Repository navigation
fix(bep): refuse a duplicate Host and cap idle upstream connections
PASS_WITH_CONDITIONS
Governs: specs/networking/deployment-and-egress-gateway.md §5.7 (v0.9, gominimal/arch#73). The BEP dns/both row (line 208) and the :7654 row (line 206) require a fast close on the h2 preface and an Upgrade: h2c strip. The Framing discipline bullet (line 216) requires canonical re-serialization, an audited close on ambiguous framing, and no upstream connection shared across boxes. The Determinism rule (line 218) requires every refusal to be a fast protocol-level close. h3 discovery suppression (line 219) requires the Alt-Svc strip.
Re-review. This head is a compare on d24c6cd, whose PASS_WITH_CONDITIONS is the baseline. since.diff touches two things only. (1) parse_request closes on more than one Host field, as Malformed("duplicate_host"). This strengthens the authority pinning that line 216 says the framing discipline protects. It is a fast close (line 218). The design does not list it among the audited framing refusals, so no audit event is correct. (2) UpstreamPool keeps at most MAX_IDLE_PER_KEY idle connections per box and authority, and removes an empty key. The design is silent on a cap. The key still carries box_id, so line 216's "never shared across boxes" holds. The new test assertions check the cap and the key removal and relax no gate.
Ruling. BEP-074, BEP-076 and BEP-077 conform at this head. The compare does not close the gap that the PR body states: the audited close of line 216 lands in a caller-supplied AuditSink, no sink exists outside the tests, and no caller logs CloseReason::rule(). The PR names this work but files no issue (rubric rule 6). C1 asks for the issue and the link. This keeps the baseline's verdict, so there is no departure from precedent.
Not checked. The ledger entry for d24c6cd is cut off after the governing sections, so I could not read its conditions verbatim. C1 restates the open work from the PR body, and it can overlap a condition of that ruling. I did not build or run the tests, per the reviewer contract. No minimal-review findings were staged for this head.
Conditions
- C1: File one issue in gominimal/minimal for the work this PR leaves to the caller, and link it in the PR body in place of the "Observability gap" and "Diagnostics gap" notes: (a) an
AuditSinkimplementation on the local audit log, so theframing_ambiguousevent thatforward_request_head(crates/bep/src/http.rs) records is durable andmin box audit <box>shows it; (b) the connection loop that logs one debug line per closed connection withCloseReason::rule(). Until the issue exists, the design's audited close (§5.7 line 216) is satisfied only by the in-memoryVec<AuditEvent>sink of the tests.
Ruled at 08ed473 against gominimal/arch@3dab1097cda1 by claude-opus-5-5; arch_rulings 25, job cf4a51da-4c0c-4219-a733-9ae0b95b54dd.