemble to https://:9000/hook. The "no empty label" phrasing at webhook_transport_hooks.py:186 also covers the interior "a..b" case. Correct.
• Bare IPv6 bracketing survives the full path. [{ip}] folding (webhook_transport_hooks.py:145) means apply_hooks' new.port re-parse at :146 doesn't raise, and canonicalize_authority yields [2001:db8::1]:9000. IPv4-mapped v6 folds to canonical [::ffff:7f00:1]. object.__setattr__ is the correct frozen-dataclass idiom.
• No canonicalization mismatch. security-reviewer confirmed in webhook_sender._send (webhook_sender.py:974-1023) the single effective_url string is what gets SSRF-validated, signed, and POSTed — sign-target and connect-target derive from the identical string, so there's no sign-as-one/connect-as-another gap. This guard is signed-URL integrity, not the SSRF boundary; SSRF still runs authoritatively after the hook.
• Not a breaking change. DockerLocalhostRewrite is public, but everything the guard now rejects at construction was already broken — rejected downstream by the pinned transport or silently mis-signed. fix(webhooks): is the correct semver signal; no ! needed. Verified underscore Docker names (my_service, host_gateway, _dns-sd._udp.local) still accepted — the structural-not-IDNA decision is the right call for the class that exists to serve Docker.
• No import cycle: adcp.signing never references webhook_transport_hooks, so the deferred canonicalize_host import can't loop.

Follow-ups (non-blocking — file as issues)

• UTS46 silently deletes mapped/ignored codepoints (webhook_transport_hooks.py:200). A soft hyphen (U+00AD) in a non-ASCII rewrite_to is stripped, so "ho­st.example" canonicalizes to "host.example" — self-consistent (sign == connect), operator config only, not exploitable. But the docstring frames this branch as fail-loud, and some inputs mutate silently. Worth a log line when the canonical form differs beyond case/bracket/trailing-dot.
• Structural-only ASCII acceptance permits reg-name sub-delims (webhook_transport_hooks.py:180-193). foo=bar passes structurally but httpx may reject at send time — a per-delivery failure rather than a wiring-time one. Explicit documented tradeoff to keep underscores working; noting it, not blocking it.

Minor nits (non-blocking)

1. PR-body "Placement" paragraph is inverted. It says validation lives in validate_for_sender "rather than __post_init__" — the code does the opposite (__post_init__), and __post_init__ is the only placement that actually covers direct apply_hooks use and unattached hooks, since validate_for_sender fires only when a hook is wired to a sender. The code is correct and strictly broader; the prose argues for the code's opposite. Fix the description so a future reader trusting it doesn't conclude the reverse of what ships.
2. Deferred import is unconditional (webhook_transport_hooks.py:97-101) but canonicalize_host is used only on the non-ASCII branch. Cosmetic — after first import it's a sys.modules hit — but it could move inside that branch so the common IP/ASCII paths never touch the signing package.
3. Docstring at webhook_transport_hooks.py:77-79 still describes only the validate_for_sender / allow_private_destinations check; the new rewrite_to canonicalization contract is documented in the class docstring above, so this is fine, but the two paragraphs read as if validate_for_sender is the only construction-time check.

25 test cases, 9 of which fail against the pre-fix module — the underscore-name pin (test_rewrite_to_accepts_docker_legal_service_names) is a good regression fence against a future IDNA "tidy-up."

Approving on the strength of the structural-before-parse ordering plus the sign/connect same-string guarantee.

Verified the follow-up rejects bracket-empty, root-dot-empty, and interior-empty-label rewrite targets while retaining the intended Docker-compatible names. My previous request is fully addressed.