Skip to content

HTTPd M1 — tier5 exploit runtime gate

Summary

Completes plan todo m1-exploit-runtime: exploit_http.py starts build/li-httpd with flattened runtime .conf (argv), and check-tier5-exploit-runtime.sh runs the PR-tier exploit profile against a live listener.

Agent continuation

  1. Run ./scripts/check-tier5-exploit-runtime.sh after ./scripts/build-li-httpd.sh.
  2. Run ./scripts/httpd-plan-gates.sh (includes runtime exploit gate when HTTPD_RUN_EXPLOIT_RUNTIME=1, default on full build).
  3. Stub-only harness smoke remains ./scripts/check-tier5-exploit-harness.sh.

Changed

Area Paths
Harness benchmarks/harness/exploit_http.py — flatten/bench conf + li-httpd <conf>
Gates scripts/check-tier5-exploit-runtime.sh, scripts/httpd-plan-gates.sh
Plan docs/superpowers/plans/2026-05-16-li-httpd-plan.md — m1-exploit-runtime: completed

Not changed

  • Tier-5 bench matrix ingest; live Pages refresh (SKIP_BENCH=1 — no new CSV).
  • Nginx --compare-nginx rows (optional; PR gate uses --langs li only).

Breaking

N/A.

Security

Tier A duplicate_content_length exercised on live parser (400 on duplicate Content-Length). Tier F config-reject exploits skip listener start (validate_config_fails).