Close RFC 9113 HTTP/2 conformance gaps

Author: cobycloud

.ssot/adr/ADR-0614-specs-own-typed-adr-links.yaml

@@ -0,0 +1 @@
+{"boundary":{"feature_ids":["feat:rfc9113-http2-content-length-mismatch-rejection","feat:rfc9113-http2-field-value-rejection","feat:rfc9113-http2-host-authority-mismatch-rejection","feat:rfc9113-http2-malformed-request-target-rejection","feat:rfc9113-http2-server-push-safe-cacheable-methods"],"frozen":true,"id":"bnd:rfc9113-http2-gap-closure","profile_ids":[],"status":"frozen","title":"RFC 9113 HTTP/2 gap closure"},"features":[{"claim_ids":["clm:rfc9113-http2-content-length-mismatch-rejection"],"description":"Reject malformed HTTP/2 requests when content-length does not equal the sum of DATA payload octets.","id":"feat:rfc9113-http2-content-length-mismatch-rejection","implementation_status":"implemented","lifecycle":{"note":null,"replacement_feature_ids":[],"stage":"active"},"plan":{"horizon":"current","slot":null,"target_claim_tier":"T3","target_lifecycle_stage":"active"},"requires":[],"spec_ids":["spc:2002","spc:2044"],"test_ids":["tst:rfc9113-http2-content-length-mismatch-rejection","tst:rfc9113-http2-wire-negatives"],"title":"RFC 9113 HTTP/2 content-length mismatch rejection"},{"claim_ids":["clm:rfc9113-http2-field-value-rejection"],"description":"Reject malformed HTTP/2 request field values that contain disallowed octets or leading and trailing whitespace.","id":"feat:rfc9113-http2-field-value-rejection","implementation_status":"implemented","lifecycle":{"note":null,"replacement_feature_ids":[],"stage":"active"},"plan":{"horizon":"current","slot":null,"target_claim_tier":"T3","target_lifecycle_stage":"active"},"requires":[],"spec_ids":["spc:2002","spc:2044"],"test_ids":["tst:rfc9113-http2-field-value-rejection","tst:rfc9113-http2-wire-negatives"],"title":"RFC 9113 HTTP/2 malformed field value rejection"},{"claim_ids":["clm:rfc9113-http2-host-authority-mismatch-rejection"],"description":"Reject malformed HTTP/2 requests when Host and :authority disagree.","id":"feat:rfc9113-http2-host-authority-mismatch-rejection","implementation_status":"implemented","lifecycle":{"note":null,"replacement_feature_ids":[],"stage":"active"},"plan":{"horizon":"current","slot":null,"target_claim_tier":"T3","target_lifecycle_stage":"active"},"requires":[],"spec_ids":["spc:2002","spc:2044"],"test_ids":["tst:rfc9113-http2-host-authority-mismatch-rejection","tst:rfc9113-http2-wire-negatives"],"title":"RFC 9113 HTTP/2 Host and authority mismatch rejection"},{"claim_ids":["clm:rfc9113-http2-malformed-request-target-rejection"],"description":"Reject malformed HTTP/2 request targets such as empty :path for http or https and deprecated userinfo in :authority.","id":"feat:rfc9113-http2-malformed-request-target-rejection","implementation_status":"implemented","lifecycle":{"note":null,"replacement_feature_ids":[],"stage":"active"},"plan":{"horizon":"current","slot":null,"target_claim_tier":"T3","target_lifecycle_stage":"active"},"requires":[],"spec_ids":["spc:2002","spc:2044"],"test_ids":["tst:rfc9113-http2-malformed-request-target-rejection","tst:rfc9113-http2-wire-negatives"],"title":"RFC 9113 HTTP/2 malformed request target rejection"},{"claim_ids":["clm:rfc9113-http2-server-push-safe-cacheable-methods"],"description":"Allow HTTP/2 server push only for safe cacheable methods.","id":"feat:rfc9113-http2-server-push-safe-cacheable-methods","implementation_status":"implemented","lifecycle":{"note":null,"replacement_feature_ids":[],"stage":"active"},"plan":{"horizon":"current","slot":null,"target_claim_tier":"T3","target_lifecycle_stage":"active"},"requires":[],"spec_ids":["spc:2002","spc:2044"],"test_ids":["tst:rfc9113-http2-server-push-safe-cacheable-methods","tst:rfc9113-http2-wire-negatives"],"title":"RFC 9113 HTTP/2 server push safe cacheable methods"}],"generated_at":"2026-05-11T03:54:49Z","kind":"boundary_snapshot","registry_path":".ssot/registry.json","registry_sha256":"449f3db7e410b35242eff6c3122c9e6f3665a60df3343334ac69d1a3c663d23d","schema_version":1,"summary":{"boundary_id":"bnd:rfc9113-http2-gap-closure","feature_count":5,"frozen":true,"profile_count":0,"status":"frozen"}}

.ssot/adr/ADR-0615-downstream-assurance-language-ceilings.yaml

@@ -0,0 +1 @@
+{"boundaries":[{"feature_ids":["feat:rfc9113-http2-content-length-mismatch-rejection","feat:rfc9113-http2-field-value-rejection","feat:rfc9113-http2-host-authority-mismatch-rejection","feat:rfc9113-http2-malformed-request-target-rejection","feat:rfc9113-http2-server-push-safe-cacheable-methods"],"frozen":true,"id":"bnd:rfc9113-http2-gap-closure","profile_ids":[],"status":"frozen","title":"RFC 9113 HTTP/2 gap closure"}],"boundary":{"feature_ids":["feat:rfc9113-http2-content-length-mismatch-rejection","feat:rfc9113-http2-field-value-rejection","feat:rfc9113-http2-host-authority-mismatch-rejection","feat:rfc9113-http2-malformed-request-target-rejection","feat:rfc9113-http2-server-push-safe-cacheable-methods"],"frozen":true,"id":"bnd:rfc9113-http2-gap-closure","profile_ids":[],"status":"frozen","title":"RFC 9113 HTTP/2 gap closure"},"claims":[{"description":"Tigrcorn rejects malformed HTTP/2 requests whose content-length field value does not equal the sum of DATA payload octets as required by RFC 9113 section 8.1.1.","evidence_ids":["evd:rfc9113-http2-gap-regressions-pytest","evd:rfc9113-http2-wire-negatives-pytest"],"feature_ids":["feat:rfc9113-http2-content-length-mismatch-rejection"],"id":"clm:rfc9113-http2-content-length-mismatch-rejection","kind":"conformance","status":"published","test_ids":["tst:rfc9113-http2-content-length-mismatch-rejection","tst:rfc9113-http2-wire-negatives"],"tier":"T3","title":"RFC 9113 HTTP/2 content-length mismatch rejection"},{"description":"Tigrcorn rejects malformed HTTP/2 request field values containing disallowed octets or leading and trailing whitespace as required by RFC 9113 section 8.2.1.","evidence_ids":["evd:rfc9113-http2-gap-regressions-pytest","evd:rfc9113-http2-wire-negatives-pytest"],"feature_ids":["feat:rfc9113-http2-field-value-rejection"],"id":"clm:rfc9113-http2-field-value-rejection","kind":"conformance","status":"published","test_ids":["tst:rfc9113-http2-field-value-rejection","tst:rfc9113-http2-wire-negatives"],"tier":"T3","title":"RFC 9113 HTTP/2 malformed field value rejection"},{"description":"Tigrcorn rejects malformed HTTP/2 requests when Host and :authority disagree as required by RFC 9113 section 8.3.1.","evidence_ids":["evd:rfc9113-http2-gap-regressions-pytest","evd:rfc9113-http2-wire-negatives-pytest"],"feature_ids":["feat:rfc9113-http2-host-authority-mismatch-rejection"],"id":"clm:rfc9113-http2-host-authority-mismatch-rejection","kind":"conformance","status":"published","test_ids":["tst:rfc9113-http2-host-authority-mismatch-rejection","tst:rfc9113-http2-wire-negatives"],"tier":"T3","title":"RFC 9113 HTTP/2 Host and authority mismatch rejection"},{"description":"Tigrcorn rejects malformed HTTP/2 request targets including empty :path for http or https and deprecated userinfo in :authority as required by RFC 9113 section 8.3.1.","evidence_ids":["evd:rfc9113-http2-gap-regressions-pytest","evd:rfc9113-http2-wire-negatives-pytest"],"feature_ids":["feat:rfc9113-http2-malformed-request-target-rejection"],"id":"clm:rfc9113-http2-malformed-request-target-rejection","kind":"conformance","status":"published","test_ids":["tst:rfc9113-http2-malformed-request-target-rejection","tst:rfc9113-http2-wire-negatives"],"tier":"T3","title":"RFC 9113 HTTP/2 malformed request target rejection"},{"description":"Tigrcorn only emits HTTP/2 server push requests for safe cacheable methods as required by RFC 9113 sections 8.4 and 8.4.1.","evidence_ids":["evd:rfc9113-http2-gap-regressions-pytest","evd:rfc9113-http2-wire-negatives-pytest"],"feature_ids":["feat:rfc9113-http2-server-push-safe-cacheable-methods"],"id":"clm:rfc9113-http2-server-push-safe-cacheable-methods","kind":"conformance","status":"published","test_ids":["tst:rfc9113-http2-server-push-safe-cacheable-methods","tst:rfc9113-http2-wire-negatives"],"tier":"T3","title":"RFC 9113 HTTP/2 server push safe cacheable methods"}],"evidence":[{"claim_ids":["clm:rfc9113-http2-content-length-mismatch-rejection","clm:rfc9113-http2-field-value-rejection","clm:rfc9113-http2-host-authority-mismatch-rejection","clm:rfc9113-http2-malformed-request-target-rejection","clm:rfc9113-http2-server-push-safe-cacheable-methods"],"id":"evd:rfc9113-http2-gap-regressions-pytest","kind":"report","path":"docs/review/conformance/releases/rfc9113-http2-gap-closure/pytest-rfc9113-http2-gap-regressions.txt","status":"passed","test_ids":["tst:rfc9113-http2-content-length-mismatch-rejection","tst:rfc9113-http2-field-value-rejection","tst:rfc9113-http2-host-authority-mismatch-rejection","tst:rfc9113-http2-malformed-request-target-rejection","tst:rfc9113-http2-server-push-safe-cacheable-methods"],"tier":"T3","title":"RFC 9113 HTTP/2 gap regression pytest evidence"},{"claim_ids":["clm:rfc9113-http2-content-length-mismatch-rejection","clm:rfc9113-http2-field-value-rejection","clm:rfc9113-http2-host-authority-mismatch-rejection","clm:rfc9113-http2-malformed-request-target-rejection","clm:rfc9113-http2-server-push-safe-cacheable-methods"],"id":"evd:rfc9113-http2-wire-negatives-pytest","kind":"report","path":"docs/review/conformance/releases/rfc9113-http2-gap-closure/pytest-rfc9113-http2-wire-negatives.txt","status":"passed","test_ids":["tst:rfc9113-http2-wire-negatives"],"tier":"T3","title":"RFC 9113 HTTP/2 wire-level negative pytest evidence"}],"generated_at":"2026-05-11T03:55:16Z","kind":"published_snapshot","registry_path":".ssot/registry.json","registry_sha256":"13e2796ee82131d4857cec88d428d087d76593945703ba69e4364774d18b8b4a","release":{"boundary_id":"bnd:rfc9113-http2-gap-closure","boundary_ids":["bnd:rfc9113-http2-gap-closure"],"claim_ids":["clm:rfc9113-http2-content-length-mismatch-rejection","clm:rfc9113-http2-field-value-rejection","clm:rfc9113-http2-host-authority-mismatch-rejection","clm:rfc9113-http2-malformed-request-target-rejection","clm:rfc9113-http2-server-push-safe-cacheable-methods"],"evidence_ids":["evd:rfc9113-http2-gap-regressions-pytest","evd:rfc9113-http2-wire-negatives-pytest"],"id":"rel:rfc9113-http2-gap-closure-0-3-16-dev5","status":"published","version":"0.3.16.dev5-rfc9113-http2-gap-closure.1"},"schema_version":1,"summary":{"boundary_count":1,"boundary_ids":["bnd:rfc9113-http2-gap-closure"],"claim_count":5,"evidence_count":2,"release_id":"rel:rfc9113-http2-gap-closure-0-3-16-dev5","status":"published","version":"0.3.16.dev5-rfc9113-http2-gap-closure.1"}}