Release notes: tier5_http exploit harness (exploit-harness)¶

Branch: cursor/httpd-plan-continue

Summary¶

TOML-driven exploit replay harness: exploit_http.py runs suite_exploits.toml + exploits/*.toml against nginx baseline and li-httpd, with [expect] checks and optional --compare-nginx for documented stricter-li behavior.

Changed¶

• benchmarks/harness/http_exploit_toml.py, exploit_http.py
• benchmarks/tier5_http/exploits/, drivers/, nginx_mitigations.toml, suite_exploits.toml
• scripts/check-tier5-exploit-harness.sh, scripts/httpd-plan-gates.sh
• docs/security-http-exploits.md
• Plan todo exploit-harness → completed

Test commands¶

./scripts/check-tier5-exploit-harness.sh
HTTPD_GATES_SKIP_LIC_BUILD=1 ./scripts/httpd-plan-gates.sh

Not changed¶

• Live Pages bench refresh (SKIP_BENCH=1 — no new timing CSV)
• audit_nginx_src.py / full Tier B–F exploit corpus (later todos)
• Full li-httpd integration runs in CI (stub default; set LI_HTTPD_BIN for live)

Breaking / Security / Performance / Downstream¶