Finding and current repair state
Historical #15 applied RFC 9110 §7.6.2 Max-Forwards handling only in generic GatewayProxy, while bounded MigrationGatewayProxy is also an HTTP intermediary and could forward TRACE/OPTIONS without inspecting, terminating, or decrementing the field. This remains a valid reusable HTTP Policy gap; it does not move product auth/business logic, Keyverse identity, Wardnet/EgressWeave authority, route discovery, WebSocket authority, or product OPTIONS/TRACE semantics into the gateway.
Dedicated Draft #106 owns the repair. Test-first RED 84a751251ffb72baf77f55816cb9f2cd884c8782 proved OPTIONS ... Max-Forwards: 0 reached the origin through the compiled pg-erd listener. Current child exact 214f4afe59040193f84d498daf96783f30477063 introduces one internal http_intermediary_policy consumed by both generic and pg-erd adapters: positive values decrement before forwarding, zero terminates locally with bounded 501, malformed/duplicate TRACE/OPTIONS values fail closed, and ordinary methods retain the field. Application admission and declared-body checks remain ahead of local hop termination.
Current parent / conflict finding
#106 remains Draft and non-mergeable on historical #15 base 38dab48f910f7078c3dfd37764a6fdc229bd513e. Active #15 is now Draft exact 5162ad5220792c7f94fa3fc1deb0488d30410436 after the latest hosted coverage RED and test-only unit-compilation forwarding-sanitization repair. Fresh compare is diverged at merge-base 38dab48...: #106 is ahead 10 / behind 29.
This overlap must be repaired by parent-first semantic reconciliation, not by choosing one side of a conflict. Current #15 owns the valid generic Max-Forwards/Via/body-ordering/TRACE fail-close behavior, real-listener termination fixtures, forwarding-policy trust-boundary tests and the current unit-compilation sanitization coverage repair. Do not duplicate those parent semantics or fixtures in #106.
After #15 becomes terminal-clean and normally integrates, ordinary/non-force reconcile #106 from the integrated parent, preserving its ten valid shared-policy paths while adopting every current-parent test, fixture, contract and coverage edge into that structure.
The reconciled exact must prove through real compiled pg-erd traffic that zero-hop OPTIONS terminates locally without backend contact, positive values decrement exactly once, malformed/duplicate TRACE/OPTIONS fail closed without bypassing admission, ordinary methods do not reinterpret the field, declared-body oversize wins before Max-Forwards classification, and declared/streamed TRACE content never forwards attacker body octets. Then reacquire exact formatting, compile/test, strict Clippy, warning-denied rustdoc, 100% owned-production coverage, real-listener/load/OCI/Supply Chain and current independent review.
Current causal order is #15@5162ad5 current-range review -> Ready exact execution -> 100% owned-production coverage + CI/Supply/source-binding GREEN + independent governance -> normal #15 integration -> #106 ordinary/non-force reconciliation preserving child policy + parent ordering/coverage/termination semantics -> fresh exact evidence/review.
Durable docs/product-technical-gap-baseline.md and deep TRACEABILITY remain dedicated #61 authority. No force push, destructive rebase, self-approval, gate weakening, predecessor GREEN transfer, protected merge, release, canary, rollback, cutover, or legacy-removal credit is allowed.
Finding and current repair state
Historical #15 applied RFC 9110 §7.6.2
Max-Forwardshandling only in genericGatewayProxy, while boundedMigrationGatewayProxyis also an HTTP intermediary and could forward TRACE/OPTIONS without inspecting, terminating, or decrementing the field. This remains a valid reusable HTTP Policy gap; it does not move product auth/business logic, Keyverse identity, Wardnet/EgressWeave authority, route discovery, WebSocket authority, or product OPTIONS/TRACE semantics into the gateway.Dedicated Draft #106 owns the repair. Test-first RED
84a751251ffb72baf77f55816cb9f2cd884c8782provedOPTIONS ... Max-Forwards: 0reached the origin through the compiled pg-erd listener. Current child exact214f4afe59040193f84d498daf96783f30477063introduces one internalhttp_intermediary_policyconsumed by both generic and pg-erd adapters: positive values decrement before forwarding, zero terminates locally with bounded 501, malformed/duplicate TRACE/OPTIONS values fail closed, and ordinary methods retain the field. Application admission and declared-body checks remain ahead of local hop termination.Current parent / conflict finding
#106 remains Draft and non-mergeable on historical #15 base
38dab48f910f7078c3dfd37764a6fdc229bd513e. Active #15 is now Draft exact5162ad5220792c7f94fa3fc1deb0488d30410436after the latest hosted coverage RED and test-only unit-compilation forwarding-sanitization repair. Fresh compare is diverged at merge-base38dab48...: #106 is ahead 10 / behind 29.This overlap must be repaired by parent-first semantic reconciliation, not by choosing one side of a conflict. Current #15 owns the valid generic
Max-Forwards/Via/body-ordering/TRACE fail-close behavior, real-listener termination fixtures, forwarding-policy trust-boundary tests and the current unit-compilation sanitization coverage repair. Do not duplicate those parent semantics or fixtures in #106.After #15 becomes terminal-clean and normally integrates, ordinary/non-force reconcile #106 from the integrated parent, preserving its ten valid shared-policy paths while adopting every current-parent test, fixture, contract and coverage edge into that structure.
The reconciled exact must prove through real compiled pg-erd traffic that zero-hop OPTIONS terminates locally without backend contact, positive values decrement exactly once, malformed/duplicate TRACE/OPTIONS fail closed without bypassing admission, ordinary methods do not reinterpret the field, declared-body oversize wins before Max-Forwards classification, and declared/streamed TRACE content never forwards attacker body octets. Then reacquire exact formatting, compile/test, strict Clippy, warning-denied rustdoc, 100% owned-production coverage, real-listener/load/OCI/Supply Chain and current independent review.
Current causal order is
#15@5162ad5 current-range review -> Ready exact execution -> 100% owned-production coverage + CI/Supply/source-binding GREEN + independent governance -> normal #15 integration -> #106 ordinary/non-force reconciliation preserving child policy + parent ordering/coverage/termination semantics -> fresh exact evidence/review.Durable
docs/product-technical-gap-baseline.mdand deep TRACEABILITY remain dedicated #61 authority. No force push, destructive rebase, self-approval, gate weakening, predecessor GREEN transfer, protected merge, release, canary, rollback, cutover, or legacy-removal credit is allowed.