An isolated 138-request experiment found that unmodified nginx can identify predefined response-contract contradictions with existing maps and access-log metadata. The result is retrospective detection — not evidence of application safety or pre-delivery containment.
The previous read-only source audit concluded that stock nginx should be sufficient for R0. The synthetic A/B validation supported that conclusion for its predefined status and declared-size contracts.
Six of six status contradictions and three of three declared-size contradictions were detected in the B arm. The remaining 60 of 60 B records were silent, including all required legitimate controls and deliberately incomplete streaming outcomes.
Content-type classification was present, but a type-only positive contradiction was not injected. This experiment does not establish body-only detection.
All 69 paired A/B client comparisons matched selected response headers, exact in-memory payload and completion outcome. The Date header was excluded and redirect target paths normalized for the two lab listeners.
Every B log record reconciled with its expected request. These are bounded synthetic correctness results, not a general proof of zero runtime overhead.
map classification and log-phase metadata were sufficient for these R0 fixtures. The result does not establish inline detection, response replacement, exploitation detection, protection against origin side effects, or behavior under HTTP/2 and HTTP/3.The experiment ran on loopback using an owned synthetic origin, a verified, unmodified nginx binary and a controlled HTTP/1.1 client over TLS 1.3. No nxTLS experiment or production configuration was changed.
Ordinary stock proxy response handling. Access logging disabled for the experiment. No filters, body scanning, compression or interception; response buffering disabled on the main fixtures.
The same executable and response configuration with built-in nginx map variables and one allowlisted JSON metadata access log. No custom module, Lua code or response modification.
A reviewed static oracle keyed by method, route and listener-bound synthetic authorization context; neither request headers nor origin responses could rewrite expectations.
23 cases, three repetitions, alternating A/B then B/A then A/B. One outstanding request; fresh nginx, origin and cache per arm and repetition.
TLS certificate and hostname checked. HTTP framing and decoded payload validated in memory, independently of TLS reads, chunks and nginx output counters.
Main fixtures used disabled proxy response buffering, compression, retries and error interception in both arms. The cache control enabled identical stock proxy buffering/cache. Normal nginx/TLS working buffers still existed.
Every case below passed in A and B in all three repetitions. “Silent” describes the expected metadata-classifier result, not proof that the origin was safe or the client received a complete response.
| Case | Synthetic response / control | B classification | Client outcome |
|---|---|---|---|
| normal | Expected normal 200 | silent | complete |
| invalid-match | Invalid route with expected 404 | silent | complete |
| invalid-injected | Invalid route returns unexpected 200 | status flagged | complete |
| restricted-denied | Denied context with expected 403 | silent | complete |
| restricted-injected | Denied context returns unexpected 200 | status flagged | complete |
| restricted-allowed | Allowed context legitimately returns 200 | silent | complete |
| error-match | Expected bounded 500 response | silent | complete |
| error-injected | 500 with accurate declared length of 32,768 bytes | size flagged | complete |
| stream-complete | All three controlled portions arrive | silent | complete |
| stream-delay | Controlled 50-ms delays between gated portions | silent | complete |
| stream-truncate | Origin stops after validated 512-byte prefix | silent | truncated |
| stream-cancel | Controlled client closes after 256-byte prefix | silent | cancelled |
| unusual | Legitimate unusual-route 200 | silent | complete |
| redirect | Expected 302, not followed | silent | complete |
| head | HEAD with declared length, no payload | silent | complete |
| no-content | Legitimate 204 without payload | silent | complete |
| not-modified | Legitimate 304 without payload | silent | complete |
| partial | Valid 206 with Content-Range | silent | complete |
| proxy | Ordinary proxied response | silent | complete |
| cache-miss | MISS populates bounded synthetic cache | silent | complete |
| cache-hit | HIT avoids a new origin request | silent | complete |
| internal-redirect | Upstream 404 → final 200 via X-Accel-Redirect | silent | complete |
| side-effect | Origin increments in-memory counter, normal 200 | silent | complete |
B logged 69/69 expected records. Six status flags and three declared-size flags were raised; 60 records remained unflagged. Cache was MISS then HIT in all six arm runs. The internal redirect consistently preserved the distinction between upstream 404 and final 200. No required control was left uncovered.
The most useful R0 findings may be its deliberate blind spots. They establish what response metadata cannot responsibly be made to say.
In all three B runs of stream-truncate, nginx logged 200 and request_completion=OK. The controlled client independently validated a 512-byte prefix but detected incomplete chunked framing.
This is not evidence of an nginx defect: its request-completion state does not promise a complete, client-validated HTTP response.
The synthetic origin incremented a private in-memory counter before sending the same normal 200 response. The harness verified the counter separately. The B observer correctly raised no response-contract flag.
Matching status, type and size do not exclude application side effects, compromise or state carried between requests.
request_completion do not prove origin safety, a server-side commit point or client receipt.The functional comparison was bounded. Coarse process and time buckets are sufficient for initial diagnostics, not for microbenchmark conclusions or production sizing.
| Measurement | Arm A / Stock | Arm B / Maps + log | Interpretation |
|---|---|---|---|
| Request-to-TTFB | 69 samples: 10–99 ms | 69 samples: 10–99 ms | Same coarse buckets; no precise latency equality |
| Outcome endpoint | 66: 10–99 ms; 3 delayed: 100–999 ms | Same bucket counts | Truncated and cancelled endpoints are not success |
| nginx CPU | 10–99 ms / 23-request arm | 10–99 ms / 23-request arm | Coarse kernel ticks; no resolved delta |
| Sampled max RSS | Below 8 MiB in all runs | 8–15 MiB in all runs | Observed difference, not isolated allocation cost |
| Response semantics | Reference | 69/69 comparisons matched | No differences in compared client outcomes |
Largest retained event record: 359 bytes against a 512-byte limit. Total retained evidence stayed below 1 MiB. Records contain allowlisted classes, timing/size buckets and validation states — no response bodies, captured raw headers, credentials, queries, addresses or stable client IDs.
Every B record declares phase=log and server_commit_point=unknown. Declared Content-Length, nginx output counters and client-validated length remain separate quantities. An upstream header time is not client TTFB.
The validated first-payload milestone was a read-unit prefix of up to 256 bytes, not necessarily the first individual payload byte. Timing began after the TLS handshake. A fixed 150-ms log-settling wait was outside client timing.
The semantic oracle can be reused as a hypothesis in later protocols. The transport mechanisms, response commitment and costs require their own evidence.
Per-stream correlation, END_STREAM and RST_STREAM, output-frame accounting, HPACK, flow control, GOAWAY and neighboring-stream fairness remain unvalidated.
QUIC buffers and retransmission, stream FIN/reset, QPACK, flow control, packet loss and actual client prefix receipt need independent study.
No early detection, clean replacement, stream abort, response buffering strategy, challenge or daemon intervention was implemented or measured.
The research stops here for R0. A future experiment would require its own scope and authorization. An observed absence of a need for new code is a valid endpoint, not a mandate to invent the next mechanism.
The result comes from a separately authorized, isolated R0 lab. Local evidence and earlier inconclusive setup attempts were preserved without mixing them into the primary 138-request result.
a7986bd6f1d349772172fa62130432fee74eba40 (main, clean before and after)594a44291086dcc7cef06cabec4c0b47afd674c089ea8a3dc171511f7325043b50e4c036248d9fad5feb7ec809c0b82d5df42c65f2342202b88270a85742690faf8f6e7fda27f5b4e7ca251da6096d5ff8b7292a; corroborates the existing baseline receipt, not a new reproducible-build proof/tmp/response-aware-edge-security-r0/ with oracle.json, nginx.conf.in, r0.py, README.txt, REPORT.txt and retained runtime evidence. These artifacts are not served by this public page.The lab used unprivileged IPv4 loopback endpoints, ephemeral TLS test certificates and synthetic content only. Processes were cleaned up; nxTLS source/decisions, BoringSSL, website and private nginx configuration were not modified by the experiment. Source pin verification is distinct from a public source release or independently repeated result.