security: bound process health probes before runtime-isolation bypass

[seonghobae]

Finding and current repair status

Process-local /livez and /readyz intentionally bypass application admission so health remains observable under saturation, but the historical generic/pg-erd adapters granted that privilege from path alone. Application-shaped traffic such as body-bearing health requests and unsupported methods could therefore receive the same local path without entering the ordinary Runtime Isolation boundary.

Dedicated Draft #102 owns this repair at 1faa68a6cc25dedbe8c11140c4e62509855fc433, with exactly eight Runtime Isolation paths and no product authentication, Keyverse identity, Wardnet/EgressWeave policy, upstream/product-health semantics, or new routing authority. Its shared process-health classifier permits privileged local handling only for payload-free GET/HEAD probes. Body-framed health traffic enters ordinary in-flight admission and fails 413; unsupported bodyless methods enter the same admission boundary and return 405 with Allow: GET, HEAD.

Review also found the HTTP/2 transport-state gap: HEADERS without END_STREAM may be followed by DATA even without Content-Length. #102 repair b867cb365a5e123f6b5bcc378bb026b9533504e4 consumes Pingora Session::is_body_done() before request-header borrowing and passes that fact into the shared classifier. Real H2 HEADERS(no END_STREAM) -> DATA acceptance remains TLS/H2 owner #75 after ordinary parent reconciliation; #102 does not activate downstream H2 itself.

Current parent / evidence order

#102 remains intentionally Draft on historical #15 base 74c0892f919e38d767f9660d4533fcc7df8246c2. Active #15 is now Draft exact 5162ad5220792c7f94fa3fc1deb0488d30410436 after its latest hosted coverage RED and test-only unit-compilation sanitization repair. Fresh compare is diverged at merge-base 74c0892...: #102 is ahead 22 / behind 30.

The missing parent lineage includes the full forwarding/intermediary trust, coverage, real-listener shutdown, RFC 3986 Host-port, Via, Max-Forwards/body-ordering, public-boundary fixture, and the latest unit-compilation forwarding-sanitization coverage repair. Those parent deltas do not belong to this process-health child and must not be copied or cherry-picked into #102.

Current causal order is #15@5162ad5 current-range review -> Ready exact execution -> 100% owned-production coverage + CI/Supply/source-binding GREEN + independent governance -> normal #15 integration -> #102 ordinary/non-force reconciliation preserving only its eight valid Runtime Isolation paths -> fresh exact fmt/compile/test/Clippy/warnings-denied rustdoc/100% coverage/real traffic/load/OCI/Supply/current review -> #75 ordinary reconciliation + real H2 no-END_STREAM RED/GREEN.

Historical Draft CI/Supply results for #102 remain characterization only. No force push, destructive rebase, predecessor receipt transfer, self-approval, gate weakening, protected merge, immutable release, canary, rollback, cutover, or legacy-removal credit is allowed.

[seonghobae]

Owner-path implementation is now open as Draft #102 on top of current #15 exact 74c0892f919e38d767f9660d4533fcc7df8246c2.

RED was committed first at 82d317efd032a4a9af7a1aac0b6c16e6072c02d4: the compiled generic and pg-erd listeners accepted body-bearing GETs and unsupported methods on /livez//readyz as the same privileged local 200 probe path. #102 now centralizes the process-health classifier, limits bypass to payload-free GET, makes body-framed/non-GET health-path traffic consume ordinary admission, and adds real-listener saturation fixtures proving those invalid shapes get 503 while the sole application lease is held and valid GET /readyz remains 200.

Current implementation exact is 305c03a077ef64446c4f7bdadf11ab7041faf412. #102 remains Draft and does not inherit #15 evidence. Parent #15 review is current-exact with no actionable threads; parent CI/Supply terminal evidence is still the prerequisite. No force restack, protected integration, or issue closure is claimed.

[seonghobae]

#102 advanced after a fresh RFC 9110 review found one more valid boundary defect: HEAD had been classified as unsupported even though RFC 9110 defines HEAD as GET without response content and requires general-purpose servers to support GET and HEAD. RED 60ef8b01fbc01658cfe22aea628f7e432b090d02 requires real-listener HEAD 200 plus Allow: GET, HEAD; GREEN af42532602965fc96216abd50cc509059b5bad69 updates the shared classifier/responder. Current Draft exact is 34dbb9f918e3f2961ef907b0ceb6e3686614a8f0, still exactly eight effective child paths. GET/HEAD remain privileged only when payload-free; body framing and all other methods remain behind ordinary admission. Parent #15 hosted CI/Supply remains the prerequisite, so #102 stays Draft and no merge/issue closure is claimed.

[seonghobae]

Fresh owner-path verification for #102 exact 34dbb9f918e3f2961ef907b0ceb6e3686614a8f0: the remaining H2 transport finding is valid and precedes promotion. src/process_health.rs still classifies privilege only from RequestHeader fields, so an HTTP/2 GET /livez or /readyz sent as HEADERS without END_STREAM and without Content-Length can be classified Probe even though DATA may follow. Header framing alone is therefore not proof that the downstream request body is complete.

Minimal causal repair should stay inside the existing shared process-health boundary: derive downstream body completion from Pingora Session::is_body_done() before borrowing the request header, pass that supplier-owned transport fact into the classifier, and grant the admission bypass only when (a) exact health path, (b) GET/HEAD, (c) safe header framing, and (d) downstream body is already complete are all true. Keep malformed/body-capable shapes behind ordinary application admission. This API is present on the currently pinned Pingora source and remains present on the 0.9.0 supplier path, so the fix does not create a transition-specific abstraction.

Acceptance needs a real HTTP/2 listener fixture, not only a constructed RequestHeader: for both /livez and /readyz, HEADERS without END_STREAM followed by DATA must never receive privileged 200/admission bypass, while a normal HEADERS+END_STREAM GET/HEAD probe must retain saturation-observable 200 behavior. Keep #102 Draft until that transport RED→fix→current-exact GREEN/review is complete and parent #15 itself reaches terminal exact-head CI/Supply evidence.

[seonghobae]

Repair advanced on #102 without importing H2 listener authority. Source commit b867cb365a5e123f6b5bcc378bb026b9533504e4 now reads Pingora Session::is_body_done() in both composition roots and passes it into the shared health classifier. Exact GET/HEAD /livez//readyz receives privileged 200 only when header framing is body-free and the downstream body is already complete; transport-incomplete requests become RejectPayload, acquire ordinary application admission, then follow the 413 path. Unit coverage pins both endpoints × GET/HEAD with body_done=false. Contract/security/TRD/changelog are code-current at #102 exact 1faa68a6cc25dedbe8c11140c4e62509855fc433.

Residual acceptance is deliberately not marked complete: #102's historical cleartext-v1 line does not own downstream HTTP/2 admission, so the real HEADERS(no END_STREAM) -> DATA listener fixture requested by security review has been handed to H2 owner #75 (comment 5668717270) for ordinary reconciliation. The #102 CodeRabbit thread remains unresolved until that executable H2 evidence exists. Draft CI/Supply for #102 exact are policy-skipped, so no promotion GREEN is claimed.