test: prove downstream H2 decoded-header admission

[seonghobae]

Refs #51. Writer-safe child of #79 exact c0406907aea4c2a13d76d219cfacd9c508a2a467.

This PR owns one real-wire HTTP/2 decoded-header admission acceptance. Production Rust outside inherited parent changes, Admin Config, TLS/cipher policy, routing/retry behavior, product authentication/business logic, Keyverse/Wardnet/EgressWeave authority, supplier source and deployment authority are unchanged by the child delta.

RFC 9113 defines SETTINGS_MAX_HEADER_LIST_SIZE as the peer's advisory maximum field-section size after decompression. Pingora 0.9.0 advertises a 64 KiB decoded header-list limit. The fixture requires the server SETTINGS frame to advertise 65536, then sends stream 1 with an HPACK field section whose decoded size exceeds that boundary. The field section is split across legal 16 KiB HEADERS/CONTINUATION frames so frame-size rejection cannot substitute for decoded-header admission. Acceptance requires the oversized stream to be rejected before origin contact, the rejection to remain stream-local, and a compliant stream 3 on the same connection to reach the H1 origin and complete with exact body sibling-ok without RST_STREAM or GOAWAY. Exact 431 is intentionally not claimed because this fixture does not independently HPACK-decode the rejection response.

Predecessor exact dab0db60b1d4ca8a3ba954698c7c268aa1a6cfb8 passed formatting and the complete locked all-target test workload, including decoded_header_limit_rejects_before_origin_and_preserves_connection, then failed only Rust 1.98.0 Clippy chunks-exact-to-as-chunks in the fixture SETTINGS parser. Current exact f98b359cf01e6bc46eb5f50abd1d7cf5adcd7141 preserves the six-byte divisibility assertion and iterates payload.as_chunks::<6>().0.iter(). No threshold, warning gate, protocol oracle, production Rust or authority boundary was weakened.

Exact-current CI 34578894666, Supply Chain 34578894727, and PgErd bounded-origin capacity 34578894702 are all terminal GREEN. Formatting, compile/test, Clippy, rustdoc, owned-production coverage, load-contract, OCI runtime and supply-chain/capacity evidence completed successfully. Fresh review-thread enumeration is empty. This PR is Ready for independent governance.

Technical COMMENT reviews are evidence only, not independent APPROVED governance credit. No protected merge/release/cutover credit is claimed. This remains narrower than request-body admission, connection/stream flow control and backpressure, partial-body cancellation semantics, origin failure/recovery, forwarding trust, release-qualified H2→H1 Cookie/body framing, representative handshake/reuse and NUMA performance, HTTP/3/QUIC, immutable release, shadow/canary, rollback, cutover and legacy removal.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ae90541e-5f4d-4a54-8a22-8e1bdf7a0bfb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head technical review after non-force restack over current #79. Parent→child compare has merge base exactly 5232c94d..., is ahead-only, and the effective delta is only tests/downstream_tls_h2_header_admission_wire.rs. The fixture advertises/observes the 64 KiB decoded header-list bound, fragments the oversized HPACK block into legal 16 KiB HEADERS/CONTINUATION frames, requires pre-origin stream-local rejection, and then proves connection survival with a compliant stream 3. Exact HTTP status 431 is intentionally not claimed because this fixture does not independently HPACK-decode the rejection response. No additional writer-safe defect was identified in this pass; current exact gates remain authority. This COMMENT is review evidence, not approval.

[seonghobae]

Exact-head technical review after ordinary restack over #79 8348cacf.... The restack adopts only the parent GOAWAY-fixture receipt-bound repair; parent→child intent remains the decoded-header admission fixture only. Current #80 still requires the 65,536 decoded field-section SETTINGS bound, uses legal multi-frame HPACK input so frame-size rejection cannot substitute, rejects the oversized stream before origin contact, and proves connection survival with a compliant sibling stream. Exact 431 remains deliberately unclaimed because the fixture does not independently decode the rejection response. No additional writer-safe defect was identified in this pass. This COMMENT is evidence only, not approval; exact-current gates remain authority.

[seonghobae]

Exact-head technical review after formatter RCA and ordinary restack (not an approval). Predecessor 6de8fa76... failed CI only at Rust 1.98.0 formatting; its log showed the inherited #79 GOAWAY file required the same four formatter changes and this child file required four layout-only changes. 1ee8832b... applies exactly the child formatter output. Current merge exact 6384c6b7... then adopts #79 8b054eef... as a second parent without force/rebase. Fresh compare has merge base exactly 8b054eef..., behind 0, and the effective parent→child delta remains only tests/downstream_tls_h2_header_admission_wire.rs. Production Rust and decoded-header acceptance semantics are unchanged. Fresh exact-current gates remain authority.

[seonghobae]

Current-head technical review for b989145fc2a4967468467c0226b38c9ced278e27: parent movement from #79 fa064688... is adopted by ordinary two-parent merge, not force/rebase. Fresh parent→child compare is behind 0 with merge base exactly #79 current, and the effective child delta remains only tests/downstream_tls_h2_header_admission_wire.rs. The decoded-header oracle still separates legal frame sizing from decompressed header-list admission and preserves same-connection sibling recovery; no exact-431 claim is introduced. No new source finding in this reviewed delta. COMMENT only, not independent approval; keep Draft until exact-current gates are terminal.

[seonghobae]

Exact-current technical review after parent repair: #79 current c040690 is the merge base, this branch is behind 0/ahead-only, and the effective parent→child delta remains only tests/downstream_tls_h2_header_admission_wire.rs. The inherited formatting RED is therefore repaired without contaminating decoded-header ownership. Fresh exact gates are queued; this COMMENT is evidence only and does not supply independent approval.

[seonghobae]

Exact-current technical review for f98b359cf01e6bc46eb5f50abd1d7cf5adcd7141 (evidence only, not approval). Predecessor CI 34574052181 completed formatting and the full locked all-target test workload; the decoded-header real-wire acceptance itself passed. The sole RED was Rust 1.98.0 Clippy chunks-exact-to-as-chunks at the fixture SETTINGS parser. Current exact preserves the existing six-byte divisibility invariant and replaces only chunks_exact(6) with the compiler-recommended as_chunks::<6>().0.iter(). No production Rust, HTTP/2 oracle, warning gate, threshold, or authority boundary changed. Fresh exact-current CI/Supply Chain/capacity receipts remain promotion authority.