WEB / WEB-09.S02

Authority, forwarded trust, and parser agreement

Separate public target, provenance, and message completeness; follow what an ordinary version projection retains.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Approved preview

Typed facts ready
POST books.example/preview?lang=en and reference Tea content are supplied. Approved-edge, protected-hop and reconstruction facts are not yet policy outcomes; expected and observed lengths are both three octets. This local evaluation receives no actual request.
Public target
POST books.example; Tea
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Public-target decision
Evaluate configured books.example mapping; public-target admission establishes no user or proxy identity.
Public target
Authority approved
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Provenance decision
Evaluate approved peer, protected hop, and reconstruction together; external context never replaces direct-target facts.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Boundary pending
Dispatch record
No dispatch
Completeness boundary
Check the known-length typed record before admission; rejection constructs no new message or network dispatch.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Complete; 3 octets
Dispatch record
No dispatch
Semantic projection
An accepted ordinary record retains method, approved authority, path/query, and Tea bytes; projection is not an actual HTTP parser.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Complete; 3 octets
Dispatch record
Descriptor ready; Tea; CL3
Final local record
Approved authority, accepted context and a complete boundary yield ACCEPT/dispatchCount=1. The three-octet Tea descriptor is selected locally; the count proves neither actual HTTP transmission, parser agreement nor user permission.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Complete; 3 octets
Dispatch record
ACCEPT; dispatchCount=1

External ignored

Typed facts ready
The public POST target is books.example with expected=observed=3 for Tea. peerClass external requires a separate forwarded-context decision. Public-target admission has not been calculated and no network dispatch exists.
Public target
POST books.example; Tea
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Public-target decision
Evaluate configured books.example mapping; public-target admission establishes no user or proxy identity.
Public target
Authority approved
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Provenance decision
Evaluate approved peer, protected hop, and reconstruction together; external context never replaces direct-target facts.
Public target
Authority approved
Context provenance
External ignored
Boundary gate
Boundary pending
Dispatch record
No dispatch
Completeness boundary
Check the known-length typed record before admission; rejection constructs no new message or network dispatch.
Public target
Authority approved
Context provenance
External ignored
Boundary gate
Complete; 3 octets
Dispatch record
No dispatch
Semantic projection
An accepted ordinary record retains method, approved authority, path/query, and Tea bytes; projection is not an actual HTTP parser.
Public target
Authority approved
Context provenance
External ignored
Boundary gate
Complete; 3 octets
Dispatch record
Descriptor ready; Tea; CL3
Final local record
Public authority and boundary pass: ACCEPT/dispatchCount=1, while external context remains ignored. Request admission and context provenance differ. Selecting a descriptor is neither actual HTTP transmission nor protected-resource permission.
Public target
Authority approved
Context provenance
External ignored
Boundary gate
Complete; 3 octets
Dispatch record
ACCEPT; dispatchCount=1

Authority denied

Typed facts ready
Typed POST facts select archive.example while the approved public mapping is books.example. Reference Tea content cannot repair that authority mismatch. Local admission is pending; context and boundary have no acceptance outcome.
Public target
POST archive.example; Tea
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Public-target decision
Evaluate configured books.example mapping; public-target admission establishes no user or proxy identity.
Public target
Authority denied
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Provenance decision
Because the public target was denied first, the provenance gate is not evaluated; not-evaluated differs from ignored context.
Public target
Authority denied
Context provenance
Context not evaluated
Boundary gate
Boundary pending
Dispatch record
No dispatch
Completeness boundary
Boundary evaluation is skipped for the denied target; no descriptor or dispatch record becomes accepted.
Public target
Authority denied
Context provenance
Context not evaluated
Boundary gate
Not evaluated
Dispatch record
No dispatch
Semantic projection
An accepted ordinary record retains method, approved authority, path/query, and Tea bytes; projection is not an actual HTTP parser.
Public target
Authority denied
Context provenance
Context not evaluated
Boundary gate
Not evaluated
Dispatch record
Descriptor null
Final local record
Authority mapping fails: REJECT/dispatchCount=0 and no descriptor. Later context and boundary evaluations are skipped. This reason differs from incomplete-content rejection; no network outcome exists beyond the local gate.
Public target
Authority denied
Context provenance
Context not evaluated
Boundary gate
Not evaluated
Dispatch record
REJECT; dispatchCount=0

Incomplete record

Typed facts ready
Typed facts supply books.example and approved-edge, but expected=3, observed=2 and complete=false. A three-byte reference Tea body is not evidence that three bytes were observed. The local gate has not selected a dispatch.
Public target
Reference Tea; expected3 / observed2
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Public-target decision
Evaluate configured books.example mapping; public-target admission establishes no user or proxy identity.
Public target
Authority approved
Context provenance
Context pending
Boundary gate
Boundary pending
Dispatch record
No dispatch
Provenance decision
Evaluate approved peer, protected hop, and reconstruction together; external context never replaces direct-target facts.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Boundary pending
Dispatch record
No dispatch
Completeness boundary
Check the known-length typed record before admission; rejection constructs no new message or network dispatch.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Incomplete; reject
Dispatch record
No dispatch
Semantic projection
An accepted ordinary record retains method, approved authority, path/query, and Tea bytes; projection is not an actual HTTP parser.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Incomplete; reject
Dispatch record
Descriptor null
Final local record
Authority and context pass, but observed 2/expected 3 leaves the boundary incomplete: REJECT/dispatchCount=0 and no descriptor. A trusted peer cannot supply missing content. Local rejection does not establish execution of an actual parser.
Public target
Authority approved
Context provenance
Context accepted
Boundary gate
Incomplete; reject
Dispatch record
REJECT; dispatchCount=0

ACTORS · STATE · DATA FLOW

Authority is routing information

Atlas accepts books.example for its public preview service. Host and :authority carry target host/port information; they are neither an authenticated user nor a trusted proxy identity. A TCP peer address, TLS reference identity, public target, and application route are different observations. This lesson records agreement with an approved public-target mapping separately.

The fixture has a fixed routeId=catalog-preview. It contains no free resolver that turns a target string into an internal destination URL. Its preview contains only public Tea text. Accepting an authority grants neither access to a personal record nor permission for another business action.

Who wrote the forwarded context?

A parseable field can have an untrusted source. Forwarded may have been changed by the client or intermediaries, and a trusted proxy list does not authenticate an earlier untrusted prefix. Atlas therefore requires an approved immediate peer, protected hop, and approved reconstruction before accepting that context.

The external-context branch needs no claimed IP value. Its external provenance alone leaves the context ignored. The separately approved direct-target facts can still admit the public preview. Ignoring a context and rejecting an entire request are different decisions.

A message boundary is not a content value

Tea occupies three UTF-8 octets. The ordinary example uses known-length framing, whose boundary determines which octets belong to one message. HTTP/1.1 body-length rules cannot be reduced to a method name or the application’s ability to read JSON. RFC 9112 §6.3 defines precedence and incomplete-message rules; this lesson does not reimplement that grammar.

The incomplete artifact is supplied metadata rather than raw HTTP: expected=3, observed=2, complete=false. The guard stops without producing a dispatch. It never drives competing parser interpretations, appends another request, or reproduces desynchronization. The boundary is taught by identifying the decision that incomplete evidence cannot justify.

What does HTTP version conversion preserve?

The selected normal projection moves from an HTTP/2 semantic record to an HTTP/1.1 descriptor. It retains method, approved public authority, path/query, and content octets. HTTP/2 supplies stream/frame boundaries; where a content-bearing message includes content-length, it must agree with DATA content length. Prohibited connection-specific fields cannot be copied into an HTTP/2 message.

This conversion runs no HPACK, DATA-frame, or HTTP/1.1 parser. Its ordinary descriptor retains Content-Length=3 and one Tea body, with distinct inbound and outbound boundaries. Using HTTP/2 on one hop does not establish HTTP/2 on the next. Version choice, message interpretation, and application authorization remain separate responsibilities.

Why is parser agreement a chain property?

It is tempting to assume the application sees the same message an edge accepted. Across ownership changes, target, field interpretation, and content-boundary contracts must be preserved. Desynchronization concerns layers choosing different message boundaries for a stream or translation. This lesson explains the risk through a defensive invariant.

The accepted fixture has one descriptor and one dispatch record. Authority-denied and incomplete branches retain a null descriptor and dispatchCount=0. The profile does not reinterpret content following a failure as a new work item. This local gate makes the designed admission boundary explicit without certifying parser agreement in a real proxy chain.

Record observation separately from policy

The artifact records provenance category, contextAccepted, boundaryComplete, and dispatchCount instead of raw context. Public-target validation and forwarded-context validation have distinct outcomes. Missing input yields not-computed rather than clean traffic or a security pass. An unknown conversion profile produces no dispatch.

The animation’s four owners are responsibilities inside one local policy evaluation. No network packet moves between them; BEGIN advances a completed local decision. This does not erase a real proxy’s network roles. Read with the previous hop lesson, it distinguishes where a metadata decision occurs from where a message travels.

Read every scenario without motion

External context

The public target was separated from external peer class
The external case has POST /preview?lang=en with authority books.example. peerClass is external; protectedHop and reconstructed are false. Tea is three bytes. A valid public target can coexist with unaccepted forwarded provenance.
Typed request facts
Public books.example / external context
Admission gate
Gate pending
Dispatch boundary
No descriptor
Target and context gates gave separate outcomes
This public-preview profile accepts direct validated facts while contextAccepted stays false. Client metadata has not become trusted. Routing acceptance also grants neither a user session nor tenant authority.
Typed request facts
Public books.example / external context
Admission gate
Public admission ACCEPT / contextAccepted=false
Dispatch boundary
No descriptor
Local dispatch count was not an actual network count
Expected dispatchCount 1 belongs to the local admission record. wireBytesIncluded is false and no real network dispatch runs. Request admission and use of forwarded context remain distinct policy outcomes.
Typed request facts
Public books.example / external context
Admission gate
Public admission ACCEPT / contextAccepted=false
Dispatch boundary
Local record count1 / no network dispatch
The approved-peer branch provided a positive comparison
Normal peerClass approved-edge has protectedHop and reconstructed true. Context is accepted and public admission remains ACCEPT. Equal admission results must not hide differing provenance decisions.
Typed request facts
Normal ACCEPT / contextAccepted=true
Admission gate
Public admission ACCEPT / contextAccepted=false
Dispatch boundary
Local record count1 / no network dispatch
Authority mapping did not generate arbitrary internal destinations
ApprovedAuthority books.example and fixedRouteId catalog-preview are configuration responsibilities. Incoming context does not generate guessed internal destinations. This fixed public mapping is not a resource-authorization engine.
Typed request facts
Normal ACCEPT / contextAccepted=true
Admission gate
Fixed public mapping / no guessed target
Dispatch boundary
Local record count1 / no network dispatch
Public acceptance was not promoted to protected authority
A public preview can be accepted while external context is ignored. Generalizing that outcome to user, tenant or sensitive-action policy is incorrect. Context source and tested resource scope must be stated together.
Typed request facts
Normal ACCEPT / contextAccepted=true
Admission gate
Fixed public mapping / no guessed target
Dispatch boundary
Public admission only / protected authz separate

Incomplete body

Declared and observed octets retained separate fields
Incomplete facts report expectedOctets 3, observedOctets 2 and complete false. bodyHex 546561 shows reference content, not receipt of all three observed bytes. Completeness fields must be read separately.
Typed request facts
Expected3 / observed2 / complete=false
Admission gate
Gate pending
Dispatch boundary
No descriptor
Trusted context did not repair incomplete boundaries
Authority can be approved and contextAccepted true, yet complete false yields REJECT for boundary-incomplete. One successful gate does not remove another required predicate. dispatchCount stays 0.
Typed request facts
Expected3 / observed2 / complete=false
Admission gate
Context true / completeness false / REJECT
Dispatch boundary
No descriptor
Rejection produced no descriptor
Stopped admission selects no conversion descriptor or local dispatch. This typed record does not measure how an actual HTTP parser processes bytes. Boundary failure is not renamed as user-authorization failure.
Typed request facts
Expected3 / observed2 / complete=false
Admission gate
Context true / completeness false / REJECT
Dispatch boundary
No descriptor / dispatchCount0
Authority failure retained a separate negative case
The authority-denied case has archive.example while ordinary three-byte content is complete. Its reason is authority-not-approved. Equal REJECT outcomes correspond to different owners and corrective needs.
Typed request facts
Complete body / archive.example not approved
Admission gate
Context true / completeness false / REJECT
Dispatch boundary
No descriptor / dispatchCount0
The version-profile name did not replace boundary proof
The h2-to-h1-known-length label alone does not prove conversion correctness. Inbound completeness, preserved Tea octets and an outbound semantic descriptor are separate evidence. Unknown profiles or missing facts are not guessed into acceptance.
Typed request facts
Complete body / archive.example not approved
Admission gate
Profile label insufficient / typed boundaries required
Dispatch boundary
No descriptor / dispatchCount0
Gate results were not protocol-implementation claims
The model operates on typed policy facts without general HTTP parsing, TLS-peer verification or actual forwarding. Keeping completeness and authority rejection reasons distinct prevents claims about checks that were not performed.
Typed request facts
Complete body / archive.example not approved
Admission gate
Profile label insufficient / typed boundaries required
Dispatch boundary
Typed gate known / parser-network unmeasured

ASSUMPTION · BOUNDARY · CONTROL

Review which information is authoritative

Seeing books.example and https in a request summary does not establish approval. Which fact is directly observed, reconstructed by an accepted peer, or externally claimed? Atlas answers the target and provenance questions separately through authorityApproved and contextAccepted. Deriving one from the other misrepresents a routing decision as provenance validation.

Study the branch that ignores external context while admitting the public preview. It does not trust every header: validated direct facts suffice for this bounded public route. Extending the same admission to tenant ownership or a user session would be wrong. Record a review result with its resource and decision scope.

Look for boundary evidence beyond the version name

An h2-to-h1 monitoring label does not prove a correct conversion. Inbound completeness, an outbound known-length descriptor, and preserved content are distinct observations. The incomplete branch keeps its approved authority; its failure belongs to another owner. Combining every denial into a generic network error loses that distinction.

The review needs neither malformed request bytes nor a live parser discrepancy. A supplied contradictory completeness record can show admission before dispatch. The actual native Buffer check preserves Tea octets without measuring a parser’s treatment of normal or abnormal wire input. Keeping that distinction in the evidence avoids crediting an unperformed check.

Read every scenario without motion

Descriptor review

Ordinary content was marked with reference bytes
A typed admission function produces the observation; facts are inputs and expected contains decision examples. Descriptor comparison examines local byte conversion. Authority-denied skips context/completeness; incomplete accepts context but has no dispatch. This ledger contains neither real proxy logs nor wire receipts. Tea has UTF-8 hex 546561 and length 3. Normal facts select POST, books.example and /preview?lang=en. Descriptor comparison must retain method, authority, path/query and content length together.
Admission observations
POST / books.example / preview / Tea3
Descriptor comparison
Gate pending
Evidence verdict
No descriptor
Approved-context predicates were tied to their source
Approved edge, protected hop and reconstruction true produce contextAccepted true. These typed provenance facts are not certificate or actual immediate-peer verification. Normal public-target mapping remains independent.
Admission observations
POST / books.example / preview / Tea3
Descriptor comparison
Approved typed provenance / context true
Evidence verdict
No descriptor
Negative cases showed descriptor absence separately
Authority-denied and incomplete have dispatchCount 0 with different reasons. External has dispatchCount 1 but context false. One success boolean cannot correctly explain all four mechanisms.
Admission observations
Authority/incomplete count0 / external context false
Descriptor comparison
Approved typed provenance / context true
Evidence verdict
No descriptor
Byte conversion was not an actual-parser claim
Native Buffer can inspect Tea bytes and URL components. This actual local API use supports the semantic descriptor, not complete H2/H1 parser agreement or network forwarding.
Admission observations
Authority/incomplete count0 / external context false
Descriptor comparison
Local bytes/components / no protocol parser evidence
Evidence verdict
No descriptor
Normal results were separated from actual dispatch
The local ACCEPT record is an admission decision for the configured route, without actual HTTP dispatch. Review states the public-resource and supplied-policy scope without adding user-authorization results.
Admission observations
Authority/incomplete count0 / external context false
Descriptor comparison
Local bytes/components / no protocol parser evidence
Evidence verdict
Local record accepted / network dispatch unmeasured
Regression was tied to semantic invariants
Regression rechecks method, authority, path/query, preserved bodyHex and selected length. Rejection reasons and contextIgnored/contextAbsent remain distinct. Secrets or a full forwarded chain are unnecessary for these invariants.
Admission observations
Authority/incomplete count0 / external context false
Descriptor comparison
Local bytes/components / no protocol parser evidence
Evidence verdict
Recheck semantic fields and bounded outcome reasons

Missing facts

Missing input was not treated as a malformed message
A typed admission function produces the observation; facts are inputs and expected contains decision examples. Descriptor comparison examines local byte conversion. Authority-denied skips context/completeness; incomplete accepts context but has no dispatch. This ledger contains neither real proxy logs nor wire receipts. missingEvidence input is null without a known cause or wire content. Null typed input is not an actual malformed HTTP packet. Review retains absence of required facts as a separate source-coverage issue.
Admission observations
Typed input null / wire unknown
Descriptor comparison
Gate pending
Evidence verdict
No descriptor
Admission remained not-computed
The result is NOT-COMPUTED with dispatchCount 0. No authority-denied or boundary-incomplete reason is guessed. The gate lacked enough input to compute a decision; this differs from guarded rejection.
Admission observations
Typed input null / wire unknown
Descriptor comparison
NOT-COMPUTED / count0 / no guessed reason
Evidence verdict
No descriptor
Reference Tea did not replace missing observation
Reference body Tea and hex 546561 do not establish those bytes in a missing request. The complete normal fixture is a teaching comparison. Adding observedOctets 3 to unknown input would fabricate evidence.
Admission observations
Reference bytes not missing-request receipt
Descriptor comparison
NOT-COMPUTED / count0 / no guessed reason
Evidence verdict
No descriptor
Required admission facts retained a separate inventory
Admission needs authority, method, path/query, completeness and a supported profile. Context acceptance additionally needs peer class, protected hop and reconstruction. Substituting one inventory for the other changes the review question.
Admission observations
Reference bytes not missing-request receipt
Descriptor comparison
Admission facts ≠ provenance facts
Evidence verdict
No descriptor
Unknown coverage did not become protected trust
Admission and provenance remain UNKNOWN for this review. An absent event establishes neither accepted target, trusted user nor parser correctness. No new network or actual-user-state assumption is added.
Admission observations
Reference bytes not missing-request receipt
Descriptor comparison
Admission facts ≠ provenance facts
Evidence verdict
UNKNOWN: admission/provenance coverage
New evidence remained targeted and minimal
Further review needs the source of typed facts and scoped observed completeness, not full bodies or credentials. With new facts, admission, context acceptance and descriptor selection are recalculated separately.
Admission observations
Reference bytes not missing-request receipt
Descriptor comparison
Admission facts ≠ provenance facts
Evidence verdict
Needed: sourced facts and observed completeness

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Make the public-target mapping explicit

A typed admission function produces the observation; facts are inputs and expected contains decision examples. Descriptor comparison examines local byte conversion. Authority-denied skips context/completeness; incomplete accepts context but has no dispatch. This ledger contains neither real proxy logs nor wire receipts. Atlas selects approved authority books.example and fixed catalog-preview routeId together. Unknown authority yields no guessed default or arbitrary internal destination. Keeping public origin and internal service addressing as separate configuration responsibilities avoids deriving routing authority from incoming metadata. The mapping grants no user authorization, which remains an application decision.

Accepting forwarded context requires a configured immediate peer, protected hop, and approved reconstruction. Keep ignored external context visible as a distinct result. A bounded outcome category preserves the necessary review relationship without copying a full chain or credential into logs. Ignored and absent contexts are different provenance observations.

Verify admission and projection boundaries together

For ordinary Tea, compare descriptor method, authority, path/query, bodyHex, and contentLength against independent expectations. Denied authority and incomplete branches retain a null descriptor and zero dispatchCount. Missing evidence is not-computed; an unknown conversion profile is rejected. Distinct outcomes require distinct reasons in regression records.

Scene snapshots show the sequence of public target, provenance, completeness, conversion projection, and final record. Local operations have no invented wire. Keep actual native byte conversion and the displayed semantic model within the same scope; they establish nothing about every HTTP implementation, actual TLS peer validation, or production routing.

NOW APPLY IT TO THE CASE

Why separate authority, forwarded provenance and body completeness gates?

Tea is three-byte content for the public books.example preview route. Direct validated public targets can be admitted while external peer context is ignored. Incomplete bodies and unapproved authority stop at dispatch for different reasons; absent inputs yield no computed decision.

Which cache owner supplies the case representation? Evaluate key scope, freshness and viewer context together; a hit does not establish the correct viewer.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Atlas public preview admission record

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "profile": "owned-public-preview-admission",
  "approvedAuthority": "books.example",
  "fixedRouteId": "catalog-preview",
  "normalBody": "Tea",
  "facts": {
    "normal": {
      "authority": "books.example",
      "method": "POST",
      "pathQuery": "/preview?lang=en",
      "peerClass": "approved-edge",
      "protectedHop": true,
      "reconstructed": true,
      "expectedOctets": 3,
      "observedOctets": 3,
      "complete": true,
      "profile": "h2-to-h1-known-length",
      "bodyHex": "546561"
    },
    "external": {
      "authority": "books.example",
      "method": "POST",
      "pathQuery": "/preview?lang=en",
      "peerClass": "external",
      "protectedHop": false,
      "reconstructed": false,
      "expectedOctets": 3,
      "observedOctets": 3,
      "complete": true,
      "profile": "h2-to-h1-known-length",
      "bodyHex": "546561"
    },
    "authority-denied": {
      "authority": "archive.example",
      "method": "POST",
      "pathQuery": "/preview?lang=en",
      "peerClass": "approved-edge",
      "protectedHop": true,
      "reconstructed": true,
      "expectedOctets": 3,
      "observedOctets": 3,
      "complete": true,
      "profile": "h2-to-h1-known-length",
      "bodyHex": "546561"
    },
    "incomplete": {
      "authority": "books.example",
      "method": "POST",
      "pathQuery": "/preview?lang=en",
      "peerClass": "approved-edge",
      "protectedHop": true,
      "reconstructed": true,
      "expectedOctets": 3,
      "observedOctets": 2,
      "complete": false,
      "profile": "h2-to-h1-known-length",
      "bodyHex": "546561"
    }
  },
  "expected": {
    "normal": {
      "decision": "ACCEPT",
      "reason": "approved-complete",
      "contextAccepted": true,
      "dispatchCount": 1
    },
    "external": {
      "decision": "ACCEPT",
      "reason": "approved-complete",
      "contextAccepted": false,
      "dispatchCount": 1
    },
    "authority-denied": {
      "decision": "REJECT",
      "reason": "authority-not-approved",
      "contextAccepted": false,
      "dispatchCount": 0
    },
    "incomplete": {
      "decision": "REJECT",
      "reason": "boundary-incomplete",
      "contextAccepted": true,
      "dispatchCount": 0
    }
  },
  "missingEvidence": {
    "input": null,
    "decision": "NOT-COMPUTED",
    "dispatchCount": 0
  },
  "wireBytesIncluded": false,
  "scope": "Supplied typed facts; selected semantic descriptor only, no HTTP parser or network dispatch."
}

authority / fixedRouteId: Public target validation and configured route; not user identity.
peerClass / contextAccepted: Supplied provenance decision, separate from direct-target admission.
expectedOctets / observedOctets / complete: Inert completeness evidence, not a raw message or parser reproduction.
profile / bodyHex: Selected normal semantic projection and preserved Tea octets.
decision / reason / dispatchCount: Accepted local record, rejection, or missing evidence; no real dispatch runs.

Supplied policy facts and ordinary Tea byte projection. Actual Node Buffer/URL and pure reducer checks; no real HTTP parser, forwarding, TLS peer verification, user authorization, or desynchronization reproduction.

Two reality checks

Host or https inside Forwarded proves a trusted identity.

Authority is routing context; provenance, transport peer, and user authorization require distinct evidence.

HTTP/2 on the first hop removes framing concerns on the next.

Conversion introduces a new boundary contract; a version label certifies neither completeness nor parser agreement.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

An external peer sends the public preview request. Authority and body boundary pass, but forwarded provenance is untrusted. Do the request and forwarded context receive the same decision?

Rejecting context necessarily rejects every public request.
The request is ACCEPTed; contextAccepted=false.

Read the explained answer

The request is ACCEPTed; contextAccepted=false. — This public profile can accept a complete request while withholding trust from the external writer’s forwarded context.

The context is approved, but only two of three expected octets were observed. Is the handler dispatched?

Selected lesson artifact fields; teaching example

facts.incomplete.expectedOctets: 3
facts.incomplete.observedOctets: 2
facts.incomplete.complete: false
expected.incomplete: {"decision":"REJECT","reason":"boundary-incomplete","contextAccepted":true,"dispatchCount":0}

No. boundary-incomplete yields dispatchCount=0.
Yes. An approved edge automatically supplies missing bytes.

Read the explained answer

No. boundary-incomplete yields dispatchCount=0. — contextAccepted=true does not change complete=false. This profile withholds an incomplete request from the handler.

What limited evidence do the H2-to-H1-known-length label and supplied typed facts provide about parser agreement? What is unknown with missing input?

Read the explained answer

Policy is evaluated over supplied method, authority, target and length facts. These are neither encoded HTTP bytes nor a test showing two real parsers agree on a boundary; wireBytesIncluded=false. Authority must match books.example; forwarded provenance is separate. Missing input yields NOT-COMPUTED and dispatchCount=0, not evidence of healthy parsers or a correct deployment.

□ I did not treat typed facts as an executed parser or capture.

□ I did not infer a safe deployment from missing input.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

RFC 9110 — HTTP Semantics7.2 Host and :authority · 7.4 Rejecting Misdirected Requests
RFC 7239 — Forwarded HTTP Extension8.1 Header Validity and Integrity
RFC 9112 — HTTP/1.16.3 Message Body Length · 11.2 Request Smuggling
RFC 9113 — HTTP/28.1.1 Malformed Messages · 8.2.2 Connection-Specific Header Fields

YOUR NOTES / THIS BROWSER

Authority, forwarded trust, and parser agreement

1. Core · Mechanism

Approved preview

External ignored

Authority denied

Incomplete record

Authority is routing information

Who wrote the forwarded context?

A message boundary is not a content value

What does HTTP version conversion preserve?

Why is parser agreement a chain property?

Record observation separately from policy

2. Red · Trust & Impact

External context

Incomplete body

Review which information is authoritative

Look for boundary evidence beyond the version name

3. Blue · Secure development & defense

Descriptor review

Missing facts

Make the public-target mapping explicit

Verify admission and projection boundaries together

Why separate authority, forwarded provenance and body completeness gates?

Two reality checks

An external peer sends the public preview request. Authority and body boundary pass, but forwarded provenance is untrusted. Do the request and forwarded context receive the same decision?

The context is approved, but only two of three expected octets were observed. Is the handler dispatched?

What limited evidence do the H2-to-H1-known-length label and supplied typed facts provide about parser agreement? What is unknown with missing input?

Sources and scope