[shiju-nv]

Summary

Retire HTTP connections promptly when the upstream closes while idle, including JSON-RPC and MCP. For relay-owned upstream failures, return a correlated 502 Bad Gateway with Connection: close before any response bytes are written to the client; close without appending another status once a response has started. Apply the same error handling to plain forward HTTP and CONNECT tunnels.

Related Issue

Closes #5322

Scope follows the issue discussion: automatic reconnect/replay is deliberately excluded. The original replay acceptance criterion still needs the issue author's correction to reflect the agreed idle-close and explicit-error scope.

Changes

• Watch idle upstream connections in all five HTTP request loops, including JSON-RPC/MCP, and reject unsolicited bytes even when a client request is already queued.
• Track response bytes accepted by the client and preserve the original upstream error cause. Distinguish incomplete framing from normal body completion followed by policy or middleware errors.
• Share correlated gateway errors, upstream shutdown, and failure telemetry with forward HTTP. Record a 502 only after its write succeeds, and end affected WebSocket middleware sessions as upstream failures.
• Extend existing test matrices for inspected requests, protocol coverage, truncated bodies, resets, and policy reload; add a full forward-handler regression. Existing response-middleware-owned failures retain their own responses and events.

Release Notes

HTTP clients receive idle upstream closure promptly. Relay-owned failures before a response starts return an explicit gateway error with a request ID.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Local validation used Rust 1.95.0 on macOS. Full Linux sandbox E2E and the reporter's EKS/Istio/Bun deployment were not run; hosted CI owns broad verification after this push.

• Six relay regressions passed, including real TCP keep-alive for passthrough, REST, JSON-RPC and MCP, queued failures, inspected 502s, reset causes, and unsolicited upstream data.
• Full forward-handler EOF regression passed with 502, request ID and allowed activity.
• Two response-policy-reload tests passed through the adapter owner with both fixed-length and close-delimited responses; two keep-alive policy-generation tests passed.
• Existing endpoint-observation, JSON-RPC and unchanged response-middleware focused receipts remain valid for their covered inputs.
• cargo clippy --offline --locked -p openshell-supervisor-network --lib --tests -- -D warnings: passed. Rust formatting, diff whitespace and SPDX checks passed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[EmilienM]

Another iteration needed: 1 blocking, 4 major, 7 minor (inline, 5 below)

The tunnel REST/GraphQL/passthrough loops are covered and tested, but the JSON-RPC/MCP loop and the forward-proxy entry path don't get the fix, and response_started can still suppress the 502 with nothing delivered to the client.

Outside the diff:

• Blocking: the PR has no area label, so Review Readiness fails; area:supervisor (or area:runtime) fits.
• Major: crates/openshell-supervisor-network/src/proxy.rs:6836, the forward-proxy error boundary downcasts the sibling typed relay errors but has no arm for the new UpstreamHttpError, so plain forward requests still close silently with no 502 and the allow-event for an allowed request is now skipped.
• Major: issue #5322's first acceptance criterion (replaying a request sent on a reused connection when the upstream closed before any response byte) isn't implemented; since the PR closes the issue, either implement it for idempotent methods or update the issue so the descope is recorded.
• Minor: relay.rs:2355, an upstream failure now ends the websocket middleware session as Cancellation while the sibling arms use UpstreamFailure.
• Minor: the PR body says the connection behavior is documented, but the second commit removed the docs paragraph; restore a trimmed note or drop the claim.

How this was reviewed

• Commit e5fe0357, round 1
• Standard review, because the change is code in crates/openshell-supervisor-network/src/l7/relay.rs, l7/rest.rs, and l7/rest/http_response.rs
• Passes: architecture, performance, security, scalability, rust, supply-chain, then correctness
• Independent skeptics checked each candidate finding (2 per blocking or major, 1 per minor); 11 of 11 held up, 2 of them after re-checking the code
• Repo rules read from main: AGENTS.md, CLAUDE.md, CONTRIBUTING.md, docs/CONTRIBUTING.mdx
• Not covered: nothing skipped

[shiju-nv]

All five HTTP loops now watch idle upstream connections, including JSON-RPC/MCP. Forward HTTP uses the same upstream-error handling and preserves allowed-request telemetry. Response commitment tracks successful client writes, so an incomplete buffered header can still produce a 502. Original I/O causes are preserved, and truncated bodies are distinguished from policy or middleware failures after normal body completion.

The shared handler preserves the request ID, shuts down upstream, and records a 502 only after delivery succeeds. Session cleanup uses UpstreamFailure. The tests now cover inspected REST, resets and the forward-handler path. The stale docs claim is removed, and area:runtime is set.