Skip to content

Release notes: httpd M2 TLS/H2 scale (m2-tls-h2)

Branch: cursor/httpd-plan-continue

Summary

M2 agent-scale gateway config and runtime oracles: TLS 1.3 terminate profile, HTTP/2 ALPN gate, WebSocket route requires, cold-queue 429 backpressure, upstream circuit breaker, and HTTPS-only webhook egress allowlist.

Changed

  • scripts/httpd_m2.py — validate + flatten M2 TOML ([server.http2], [route.queue], [circuit_breaker], [webhooks], require=websocket)
  • scripts/check-httpd-m2-config.sh, scripts/httpd-plan-gates.sh — M2 config + runtime smokes (test-m2-*-runtime.sh)
  • li-tests/config_desugar/good/m2_agent_scale.toml, reject/m2_*.toml
  • li-tests/httpd/m2_tls_h2_oracle.li
  • runtime/li_rt_httpd.c, runtime/li_rt.h — M2 TOML parse + oracle getters/selftest
  • runtime/li_rt_net.c, runtime/li_rt_tls.c, runtime/li_rt_h2.c — TLS 1.3 terminate + ALPN h2, queue 429 (Retry-After), circuit breaker, WebSocket tunnel, webhook egress allowlist
  • packages/li-net-httpd/examples/tls_h2.toml, circuit_queue.toml, websocket_proxy.toml, webhook_egress.toml
  • scripts/httpd_config.py — require=websocket in route DSL
  • docs/superpowers/plans/2026-05-16-li-httpd-plan.md — m2-tls-h2 + M2 runtime parity todos → completed

Not changed

  • Full HPACK dynamic table / HTTP/2 negative suite (h2spec) — smoke only via curl --http2
  • Live GitHub Pages bench refresh (SKIP_BENCH=1; no new tier5 CSV this slice)

Breaking

N/A — new optional M2 tables; existing M1/M1.5 configs unchanged.

Security

Webhook egress allowlist rejects private/loopback https hosts at lic validate-config time (SSRF guard).

Performance

N/A — policy hooks only; no published RPS delta.

Downstream

Flatten adds m2_* keys to httpd.runtime.conf for C loader; proxy path emits 429 when queue saturated or all peers circuit-open/down.

Test plan

./scripts/build.sh && ./scripts/build-li-httpd.sh
./scripts/check-httpd-m2-config.sh
./scripts/test-m2-tls-h2-runtime.sh
./scripts/test-m2-circuit-queue-runtime.sh
./scripts/test-m2-websocket-runtime.sh
./scripts/test-m2-webhook-egress-runtime.sh
./scripts/httpd-plan-gates.sh