feat(bep): relay request bodies re-framed and log each close · gominimal/minimal@e94f459

PASS_WITH_CONDITIONS

Baseline: the PASS_WITH_CONDITIONS ruling on 08ed473 (this PR) stands for everything that since.diff does not touch. The compare 08ed473..e94f459 has two commits: ebd39bd (drop a connection given back after its box is dropped) and e94f459 (relay request bodies re-framed and log each close).

Governs: specs/networking/deployment-and-egress-gateway.md §5.7 (v0.9, gominimal/arch#73). The Framing discipline note (line 216) says the BEP never forwards raw head bytes, refuses ambiguous framing with an audited close, and never shares an upstream connection across boxes. The determinism rule (line 218) makes each refusal a fast protocol-level close. The BEP dns/both row (line 208) and the :7654 row (line 206) give the h2 preface close and the h2c strip. Line 219 gives the Alt-Svc strip.

Ruling: the compare conforms. Body relay re-frames the body from the parsed head. A Content-Length body goes up as exactly that many bytes, and a chunked body goes up as canonical chunks with extensions and trailers dropped. This closes the desync that line 216 names: bytes audited as body can no longer arrive upstream as a request the audit never saw. A Connection option that names a framing header is refused as framing_ambiguous and is audited on the same path as the other ambiguities. A missing Host, an absolute-form target that disagrees with Host, and Connection: host close as malformed. Each close is a fast close (line 218). The pool epoch keeps a connection that is checked out across drop_box from going to a later box with the same id, which tightens line 216. forward_requests writes the task's one debug line per closed connection, with the box id and CloseReason::rule(). The tracing workspace dependency in crates/bep/Cargo.toml is outside the task's declared layers, but it is the smallest change that makes the declared observability line true, in the crate that owns it. I do not count it as a placement deviation (rule 8). C1 is the same residual as in the baseline: the audited close reaches only the AuditSink trait until #2435 lands.

Note for the author: the PR body says that the bep crate has no logging dependency and that body relay is not part of this change. At this head both statements are stale. Update the body so the next reviewer reads the change as it is.

Not checked: that the tests pass at this head. That needs a build, which is out of bounds. I also could not open #2435, because gh is not in the sandbox. The residual is taken from the PR body and the baseline. The epochs map in UpstreamPool grows by one entry for each dropped box id. That is a resource question for minimal-review, not a design line. No findings.json was staged.

Conditions

C1: Implement bep::http::AuditSink in the task that adds the min/v1 audit log (BEP-039), so that each AuditEvent { box_id, marker: "framing_ambiguous", rule } that forward_head records is appended to the log and min box audit <box> shows the marker. This is open as filed residual #2435, blocked on #2361 (T9). No edit is required on this head.

_{Ruled at e94f459 against gominimal/arch@3dab1097cda1 by claude-opus-5-5; arch_rulings 41, job 6b10ee2f-10f0-49d5-8317-4d51b2dd0e92.}

Navigation Menu

Repository navigation

PASS_WITH_CONDITIONS

Re-running checks...