Function egress_target 

pub fn egress_target(
    list: &EgressAllowlist,
    target: &EgressTarget,
) -> EgressOutcome

The destination half of the egress question: may this run reach this host at all? The payload half stays with egress — “may these bytes leave” and “may this host be reached” are two questions, and a caller that asks only one of them should not look as if it asked both.

Loopback and private targets are not on the list: a local model or a machine on the same network is not egress, and putting them behind a domain list would mean a confidential building could not reach its own inference server.