# HTTP/ASGI prototype requirements matrix
Normative references: [ASGI 3.0](https://asgi.readthedocs.io/en/latest/specs/main.html),
[HTTP/WebSocket 2.5](https://asgi.readthedocs.io/en/latest/specs/www.html),
[Lifespan 2.0](https://asgi.readthedocs.io/en/latest/specs/lifespan.html),
[RFC 9110](https://www.rfc-editor.org/rfc/rfc9110.html),
[RFC 9112](https://www.rfc-editor.org/rfc/rfc9112.html).
This matrix tracks specific evidence. It is not a blanket compliance claim.
Specifications and verified errata need another review before a release.
| Contract | Evidence / state |
|---|---|
| ASGI 3 asynchronous application interface | Real ASGI apps, FastAPI benchmark |
| HTTP scopes, paths, query strings, repeated headers | `test_scope_headers_and_percent_decoding` |
| Absolute-target authority replaces Host | `test_absolute_target_authority_overrides_host` |
| Incremental fixed/chunked request bodies | Upload, fragmentation, and native segmentation tests |
| Exact request boundaries and ordered pipelining | Fixed-upload/pipeline test and native consumed-prefix test |
| Framing ambiguity closes the connection | Table of malformed requests plus a pipelined successor |
| Resource bounds and integer overflow | 100/101-header boundaries, oversized head/body cases; native chunk syntax/overflow test |
| Response start/body order and header validation | Response validation and iterable-header-pair tests; broader invalid-message matrix remains |
| Duplicate response fields preserved | Repeated Set-Cookie socket test |
| Header snapshots and owned scope values | Empty/obs-text/trimmed values, retained/mutated scope headers, changed same-length values, and large/duplicate header tables; mutation of response headers after start |
| Native send call signature | Invalid arity/type and positional/keyword send calls through a real application |
| Ready awaitable iterator returns the receive value | Explicit `__await__` iterator completion plus socket echo/fragmentation tests |
| HEAD/204/205/304 no response body | Parameterized bodyless pipeline test |
| Response Content-Length checked | Mismatch before/after response bytes begin, with no second response appended |
| Streaming sends flush before app completion | Event-controlled streaming socket test |
| ASGI response trailers | Multi-message trailer socket test |
| receive waits after the final request event | Disconnect test |
| Pending receive wakes when the response completes | Response-completion socket test |
| Closed send raises OSError | Backpressure/disconnect test |
| Cancelled receive may be replaced | Cancellation socket test |
| Retained request callables cannot cross requests | Retained-channel socket test |
| Immediate awaits preserve fairness | Streaming producer, ready disconnect receives and queued-marker pipeline checks |
| Buffered pipelining remains ordered while an app is held | 200-request pipeline test |
| Eager execution preserves Task and context isolation | Ready/waiting app context test |
| Embedding task factories are respected | Custom factory socket test |
| Disconnect during dispatch cannot panic or stop serving | Final/streaming TCP resets and subsequent healthy-request test |
| Server closed-send errors are quiet; application failures remain visible | Disconnect logging regression and ready/waiting Task failures, including application OSError and cancellation |
| Scope method/version defaults do not leak across requests | Mixed HTTP/1.0 and HTTP/1.1 methods on keepalive connections |
| Completion outside the native reactor flushes output | 24 independently held applications released together |
| Large body data and chunk framing survive partial writes | Byte-exact streamed payloads at 4095/4096/4097 bytes and 8 MiB |
| Lifespan on serving loop; request state shallow copies | Lifespan/state test for on/off; optional state omitted only when explicitly off |
| Explicit startup.failed prevents serving | Lifespan failure test |
| Graceful shutdown ordering | Cancellation cleanup precedes lifespan shutdown in embedding test; process-level qualification remains |
| Slow-client timeouts and truncated EOF | Implemented; broader deadline/EOF matrix remains |
| WebSockets | Unsupported; upgrade rejected with 501 |
| Optional ASGI extensions | None advertised |
| HTTP/2, HTTP/3, TLS | Unsupported |
Before production: complete the remaining HTTP requirement-by-requirement audit,
add property/fuzz coverage, extend the native/Python AddressSanitizer checks with leak and fuzz qualification,
qualify all advertised Python/platform combinations, and exercise prolonged
mixed-client load and shutdown failures. Differential server behavior is useful
evidence but does not replace the specifications as the authority.