The access report needs to apply IPv4 and IPv6 policy with explicit denies taking precedence. Implement evaluation so subnet membership and invalid addresses follow the defined behavior.
Build the implementation in Rust under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has allow and deny lists of CIDRs and addresses list of IP strings. Parse CIDRs with host bits permitted (normalize to the containing network). An address passes if it belongs to at least one same-family allow network and no same-family deny network. Return booleans in address order. Invalid addresses or CIDRs must be rejected; unmatched address families are denied.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.