The request was known.
nginx could identify its HTTP/2 stream and upstream transaction. The unresolved join was from that transport to the actual executing task and its native operation.
historical experiment archive / R4 / 3–5 November 2026
Who owns the request?
The join remained open.
R4 examined whether an nginx upstream transaction could be bound to backend execution and a native security event. Prepared tooling and local ownership controls exposed gaps; they did not establish a trustworthy request-scoped enforcement context.
ARCHIVE / NOT AN ACTIVE RUNBOOK
R4.1: partial socket/process observations.
R4.2: request-owned execution group INCONCLUSIVE.
No live C0 ownership proof, PHP2Shell differential or request-selective response result.
R4.1: partial socket/process observations.
R4.2: request-owned execution group INCONCLUSIVE.
No live C0 ownership proof, PHP2Shell differential or request-selective response result.
socket identity ≠ causal request ownershiphistorical findings / no production adoption
01 / MOTIVATION
The event was genuine.
Which request caused it?
R3.1 delivered a real kernel denial to a service-level response gate. Both concurrent streams were reset, including the innocent one. R4 investigated the missing request-to-execution binding.
Artifacts were not live proof.
An isolated nginx/PHP-CGI fixture, provenance records and offline tooling were prepared. C0 remediation recorded 56 passing offline tests. No live C0 ownership result or production PHP-CGI execution model was established.
A comparison was prepared.
A PHP 8.4.26/8.4.27 comparison harness recorded 24 passing offline tests. Those tests did not reproduce exploitation or establish a native PHP2Shell differential or post-compromise containment.
02 / LOCAL CONTROLS
A connected socket.
Several possible owners.
R4.1 and R4.2 ran bounded, unprivileged Unix-socket/process controls. They did not run nginx, PHP, an LSM policy or a response gate.
Restricted candidates existed.
Distinct fixture workers had distinct connected sockets and process generations. Wrong-process, exit and replacement controls were rejected. This depended on the fixture's behavior and did not certify hostile-backend exclusivity.
Credentials could name the wrong task.
In a forked-listener case, peer credentials named the listening parent while the accepted connection was held by its child. Listener identity was insufficient to select the executor.
Possession could move or multiply.
Parent and child could hold the same connected descriptor. A transferred descriptor reached another holder while original peer credentials persisted. Retrospective FD scans were non-atomic, and one transfer-case scan was incomplete.
No request-owned execution group.
A shared group could not select one request. Separate per-request cgroups were not tested, and actual group IDs were not independently obtained. A namespace inode was not a cgroup identity. No real denial event was joined to an nginx stream.
03 / EVIDENCE LIMIT
Local identity is evidence.
Causality still needs proof.
Neither socket possession, a shared process identity nor backend-supplied metadata established an attacker-resistant causal binding. The existing evidence does not prove a general impossibility theorem for every execution model.
Historical conclusion: request-selective containment was not demonstrated. R4 is archived; its prepared architecture is not adopted and its dated proposed experiments are not an active execution plan.
What performed the operation
is not necessarily why it happened.R2³ later demonstrated native denial and link-loss fail-open. It did not resolve R4's request-ownership gap.
is not necessarily why it happened.R2³ later demonstrated native denial and link-loss fail-open. It did not resolve R4's request-ownership gap.
04 / RELATED RECORDS
Keep the findings.
Keep their scope.
R1–R4 preserve separate experiments and outcomes. No archive page authorizes another experiment or establishes deployable protection.
RAES / Current goalRequest-scoped enforcement at the nginx-to-backend boundary remains a research question.↗
R3.1 / MotivationOne genuine denial reset both streams under shared-process concurrency.↗
R2³ / Later resultSelective native denial after loader exit; observed fail-open after link loss. Overall INCONCLUSIVE / result 3.↗