test: characterize H2 origin reset recovery

[seonghobae]

Refs #51.

Ready-for-review writer-safe child of #85 exact 33f2a96c20c2b5de8e704cb5788f63479c9ae808. This increment targets the next causal transport gap only: distinguishing fresh-upstream failure before downstream response commitment from failure after downstream commitment on a verified TLS/H2 connection, without adding gateway-local retry/failover policy.

The pre-commit case opens a real H1 origin connection, receives the complete forwarded GET, then injects Linux SO_LINGER(0) RST before any origin response bytes. The H2 client requires a complete HTTP-level failure on the affected stream without connection GOAWAY or pre-response stream reset, then proves a compliant sibling GET reaches a fresh H1 origin and completes as sibling-ok on the same H2 connection. The origin’s next-accept target check also fails closed if the fresh failed request is replayed before that sibling.

The post-commit case writes HTTP/1.1 200 OK with Content-Length: 20 and body prefix partial, waits until the H2 client has actually observed the committed response header/body prefix, and only then injects RST. Acceptance forbids a second response HEADERS block or clean END_STREAM for the truncated response, requires stream-local error termination, proves no replay reaches the origin before the sibling, and then proves the sibling still completes on the same H2 connection.

Exact pre-commit HTTP status is not invented by this fixture. Current production behavior is independently constrained by the existing real-listener H1 reset acceptance (pg_erd_upstream_reset_traffic.rs, exact 502) and released Pingora 0.9.0 default fail_to_proxy mapping of upstream errors to 502. GatewayProxy does not override fail_to_connect, error_while_proxy, or fail_to_proxy; this PR does not add any retry count or failover rule. The raw-H2 fixture owns transport parity, commitment, replay prevention, stream locality, and same-connection recovery rather than claiming an HPACK-decoded status it does not decode.

Initial exact d9a08c4d4e0122d6f4a42378fc3affef56b262a9 failed before compile/test only at Rust 1.98.0 cargo fmt --all -- --check. Job 103251962248 in CI run 34596060703 required formatting only; no production or traffic semantic failure had executed. Current exact 258c2cf7d1e20d01221158394a99f7bbfe47ee69 applies exactly that hosted rustfmt output and changes the same fixture only.

Current exact 258c2cf7d1e20d01221158394a99f7bbfe47ee69 is terminal GREEN: CI 34596282546, Supply Chain 34596282585, and PgErd bounded-origin capacity 34596282560 all succeeded. CI passed formatting, compile/test including both new real-wire origin reset cases, Clippy, rustdoc, complete owned-production coverage, resolved dependency-lock verification, load-contract traffic, and least-privilege OCI runtime. Supply Chain completed dependency audit, candidate builds, SPDX SBOM generation, image scans, exact-source binding, and evidence upload. Fresh review-thread enumeration is empty.

Effective child scope remains one new real-wire fixture, tests/downstream_tls_h2_origin_failure_recovery_wire.rs. Production Rust, Admin Config, TLS policy, routing/business authority, Keyverse/Wardnet/EgressWeave boundaries, supplier source, gate thresholds, and deployment authority are unchanged. docs/product-technical-gap-baseline.md remains owned by dedicated lane #61 and is not touched here.

This PR is Ready for independent governance review. No predecessor receipt, protected merge, release, canary, cutover, or legacy-removal credit is claimed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 535a2790-7905-46ae-9608-33cdd3b51421

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current technical review for 258c2cf7d1e20d01221158394a99f7bbfe47ee69: re-read the one-file child range after hosted execution. The pre-commit case injects a real Linux RST only after the fresh H1 origin received the forwarded GET, requires an HTTP-level stream-local failure without GOAWAY or replay, then proves a compliant sibling succeeds on the same H2 connection. The post-commit case releases the RST only after downstream response commitment is observed, forbids a second response or clean END_STREAM for the truncated body, requires stream-local error termination, prevents replay, and again proves sibling recovery. The fixture deliberately does not invent an HPACK-decoded status or gateway-local retry/failover rule; current 502 status authority remains the existing H1 real-wire acceptance plus released Pingora default error mapping. Initial d9a08c4... failed only Rust 1.98 formatting before compile/test; current exact applies that formatter output. CI 34596282546, Supply Chain 34596282585, and PgErd capacity 34596282560 are all terminal success; formatting, both new real-wire tests, Clippy, rustdoc, complete owned-production coverage, load/runtime, dependency/SBOM/image scans, and capacity evidence are GREEN. Fresh review-thread enumeration is empty. No production Rust, policy threshold, foreign authority, supplier source, or deployment authority changes. No additional writer-safe defect is present in this exact-current range. This COMMENT is technical evidence only and is not independent APPROVED governance credit.