A live security decision, proven not guessed

The queue Granite can't clear — HTTP request smuggling, caught in 2.8 microseconds.

A request carrying both a Transfer-Encoding and a Content-Length header is the textbook request-smuggling setup — RFC 9112 §6.3 item 3 names it outright. Vulcan's oracle proves the verdict deterministically, citing the exact clause, in microseconds. Watch it run below on a live-scripted traffic feed, then see why routing that same traffic through a language model doesn't scale: the same question, asked of a local Granite model, takes over two seconds — a backlog that only grows.

HTTP/1.1 framing decision · verdict per message RFC 9112 §6.3 / §9.3 0 normal · 0 anomaly caught

A scripted replay of a real, measured run (recorded ) — every verdict shown is the oracle's actual output on this machine, not invented for the page.

Same question, same machine

Vulcan vs. a local LLM — measured, not estimated

We asked a local Granite 2B model (via Ollama) the identical smuggling question Vulcan answers instantly. Same hardware, same prompt, deterministic decoding on both sides.

Vulcan

2.8 microseconds

Deterministic — the same verdict, every single time. Cites RFC 9112 §6.3 item 3 by name.

Granite 2B (local LLM)

2.1 seconds

A free-text answer, graded by inspection — not a certified verdict. ~760,000× slower on this run.

Measured throughput — single core, pure Python

~1.2 million decisions/sec, average

Sampled over 500,000 real decision calls on one core (Apple M5 Max, no threads, no GPU): worst 279,000/sec, best 1.4 million/sec, average ~1.2 million/sec — reported worst-case first, not just the flattering number. Honest scope: this is the decision step alone, not a full packet/wire parser.

Why this matters at production traffic rates

The queue Granite can't clear

At a modest 300 requests/sec, Vulcan proves every single one — the backlog never leaves zero. Route that same traffic through the LLM instead, and the math is exact, not hand-waved: Granite completes roughly one verdict for every ~2.1-second slice of wall clock, so the backlog grows by ~299 requests every single second it runs.

Vulcan — backlog

0

Stays at zero indefinitely — decision time is microseconds against a 300/sec arrival rate.

Routed through Granite instead — backlog after 10 seconds

~2,990 requests

And climbing, without bound, for as long as traffic keeps arriving faster than one verdict every 2.1 seconds.

Details

The spec it proves, the decision set, and how it was built

No hidden benchmark, no cherry-picked run — the grounding, the decision set, and the provenance are all here. Expand what you want to inspect.

The decision set — every verdict the oracle can reach

The oracle decides connection persistence and message-body framing for one HTTP/1.1 message — five inputs (version, Connection, Transfer-Encoding presence, Content-Length presence, request/response role), seventeen possible verdicts, one of which is a hard rejection:

Grounding — the published standards, and only those

Every decision traces to a published, active IETF standard. No experimental drafts, no invented behavior:

RFC	Title	Status	Used for
9110	HTTP Semantics	Internet Std (STD 97)	the `Connection` header field definition (§7.6.1)
9112	HTTP/1.1	Internet Std (STD 99)	message-body framing (§6.3) and persistence (§9.3)

Scope — what this oracle does NOT cover

Deliberately narrow: only connection-persistence and message-framing. It does not cover request methods, routing, status codes in general, caching (RFC 9111), any header beyond Connection/Transfer-Encoding/Content-Length, the HEAD/1xx/204/304 body-suppression cases, CONNECT tunnelling, or chunked-trailer semantics. A full HTTP/1.1 implementation needs all of those; this oracle proves one well-defined, security-relevant slice of it.

How it was built

A hand-authored decision procedure — pure Python, no model, no training — transcribed directly from the fetched RFC 9112 text (not from memory or a summarizer). It is one part of a larger effort proving the same recipe across eleven RFC families (IPv4, IPv6, TCP, UDP, ICMP, BGP-4, DNS, ARP, HTTP/1.1, TLS 1.3, SMTP). The verdict is a total function: given the five inputs, there is exactly one correct answer, and the oracle always returns it.