# hmn-code-test interface selection contract

Installed file:

```
/root/hmn/hmn-code-test.sh
```

Installed SHA256:

```
f05a4cb3c72db901f956ea9f0cdeea8ca36cd192083b4cf6416b93c30086ddef
```

Runtime library:

```
/usr/local/lib/router-egress-vm101-runtime.sh
```

Runtime-library SHA256:

```
1fd8d8b9258f7ca1d711323b7652f0b46991e1d17346b59e1d8ff5d71ba471d9
```

## Selection policy

1. When `HMN_REQUEST_IFACE` names an interface explicitly, that interface
   is preferred and must pass `vm101_strict_iface`.
2. When the value is `auto` or unset, the script calls
   `vm101_healthy_bootstrap_iface`.
3. The runtime selector may prefer a healthy `vpn1-vpn5` default from
   optional table 200.
4. If table 200 has no usable default, the selector checks `vpn1` through
   `vpn5`.
5. If no healthy interface exists, the test fails strictly.
6. The access code is never printed.

## R11C proof

- Invalid explicit interface `eth0` was rejected.
- Automatic selection succeeded through vpn1.
- The HideMyName server-list API returned `services.wg`.
- The installed file succeeded again with explicit
  `HMN_REQUEST_IFACE=vpn1`.
- No services were restarted and no VPN interface was recreated.