A bounded HTTP/2 hold demonstrated additional synthetic pre-delivery containment. Iteration one failed its CPU budget; iteration two did not support evidence batching. R1 continues with more precise questions about efficiency and trustworthy host evidence.
Qualifying host evidence added a synthetic containment advantage while ordinary streams continued. The tested implementation missed its cost criterion. Those findings sharpen the ongoing A+B research question: what can still be prevented, and at what cost?
Gate A evaluates response-contract evidence and classifies output. Gate B holds selected INCONCLUSIVE sensitive output and acts on qualifying evidence before client delivery. A+B remain the central response-aware direction; B is the long-term objective.
R0 / PASS established retrospective metadata detection with stock nginx, without a new filter. R1 tested a separate experimental containment mechanism.
Gate C is a potential future boundary for preventing defined host-side harm independently of nginx. It complements A+B; nginx must not become a privileged host-policy controller.
A+B may consume trusted service-level host evidence. The synthetic result supports studying that bounded design, without establishing production readiness or reliable PHP-FPM request attribution. Host enforcement must remain effective even if nginx never receives its event.
The nginx 1.31.7 source audit identified a pause after upstream headers were parsed and successfully processed, immediately before ngx_http_upstream_send_response(). A narrow patch in a disposable source copy implemented that explicit continuation.
Read complete upstream headers; distinguish upstream metadata, final output and client receipt.
Evaluate the independent status, content-type and declared-length contract, sensitivity and configured service invocation.
In the hold arms, pause further upstream reads and writes. Retain the existing 4 KiB preread buffer; add no body chain or disk spill.
Consume bounded, authenticated worker-local host state without a synchronous verdict query. The lab used nonblocking Unix datagrams, at most four messages per callback and sixteen service slots.
An explicit timer owns continuation. Existing nginx request finalization stops selected streams; cleanup cancels timers and live references.
An independent client checks decoded DATA, payload prefixes, completion and resets. Filter entry and server counters are not client receipts.
NGX_AGAIN alone does not establish a safe hold. Stock proxy buffering is not a security decision window. The experiment used an explicit upstream gate, rather than assuming either behavior.Auxiliary-filter registration was corrected after the first smoke run exposed bypassed observation callbacks. The qualifying intermediate S2-20 stops occurred before header-filter entry, and the client independently confirmed zero M bytes.
The existing upstream/request error-finalization path closed the selected HTTP/2 stream. The client observed reset code 2 / INTERNAL_ERROR, with O/U and later streams intact. No custom RST_STREAM frame or shared-connection close was used.
These were experiment-only decisions under a limited response contract. Matching metadata did not establish application safety.
| Class | Meaning | Handling |
|---|---|---|
| ALLOW | Ordinary response matches the contract. | Normal delivery; limited contract only. |
| DENY | Predefined metadata contradiction, such as expected 403 versus actual 200. | Terminate before output without host evidence in RA/S2. |
| INCONCLUSIVE | Sensitive response with matching metadata. | Use configured service state; hold for 0 or a nominal 20 ms. |
Messages carried synthetic invocation, session and sequence identifiers with HMAC authentication and sender credentials. Invalid authentication, stale, duplicate, out-of-order and unrelated updates were exercised. Unix datagrams provided no disconnect EOF or direct controller-liveness guarantee.
One TLS 1.3 / ALPN h2 connection carried four concurrent harmless 8 KiB fixtures. The origin did not read the independent client oracle; host events were simulated trusted lab input.
| Stream | Response class | Evidence purpose |
|---|---|---|
| M / S | Sensitive, fixture-designated forbidden | Count forbidden client-received bytes. |
| L / S | Legitimate sensitive, matching metadata | Count collateral containment. |
| O / S | Ordinary allowed | Check same-service continuation. |
| U / T | Ordinary allowed | Check unrelated-service isolation. |
| Arm | Evidence / action | Purpose |
|---|---|---|
| N | Stock proxy delivery | Unmodified baseline. |
| RA-0 | Response contract; no hold or host state | Metadata-only intervention. |
| RA-20 | Response contract; nominal 20 ms hold; no host state | Separate delay from host evidence. |
| C | Independent simulator revoked S output and aborted all its owned upstream sockets | Host-only action without HTTP response selection. |
| S2-0 | Response contract plus authenticated host state; no hold | Evidence already available at the gate. |
| S2-20 | Response contract plus host state; nominal 20 ms hold | Additional event-arrival window and its cost. |
C actively stopped service output; it was not just an observer. It could not retract earlier delivery. A whole-connection stop would also sacrifice unrelated streams. RA-20 plus C, application-cooperative controllers and pre-compromise confinement were not comparison arms; this is not a universal host-only architecture ranking.
Twenty functional scenarios × six arms × three repetitions produced 360 cells and 1,800 primary functional requests. Eighteen fixed cost runs added 2,160 requests. Including 60 smoke diagnostics, 48 superseded reload requests and five interrupted flow-control requests, execution totaled 4,073 / 4,096 requests.
The retained accounting bounded rate at 64 requests/s, active streams at sixteen and simultaneous holds at four. Execution phases totaled 113.621 of 600 seconds, excluding offline build/analysis time. The five interrupted requests lack complete client records and were not credited to primary outcomes; corrected cells and preserved earlier attempts remained distinct.
Functional containment — PASS, scoped. In all three qualifying intermediate S2-20 repetitions, host acceptance fell inside the hold: M and L stopped before header-filter entry, while O/U and the subsequent stream completed.
| Arm | Early | Intermediate | Late / prefix validated | After completion |
|---|---|---|---|---|
| N | 8,192 | 8,192 | 8,192 | 8,192 |
| RA-0 | 8,192 | 8,192 | 8,192 | 8,192 |
| RA-20 | 8,192 | 8,192 | 8,192 | 8,192 |
| C | 0 | 8,192 | 256 | 8,192 |
| S2-0 | 0 | 8,192 | 256 | 8,192 |
| S2-20 | 0 | 0 | 256 | 8,192 |
N, RA-0, RA-20, C and S2-0 delivered the full M fixture in the corresponding intermediate cases. RA-20 had the same hold: delay alone did not explain S2-20's zero-byte outcome.
Each S2 arm completed 156/156 primary O/U records exactly. C completed 141/156, with fifteen ordinary S disruptions in early/persistent-alert controls. Early C returned 502 bodies for M/L/O: zero M fixture bytes did not mean zero HTTP body bytes.
S2-20 stopped L in all three core intermediate cases and eighteen alert-related L records across the full repeated controls; S2-0 stopped fifteen. These are fixture counts, not real-world false-positive rates.
Capacity tests separately produced twelve 503 responses per 20 ms arm, including legitimate sensitive traffic. These were load-shedding costs, not security successes.
Validate decoded DATA bytes, exact fixture or prefix, status/type/declared length, END_STREAM and reset. Origin writes and filter counters were separate evidence; no timeout was credited as prevention.
No-alert release, invalid/stale/unrelated state, disconnect/restart, cancellation, origin abort, replacement workers, capacity and constrained flow control were exercised. O/U and later streams progressed.
Intermediate emission actually occurred 10.586–12.701 ms after release. Accepted alert delivery took 0.114–0.317 ms in this simulator; neither number measures real collector detection latency.
S2-20 used 157.019 ms of instrumented worker CPU against 128.600 ms for stock nginx across 360 cost requests per arm: +22.1%, exceeding the predeclared +10% target. Iteration one's overall acceptance result is FAIL; functional success does not qualify the mechanism for adoption.
| Arm | Ordinary TTFB p95 / p99, ms | Sensitive TTFB p95 / p99, ms | Worker CPU, ms | CPU vs N |
|---|---|---|---|---|
| N | 4.895 / 5.923 | 6.216 / 7.115 | 128.600 | baseline |
| RA-0 | 5.345 / 6.334 | 6.722 / 7.891 | 131.673 | +2.39% |
| RA-20 | 3.931 / 7.043 | 25.874 / 29.043 | 161.298 | +25.43% |
| C | 4.480 / 5.112 | 5.766 / 6.287 | 123.662 | −3.84% |
| S2-0 | 4.707 / 5.833 | 5.740 / 7.467 | 124.536 | −3.16% |
| S2-20 | 3.797 / 4.647 | 25.847 / 26.269 | 157.019 | +22.10% |
CPU sampled the owned worker's accumulated execution time, excluding startup, most shutdown and Python origin/client work. Regular-file evidence writes, gauges and filter callbacks were included. The controller was idle after its initial snapshot; active-controller CPU was not isolated. Three runs and nearest-rank percentiles do not establish production tails, general speedups or statistical equivalence.
| Gate | Predeclared target | Observed | Result |
|---|---|---|---|
| Worker CPU vs N | ≤+10% | +22.10% | FAIL |
| Ordinary TTFB delta | p95 ≤+1 ms; p99 ≤+2 ms | −1.098 / −1.276 ms | PASS |
| Hold through scheduled continuation | ≤25 ms | 20.090–21.507 ms; p99 21.244 ms; n=570 | PASS |
| Retained request allocation | ≤32 KiB | 17,544 bytes per sample; n=582 | PASS |
The 20 ms hold was a nominal deadline, not a demonstrated hard wall-clock bound. The 25 ms gate concerned hold plus scheduling, not absolute sensitive TTFB (p99 26.269 ms). Memory covered request/stream/upstream pools, including existing retained allocations; shared connection/TLS allocations and kernel buffers were outside that gauge. It was not per-stream RSS.
One bounded follow-up tested a 4 KiB evidence-record buffer. It retained the same records, gauges, response contract, nominal 20 ms hold and independent M/L/O/U oracle. Batching reduced regular-file write calls, but did not demonstrate lower S2-20 worker CPU. The candidate is not retained.
| Matched arm | Worker CPU, ms | CPU vs stock | Worker write syscalls |
|---|---|---|---|
| Stock N | 53.239 | baseline | 720 |
| Original S2-20 | 68.898 | +29.41% | 1,656 |
| Batched S2-20 | 72.088 | +35.40% | 936 |
S2-20 write syscalls fell 43.48%; CPU was 4.63% higher in the aggregate, with mixed per-repetition effects. Three short repetitions do not establish a statistical regression or production cost. They do not support the intended CPU improvement. Both prototypes still exceeded the unchanged +10% gate. All cost-pair event counts matched; observation work was retained.
Original and batched S2-20 each withheld all 8,192 M bytes in 3/3 intermediate repetitions. O/U and probes completed 105/105 primary regression records per variant. Late S2 alerts still left a validated 256-byte M prefix. Legitimate L remained collateral: three core intermediate resets, nine alert-related resets across repeated controls per variant.
Batched S2-20 retained 17,544 bytes per held request in the pool gauge and added 4 KiB of worker-global telemetry storage. Hold through scheduled continuation was 20.183–21.304 ms; capacity still produced twelve 503s per S2-20 variant, including legitimate traffic.
Timers, longer request lifetimes, pool scans, formatting and event-loop scheduling were not individually profiled. Batching added copying and flush dispatch; synchronous file writes remained. Source review also found that reaching the inherited 4,096-record cap could suppress a pending-buffer flush. The pilot did not reach that cap; this further limits the candidate.
Active simulator command CPU was measured separately: median 314.639 microseconds across 66 positive commands. This is not real collector cost or detection latency. No HPACK/G0A CPU offset or combined-stack benefit was established.
Iteration one remains an overall FAIL under its acceptance criteria; iteration two remains NO JUSTIFIED CHANGE for batching. These outcomes narrow the next questions without closing the response-aware research direction.
No real collector detection accuracy or latency was established. Service/invocation association was trusted lab configuration, not verified PHP-FPM request attribution or hostile same-UID isolation.
Ordinary-class malicious output, matching-metadata harmful content and authorized-resource misuse remain blind spots. Origin-side effects remain outside response-abort protection.
No real exploit, PHP or production target was used. HTTP/3 / QUIC was not tested. Cache, retries, compression, redirects and early hints were excluded from R1; arbitrary output paths and adverse networks remain outside its proof.
No sanitizer campaign, adversarial event flood, slow-filesystem test or instrumentation-free benchmark was run. A synthetic functional PASS does not remove these limits.
Matched RA-20/S2-20 comparisons did not identify idle local host-state checks as a dominant additional CPU cost. Active notifications, controller work and real collector costs need separate attribution; host evidence has not been shown to be free.
The prototype still allocates a request context, registers cleanup and records five evidence events for ordinary ALLOW traffic in this fixture. A narrow fast path is a concrete candidate, not an implemented or measured optimization. It must retain contract checks, metadata DENY and the required sensitive INCONCLUSIVE hold. A missing alert cannot become ALLOW.
Event/timer suspension and continuation, evidence formatting, allocation gauges, observer callbacks and request lifetime remain incompletely attributed. Fewer write calls did not solve the held-path CPU problem. No single unisolated component is the proven cause.
No actual AppArmor policy/canary enforcement experiment or real host collector ran; no end-to-end notification-latency bound was measured. A denial does not establish absence of earlier compromise or other damage. A stream reset cannot reverse a completed host operation or retract delivered bytes. This establishes neither PHP2Shell nor ransomware prevention.
| Question | Evidence needed |
|---|---|
| How much CPU belongs to ordinary observation versus hold/continuation? | Matched attribution of observation, gauges and event/timer work without changing the security timing contract. |
| Can a narrow ALLOW fast path reduce overhead? | Measured savings while preserving contract validation, metadata DENY and holds for sensitive INCONCLUSIVE output. |
| Can real host-enforcement evidence arrive soon enough? | Trusted collection and service association, with end-to-end timing measured against actual client delivery. |
| How are missing, delayed or lost events represented? | Explicit unknown/freshness state and loss accounting; silence must never certify safety. |
| How can independent host prevention coexist with less legitimate disruption? | Verify the host denial independently, then measure additional response containment and collateral loss separately. |
Any next experiment requires separate authorization and predeclared criteria. Narrower routes or shorter holds change coverage and need equivalent response-aware controls. No HPACK/G0A CPU offset, production protection or future result is assumed.
a7986bd6f1d349772172fa62130432fee74eba40; no product source, decision or integration adopted.594a44291086dcc7cef06cabec4c0b47afd674c0. BoringSSL was not rebuilt; this is matched-input provenance, not a fresh reproducible-build proof.