{
  "note": "Generated from docs/SPEC.md by scripts/spec_sheet.py. `verified` means a named CI gate exercises the capability on the stated cadence, not that it is correct.",
  "capabilities": [
    {
      "id": "A1",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Persistent connections (keep-alive)",
      "status": "verified",
      "evidence": "`Smoke test pipelined requests` (every PR)"
    },
    {
      "id": "A2",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "The example Mojo server starts and answers `/health`",
      "status": "verified",
      "evidence": "`Smoke test the hello server` (every PR)"
    },
    {
      "id": "A3",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Keep-alive request cap",
      "status": "verified",
      "evidence": "`Smoke test the keep-alive request cap` (every PR) \u2014 closes on the cap request, and a stream or WebSocket upgrade landing there survives it; the probe's third phase refuses to pass on a build whose cap never fires. No flag or env var exposes the limit"
    },
    {
      "id": "A4",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Idle connection timeout, `--idle-timeout`",
      "status": "verified",
      "evidence": "`Smoke test the idle connection timeout` (every PR) \u2014 an answered keep-alive connection left quiet is closed at the deadline and no earlier, and one kept busy across it is not"
    },
    {
      "id": "A5",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Header read timeout (slowloris defence)",
      "status": "verified",
      "evidence": "`Smoke test the header read timeout` (every PR)"
    },
    {
      "id": "A6",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Request pipelining, answered in order (RFC 9112 \u00a79.3)",
      "status": "verified",
      "evidence": "`Smoke test pipelined requests` (every PR)"
    },
    {
      "id": "A7",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Chunked request bodies, decoded incrementally across reads",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_incremental_decode_matches_a_single_pass` (every PR)"
    },
    {
      "id": "A8",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Chunked decode consumes the terminator, leaving nothing buffered",
      "status": "verified",
      "evidence": "`test_chunked_encode.mojo:test_round_trip_single_chunk` (every PR)"
    },
    {
      "id": "A9",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Chunked response bodies",
      "status": "verified",
      "evidence": "`Smoke test streamed WSGI bodies` (every PR)"
    },
    {
      "id": "A10",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Trailer fields consumed and discarded, not surfaced to the application",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_a_trailer_section_is_consumed_whole` (every PR) \u2014 with seven more beside it: the framing fields a trailer must not honour, the pipelined tail surviving it, the section bounded by the abuse ratio, and `test_without_consume_trailer_the_body_ends_at_the_zero_chunk` as the other half. `poe sabotage-trailers` reverts each of the six rules and requires a failure for every one"
    },
    {
      "id": "A11",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "`Expect: 100-continue`, honoured case-insensitively and withheld from HTTP/1.0",
      "status": "verified",
      "evidence": "`Expect 100-continue, honoured and withheld` (every PR) \u2014 both directions: a server answering it unconditionally would pass the invitation half while discarding the refusal-before-upload the mechanism exists for"
    },
    {
      "id": "A12",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Half-close answered rather than dropped",
      "status": "verified",
      "evidence": "`Smoke test a half-closed client` (every PR)"
    },
    {
      "id": "A13",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Request headers larger than one socket read",
      "status": "verified",
      "evidence": "`Smoke test a request larger than one read` (every PR)"
    },
    {
      "id": "A14",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "`Host` required on HTTP/1.1",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_http11_requires_a_non_empty_host` (every PR)"
    },
    {
      "id": "A15",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "absolute-form request target reduced to its path",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_absolute_form_target_is_reduced_to_its_path` (every PR)"
    },
    {
      "id": "A16",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Malformed field lines rejected, not treated as incomplete",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_a_field_line_without_a_colon_is_invalid_not_incomplete` (every PR)"
    },
    {
      "id": "A17",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "Control bytes in the request target rejected",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_a_control_byte_in_the_request_target_is_invalid` (every PR)"
    },
    {
      "id": "A18",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "HTTP/2",
      "status": "out of scope",
      "evidence": "terminate at a proxy \u2014 gunicorn's answer, and the same one applies here"
    },
    {
      "id": "A19",
      "section": "A",
      "category": "A. HTTP/1.1 framing and connection lifecycle",
      "capability": "HTTP/3 and QUIC",
      "status": "out of scope",
      "evidence": "follows HTTP/2; there is no TLS layer to build it on"
    },
    {
      "id": "B1",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "`Content-Length` with `Transfer-Encoding` rejected",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_content_length_with_transfer_encoding_is_rejected` (every PR)"
    },
    {
      "id": "B2",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "Duplicate `Content-Length` rejected, including across letter case",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_duplicate_content_length_is_rejected_across_letter_case` (every PR)"
    },
    {
      "id": "B3",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "`Transfer-Encoding` whose last coding is not `chunked` rejected",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_transfer_encoding_whose_last_coding_is_not_chunked_is_rejected` (every PR)"
    },
    {
      "id": "B4",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "Header padding does not bypass the smuggling check",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_padded_headers_do_not_bypass_the_smuggling_check` (every PR)"
    },
    {
      "id": "B5",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "Bare LF in a chunk extension rejected",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_bare_lf_in_a_chunk_extension_is_rejected` (every PR)"
    },
    {
      "id": "B6",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "`Content-Length` integer overflow rejected",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_overflowing_content_length_is_rejected` (every PR)"
    },
    {
      "id": "B7",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "Chunk size with the sign bit set rejected",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_chunk_size_with_the_sign_bit_set_is_rejected` (every PR)"
    },
    {
      "id": "B8",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "h2spec conformance run",
      "status": "out of scope",
      "evidence": "follows from having no HTTP/2 (A18), the same reason C7 gives"
    },
    {
      "id": "B9",
      "section": "B",
      "category": "B. Request smuggling (CWE-444)",
      "capability": "PortSwigger-style desync scanning",
      "status": "out of scope",
      "evidence": "the scanner probes a proxy/server PAIR for disagreement about framing; this server has no proxy in front of it in any gate, so there is no second parser to disagree with. The shapes it looks for are unit-tested directly above (B1-B7), and fuzzing the decoder itself is G13"
    },
    {
      "id": "C1",
      "section": "C",
      "category": "C. Connection management and denial of service",
      "capability": "Max request body size, configurable",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--max-body`"
    },
    {
      "id": "C2",
      "section": "C",
      "category": "C. Connection management and denial of service",
      "capability": "Chunk size limited to 16 significant digits",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_chunk_size_is_limited_to_sixteen_significant_digits` (every PR)"
    },
    {
      "id": "C3",
      "section": "C",
      "category": "C. Connection management and denial of service",
      "capability": "Raw chunked bytes bounded independently of decoded size",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 a decoded-legal body costing 2x the cap in framing answers 413"
    },
    {
      "id": "C4",
      "section": "C",
      "category": "C. Connection management and denial of service",
      "capability": "Max header count",
      "status": "verified",
      "evidence": "`test_parsing.mojo:test_header_count_is_capped` (every PR)"
    },
    {
      "id": "C5",
      "section": "C",
      "category": "C. Connection management and denial of service",
      "capability": "A slow handler does not stall connections behind it",
      "status": "verified",
      "evidence": "`Smoke test the blocking-threads pool` (every PR)"
    },
    {
      "id": "C6",
      "section": "C",
      "category": "C. Connection management and denial of service",
      "capability": "Connection/request rate limiting",
      "status": "out of scope",
      "evidence": "a proxy's job; this server has no notion of a client identity to limit on"
    },
    {
      "id": "C7",
      "section": "C",
      "category": "C. Connection management and denial of service",
      "capability": "HTTP/2 reset-flood limits",
      "status": "out of scope",
      "evidence": "follows from having no HTTP/2"
    },
    {
      "id": "D1",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "SIGTERM drains in-flight requests",
      "status": "verified",
      "evidence": "`Smoke test graceful shutdown` (every PR)"
    },
    {
      "id": "D2",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "SIGTERM to the supervisor alone reaps workers",
      "status": "verified",
      "evidence": "`Smoke test graceful shutdown` (every PR)"
    },
    {
      "id": "D3",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "Bounded drain, naming what it abandoned",
      "status": "verified",
      "evidence": "`Smoke test streamed WSGI bodies` (every PR)"
    },
    {
      "id": "D4",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "SIGTERM reaches a shutdown pipe rather than killing the process",
      "status": "verified",
      "evidence": "`test_lifecycle.mojo:test_sigterm_reaches_the_shutdown_pipe` (every PR)"
    },
    {
      "id": "D5",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "Development hot reload on file change",
      "status": "verified",
      "evidence": "`Smoke test hot reload` (every PR) \u2014 `--reload`, `--reload-dir`"
    },
    {
      "id": "D9",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "A request whose body is still arriving at SIGTERM is read on and answered, not left to the deadline",
      "status": "verified",
      "evidence": "`Smoke test the drain with an upload in flight` (every PR) \u2014 `scripts/drain_upload_probe.py`, two-sided: answered whole AND exited inside 3 s, on the ASGI executor and on a WSGI pool thread"
    },
    {
      "id": "D6",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "`SO_REUSEPORT` off by default: a second bind fails loudly instead of silently sharing the port",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 five attempts a second apart, so a restart racing the previous process's drain still succeeds; the second server must exit 1 naming the address, print no ready banner, and leave the first answering. The opt-in `ListenConfig.reuse_port` remains for a deliberate handoff between two processes that both mean to listen; no shipped path enables it, because workers and threads all accept from ONE listener bound before the fork"
    },
    {
      "id": "D7",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "Binary/hot upgrade (USR2-style overlap)",
      "status": "out of scope",
      "evidence": "needs socket handoff this server does not have; run two behind a proxy"
    },
    {
      "id": "D8",
      "section": "D",
      "category": "D. Graceful shutdown and restart",
      "capability": "SIGHUP reload",
      "status": "out of scope",
      "evidence": "`--reload` covers development; production reload is a new process behind a proxy"
    },
    {
      "id": "E1",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "Multi-process prefork with a supervising parent",
      "status": "verified",
      "evidence": "`Smoke test the Django WSGI example` (every PR)"
    },
    {
      "id": "E2",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "Crashed workers respawned",
      "status": "verified",
      "evidence": "`test_respawn.mojo:test_respawned_worker_returns_to_the_callers_startup_path` (every PR)"
    },
    {
      "id": "E3",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "A spent respawn budget exits nonzero rather than looping",
      "status": "verified",
      "evidence": "`test_respawn.mojo:test_supervisor_exits_nonzero_when_respawn_budget_is_spent` (every PR)"
    },
    {
      "id": "E4",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "Handler thread pool behind each event loop",
      "status": "verified",
      "evidence": "`Smoke test the Mojo handler pool` (every PR)"
    },
    {
      "id": "E5",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "Free-threaded CPython, N loops on N threads",
      "status": "verified",
      "evidence": "`py-canary` (weekly)"
    },
    {
      "id": "E6",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "A GIL-enabled interpreter is refused, never warned-and-run",
      "status": "verified",
      "evidence": "`Smoke test the threaded mode's guard` (every PR)"
    },
    {
      "id": "E7",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "Zero-config topology defaults",
      "status": "verified",
      "evidence": "`Smoke test --doctor against the server's own exit codes` (every PR)"
    },
    {
      "id": "E8",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "Max-requests worker recycling with jitter",
      "status": "out of scope",
      "evidence": "the leak it mitigates is measured instead \u2014 `smoke-django` fails on RSS growth over 10k requests"
    },
    {
      "id": "E10",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "A worker's configuration refusal (exit 78) ends supervision with 78, never a respawn loop",
      "status": "verified",
      "evidence": "`test_respawn.mojo:test_a_worker_refusing_its_configuration_is_not_respawned` (every PR)"
    },
    {
      "id": "E9",
      "section": "E",
      "category": "E. Process and worker model",
      "capability": "Worker lifetime / max-RSS recycling",
      "status": "out of scope",
      "evidence": "same reason as above"
    },
    {
      "id": "F1",
      "section": "F",
      "category": "F. Observability",
      "capability": "Access log records cannot be forged by a value (newline, quote, backslash escaped)",
      "status": "verified",
      "evidence": "`test_log.mojo:test_a_newline_cannot_forge_a_second_log_line` (every PR)"
    },
    {
      "id": "F2",
      "section": "F",
      "category": "F. Observability",
      "capability": "`--access-log` emits one JSON record per response, and nothing without it",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--access-log`"
    },
    {
      "id": "F3",
      "section": "F",
      "category": "F. Observability",
      "capability": "`--metrics` turns `/__metrics` from the application's 404 into a 200",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--metrics`"
    },
    {
      "id": "F4",
      "section": "F",
      "category": "F. Observability",
      "capability": "Prometheus exposition 0.0.4: 8 counter and gauge families, each with HELP, TYPE and a sample",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--metrics`"
    },
    {
      "id": "F5",
      "section": "F",
      "category": "F. Observability",
      "capability": "Latency histograms on `/__metrics`",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 six log-spaced `le` bounds (100\u00b5s\u20131s, +Inf), integer-only and O(1) on the loop thread; `scripts/histogram_check.py` (selftested in the same phase) asserts the documented bounds, non-decreasing cumulative counts, `le=\"+Inf\"` equal to `_count`, and a `_count` covering the phase's own requests; boundary math pinned by `test_metrics.mojo`"
    },
    {
      "id": "F12",
      "section": "F",
      "category": "F. Observability",
      "capability": "Coverage declared by the gate rather than cited by this page",
      "status": "verified",
      "evidence": "`Check machine-sourced doc facts` (every PR) \u2014 every pull-request-gated row declares its coverage in the gate itself (a `covers:` docstring line in the cited test, or a recorder coverage call in what the cited step runs), and the checker requires the declaration to agree with the citation, which is what makes the audit's mis-citation class structurally impossible. Weekly and pre-release rows keep declared-static citations, their runs being absent from PR CI. Four sabotages in `poe sabotage-spec` revert the rules"
    },
    {
      "id": "F6",
      "section": "F",
      "category": "F. Observability",
      "capability": "`--health-path` answers 200",
      "status": "verified",
      "evidence": "`Smoke test the Django realtime example` (every PR) \u2014 `--health-path`"
    },
    {
      "id": "F7",
      "section": "F",
      "category": "F. Observability",
      "capability": "Health registry with readiness aggregation",
      "status": "verified",
      "evidence": "`test_health.mojo:test_health_register_unhealthy` (every PR)"
    },
    {
      "id": "F8",
      "section": "F",
      "category": "F. Observability",
      "capability": "Configuration report that exits as the server would",
      "status": "verified",
      "evidence": "`Smoke test --doctor against the server's own exit codes` (every PR) \u2014 `--doctor`"
    },
    {
      "id": "F9",
      "section": "F",
      "category": "F. Observability",
      "capability": "OpenTelemetry tracing",
      "status": "out of scope",
      "evidence": "no tracing context crosses the Mojo/Python seam today; a wrapper in the application is the supported route"
    },
    {
      "id": "F10",
      "section": "F",
      "category": "F. Observability",
      "capability": "CI measurements recorded, rendered per run and kept as an artifact",
      "status": "verified",
      "evidence": "`Check machine-sourced doc facts` (every PR)"
    },
    {
      "id": "F11",
      "section": "F",
      "category": "F. Observability",
      "capability": "The measurement recorder itself",
      "status": "verified",
      "evidence": "`Self-test the measurement recorder` (every PR)"
    },
    {
      "id": "F14",
      "section": "F",
      "category": "F. Observability",
      "capability": "The site's deploy image: the wheel in `python:3.12-slim` with the built site, served from a container as it deploys",
      "status": "verified",
      "evidence": "`Smoke test the documentation site's deploy image` (every PR) \u2014 `deploy/site/Dockerfile` built from the tree's own wheel; through a published port, `llms.txt` and the sitemap answer at the root, a page answers with the Markdown twin it advertises, the slash redirect and the HTML 404 come from the application, m0serve is PID 1 by `/proc/1/cmdline`, and `docker stop` is the drain's exit 0 inside its grace"
    },
    {
      "id": "F15",
      "section": "F",
      "category": "F. Observability",
      "capability": "Every RFC the tree cites is a current document",
      "status": "verified",
      "evidence": "`Check machine-sourced doc facts` (every PR) \u2014 `scripts/check_citations.py` looks every `RFC nnnn` in a tracked text file up in `scripts/rfc_status.json`, a committed snapshot of the RFC Editor's per-document JSON; a citation with no entry fails, and a citation of an obsoleted RFC fails unless the same paragraph cites a successor. Section numbers are not checked. Selftested in `check-docs`; each rule reverted against the tree by the sabotage step in docs.yml"
    },
    {
      "id": "F16",
      "section": "F",
      "category": "F. Observability",
      "capability": "The RFC snapshot is compared with the RFC Editor monthly",
      "status": "verified",
      "evidence": "`Compare the snapshot with the RFC Editor` (monthly) \u2014 `citations.yml` re-fetches every snapshot entry and fails on a changed `obsoleted_by` or status, filing an issue; a transport failure fails too, because the job exists only to ask. F15 checks that this workflow still exists, has a cron and passes the live flag"
    },
    {
      "id": "F13",
      "section": "F",
      "category": "F. Observability",
      "capability": "The documentation site: the tree's own pages rendered and served by the server, `llms.txt` at the root, a Markdown twin beside every page",
      "status": "verified",
      "evidence": "`Smoke test the documentation site` (every PR) \u2014 built by `scripts/docsite.py`, served through `--static` with `apps/site` behind it; every sitemap URL answers as HTML with the twin it advertises, the root text files name the site's pages by absolute URL, the sitemap goes out as XML, and the slash redirect and HTML 404 come from the application"
    },
    {
      "id": "G1",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "An injected status reason phrase is emptied, not transmitted",
      "status": "verified",
      "evidence": "`test_response.mojo:test_status_reason_with_crlf_is_emptied_not_transmitted` (every PR)"
    },
    {
      "id": "G2",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "A response header carrying CR, LF or NUL is dropped, and a clean one beside it is not",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "G3",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "An application's `Set-Cookie` reaches the wire verbatim",
      "status": "verified",
      "evidence": "`test_response_cookies.mojo:test_raw_line_reaches_the_wire_verbatim` (every PR)"
    },
    {
      "id": "G4",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "`Proxy` request header never becomes `HTTP_PROXY` (httpoxy)",
      "status": "verified",
      "evidence": "`test_environ.mojo:test_proxy_header_is_excluded_from_the_environ` (every PR)"
    },
    {
      "id": "G5",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "Path traversal rejected (`../`)",
      "status": "verified",
      "evidence": "`test_static.mojo:test_dotdot_is_rejected` (every PR)"
    },
    {
      "id": "G6",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "Percent-encoded traversal rejected (`%2e%2e`)",
      "status": "verified",
      "evidence": "`test_static.mojo:test_encoded_dotdot_is_rejected` (every PR)"
    },
    {
      "id": "G7",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "Reserved `x01` channel namespace refused by `publish_to_channels`",
      "status": "verified",
      "evidence": "`test_broadcast.mojo:test_publish_rejects_reserved_channel` (every PR)"
    },
    {
      "id": "G8",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "...and by `BroadcastBus.publish`",
      "status": "verified",
      "evidence": "`test_broadcast.mojo:test_bus_publish_method_rejects_reserved_channel` (every PR)"
    },
    {
      "id": "G9",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "API key authentication, length-checked so a repeated key fails",
      "status": "verified",
      "evidence": "`test_auth.mojo:test_a_rotation_of_the_key_is_rejected` (every PR)"
    },
    {
      "id": "G10",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "CORS, configurable",
      "status": "verified",
      "evidence": "`Smoke test the notes API` (every PR)"
    },
    {
      "id": "G11",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "`X-Forwarded-*` / `Forwarded` parsing with a trusted-proxy allowlist",
      "status": "out of scope",
      "evidence": "the server never consults them \u2014 `REMOTE_ADDR` is the socket peer and `wsgi.url_scheme` is configuration, so there is nothing to spoof"
    },
    {
      "id": "G12",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "PROXY protocol v1/v2",
      "status": "out of scope",
      "evidence": "same reason: the peer address is taken from the socket"
    },
    {
      "id": "G13",
      "section": "G",
      "category": "G. Security hardening",
      "capability": "Parser fuzzing in CI",
      "status": "verified",
      "evidence": "`Fuzz the request decoder` (every PR) \u2014 20k mutations of a seed corpus against `parse_request_headers` and the chunked decoder, replayable from the seed it prints; asserts determinism, that an INVALID request cannot become valid by appending, that a parsed one is unchanged by bytes after it, and that the decoder's counts index its buffer. `poe fuzz-request-long` is the release sweep (8 seeds x 250k). The run refuses to pass on thin coverage, and `Sabotage the decoder invariants the fuzzer checks` breaks each invariant so \"no findings\" cannot mean \"checks nothing\""
    },
    {
      "id": "H1",
      "section": "H",
      "category": "H. TLS",
      "capability": "TLS 1.2 / 1.3 termination",
      "status": "out of scope",
      "evidence": "terminate at a proxy \u2014 gunicorn's answer, and the same one applies here"
    },
    {
      "id": "H2",
      "section": "H",
      "category": "H. TLS",
      "capability": "ALPN, SNI, mTLS, OCSP stapling, certificate hot-reload",
      "status": "out of scope",
      "evidence": "all follow from not terminating TLS"
    },
    {
      "id": "I1",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "WebSocket handshake (RFC 6455), `Sec-WebSocket-Accept`",
      "status": "verified",
      "evidence": "`Smoke test the WebSocket echo demo` (every PR)"
    },
    {
      "id": "I2",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Fragmented messages reassembled",
      "status": "verified",
      "evidence": "`test_websocket.mojo:test_fragmented_message_assembles` (every PR)"
    },
    {
      "id": "I3",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Ping/pong, and a server heartbeat on a cadence",
      "status": "verified",
      "evidence": "`Smoke test the WebSocket echo demo` (every PR)"
    },
    {
      "id": "I4",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Close frame echoed with its code, connection marked for close",
      "status": "verified",
      "evidence": "`test_websocket.mojo:test_close_is_echoed_with_code_then_closes` (every PR)"
    },
    {
      "id": "I5",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Invalid UTF-8 in a text frame closes 1007",
      "status": "verified",
      "evidence": "`test_websocket.mojo:test_invalid_utf8_text_closes_1007` (every PR)"
    },
    {
      "id": "I6",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "A fragmented control frame is a protocol error",
      "status": "verified",
      "evidence": "`test_websocket.mojo:test_fragmented_control_frame_is_protocol_error` (every PR)"
    },
    {
      "id": "I7",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Wrong `Sec-WebSocket-Version` answers 426 advertising 13",
      "status": "verified",
      "evidence": "`test_websocket.mojo:test_wrong_version_is_426_advertising_13` (every PR)"
    },
    {
      "id": "I8",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Cross-worker WebSocket fan-out over the broadcast bus",
      "status": "verified",
      "evidence": "`Smoke test the WebSocket chat demo` (every PR)"
    },
    {
      "id": "I9",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Server-Sent Events, with heartbeats and disconnect cleanup",
      "status": "verified",
      "evidence": "`Smoke test the Datastar counter` (every PR)"
    },
    {
      "id": "I10",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "`Last-Event-ID` replay from a bounded journal",
      "status": "verified",
      "evidence": "`Smoke test the Datastar todo demo` (every PR)"
    },
    {
      "id": "I11",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "A synchronous view gating a held SSE connection, with cross-worker publish",
      "status": "verified",
      "evidence": "`Smoke test the Django realtime example` (every PR) \u2014 `--realtime`"
    },
    {
      "id": "I12",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "A synchronous view gating a held WebSocket it never speaks",
      "status": "verified",
      "evidence": "`Smoke test the Django realtime example over WebSockets` (every PR)"
    },
    {
      "id": "I18",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "N holds taken AT ONCE from a pool, and a publish reaching all of them",
      "status": "verified",
      "evidence": "`Concurrent --realtime holds from a pool` (every PR) \u2014 the other realtime rows subscribe sequentially, so this is the only one where more than one hold is in flight; the probe's own self-test gates it, because the result it reports is a negative"
    },
    {
      "id": "I19",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Inbound WebSocket data larger than one socket read",
      "status": "verified",
      "evidence": "`Inbound WebSocket messages survive a stalled client` (every PR) \u2014 the WebSocket read path took one `recv` per event with no re-arm, A13's defect in the one path nothing had sent a large inbound burst to; invisible on kqueue's level trigger, and on epoll only once the client STOPS sending"
    },
    {
      "id": "I13",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "Autobahn|Testsuite conformance run, wired to a cadence",
      "status": "verified",
      "evidence": "`autobahn` (pre-release) \u2014 sections driven separately against the runner's pure-echo ASGI app, image version-pinned so the per-section case counts are asserted exactly; compared both directions against the pinned baseline (240/247, every failure I17's cap): a new failure is red, and an I17 case unexpectedly passing is red too. The comparator's selftest runs first. What the suite cannot see stays L15's territory \u2014 its client always closes first (ROADMAP: A conformance-suite tier)"
    },
    {
      "id": "I14",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "`permessage-deflate`",
      "status": "out of scope",
      "evidence": "follows from having no response compression"
    },
    {
      "id": "I15",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "WebSocket over HTTP/2 (RFC 8441)",
      "status": "out of scope",
      "evidence": "follows from having no HTTP/2"
    },
    {
      "id": "I16",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "A Close frame's code is VALIDATED, not just echoed",
      "status": "verified",
      "evidence": "`test_websocket.mojo:test_reserved_close_codes_are_refused_1002` (every PR) \u2014 with `test_legal_close_codes_are_still_echoed` as the other half, so a refusal that refuses everything cannot pass"
    },
    {
      "id": "I17",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "A message at or above the outbox cap ends the connection",
      "status": "verified",
      "evidence": "`Smoke test the outbox cap ending a connection` (every PR) \u2014 the marker sent after the oversized message must never arrive, which is what separates ending the connection from dropping a frame the peer cannot know it missed; the under-cap half stops a server that ended every large-message connection from passing. Deliberate, and what Autobahn scores as 7 failures plus all of its performance section. `poe sabotage-outbox-cap` (pre-release) reverts each of the four rules"
    },
    {
      "id": "I20",
      "section": "I",
      "category": "I. WebSocket and Server-Sent Events",
      "capability": "A synchronous Flask view gating a held SSE stream and a WebSocket, with cross-worker publish",
      "status": "verified",
      "evidence": "`Smoke test the Flask realtime views` (every PR) \u2014 the headline names Flask, and K10 only proves plain WSGI. The file under test is extracted from QUICKSTART.md's own fenced block, so it is the one a reader types; the Django rows' RFC 6455 probe drives it unchanged (its gate phase off: the quickstart's views take no token), one stream and one socket pinned per worker under `--workers 2`, so a message sent on one worker's socket reaches a Flask view and comes back on the other worker's. The quickstart runs the same file from the wheel with curl alone (M10)"
    },
    {
      "id": "J1",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "Zero-copy `sendfile`, body never entering the process",
      "status": "verified",
      "evidence": "`Smoke test zero-copy static file serving` (every PR) \u2014 `--static`"
    },
    {
      "id": "J2",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "Byte range served as 206 with `Content-Range`",
      "status": "verified",
      "evidence": "`test_static.mojo:test_range_serves_206_with_content_range` (every PR)"
    },
    {
      "id": "J3",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "Unsatisfiable range answered 416 carrying the total",
      "status": "verified",
      "evidence": "`test_static.mojo:test_range_unsatisfiable_is_416_with_total` (every PR)"
    },
    {
      "id": "J4",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "`If-None-Match` takes precedence over a range",
      "status": "verified",
      "evidence": "`test_static.mojo:test_if_none_match_beats_range` (every PR)"
    },
    {
      "id": "J5",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "`If-Range` with a weak ETag serves the full body",
      "status": "verified",
      "evidence": "`test_static.mojo:test_if_range_with_weak_etags_serves_full` (every PR)"
    },
    {
      "id": "J6",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "ETag and conditional 304",
      "status": "verified",
      "evidence": "`Smoke test the notes API` (every PR)"
    },
    {
      "id": "J7",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "`Cache-Control`, configurable",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--static-cache-control`"
    },
    {
      "id": "J8",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "Response compression (gzip, brotli, zstd)",
      "status": "out of scope",
      "evidence": "recorded in ROADMAP as deliberate: no dynamic compression; a proxy compresses"
    },
    {
      "id": "J9",
      "section": "J",
      "category": "J. Static file serving",
      "capability": "Precompressed sidecar files (`.br`, `.gz`)",
      "status": "out of scope",
      "evidence": "follows from the row above"
    },
    {
      "id": "K1",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "`application(environ, start_response)` against a bare callable",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "K2",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "`wsgiref.validate` pass, with an engagement canary",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "K3",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "The `write()` callable reaches the client, in production order",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "K4",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "A second `start_response`, with and without `exc_info`",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "K5",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "`wsgi.input` read, readline, iteration, and read past EOF",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "K6",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "`QUERY_STRING` raw while `PATH_INFO` is decoded",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "K7",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "`close()` called on the response iterable",
      "status": "verified",
      "evidence": "`Conformance test the WSGI bridge` (every PR)"
    },
    {
      "id": "K8",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "Correct `wsgi.multithread` / `wsgi.multiprocess` for the real topology",
      "status": "verified",
      "evidence": "`Smoke test the Django WSGI example` (every PR)"
    },
    {
      "id": "K9",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "Unsized iterables streamed from a pool thread, sized bodies buffered",
      "status": "verified",
      "evidence": "`Smoke test streamed WSGI bodies` (every PR)"
    },
    {
      "id": "K10",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "Framework-neutral: one contract, two frameworks",
      "status": "verified",
      "evidence": "`Run the WSGI framework contract against Flask` (every PR)"
    },
    {
      "id": "K11",
      "section": "K",
      "category": "K. WSGI (PEP 3333)",
      "capability": "The hold headers degrade under another WSGI server: the same view answers a short plain response",
      "status": "verified",
      "evidence": "`Execute the quickstart` (every PR) \u2014 the quickstart's Django file under gunicorn: `/events` answers 200 with the view's body and closes inside curl's deadline (held, it would not), the upgrade request answers 200 rather than 101, and `publish()` reports 0 workers without raising. The README's \"degrades, not breaks\" sentence, executed"
    },
    {
      "id": "L1",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Single `app(scope, receive, send)`, protocol detected from the object",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR) \u2014 `--protocol`"
    },
    {
      "id": "L2",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "`http` scope shape, validated against the spec",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR)"
    },
    {
      "id": "L3",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "`websocket` scope: connect, accept, receive, send, close",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR)"
    },
    {
      "id": "L4",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "`lifespan` startup and shutdown, degrading if unsupported",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR)"
    },
    {
      "id": "L5",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "`lifespan.state` shallow-copied into each request scope",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR)"
    },
    {
      "id": "L6",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Streaming responses stream, credit-gated per stream and in total",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR)"
    },
    {
      "id": "L7",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Slot ownership across recycled connections, sabotage-proven",
      "status": "verified",
      "evidence": "`Run unit tests` (every PR) \u2014 `poe test-shim` drives the extracted shim through real socketpairs and reverts each rule"
    },
    {
      "id": "L8",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "The event loop running inside asyncio (`M0_INVERTED`)",
      "status": "verified",
      "evidence": "`Smoke test the ASGI executor under the loop inversion` (every PR)"
    },
    {
      "id": "L9",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Slot ownership under CPU contention, on the streamed AND WebSocket paths, in both loop modes",
      "status": "verified",
      "evidence": "`stress-asgi` (pre-release) \u2014 each round runs `chunked_keepalive.py` then `ws_probe.py`, so the handshake lands on the slot the streamed connection just released; run under CPU hogs on the pump and again under `M0_INVERTED=1`"
    },
    {
      "id": "L10",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Django's own ASGI handler through the executor",
      "status": "verified",
      "evidence": "`Serve a Django ASGI project through the executor` (every PR)"
    },
    {
      "id": "L11",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Starlette-family app (FastHTML) through the executor",
      "status": "verified",
      "evidence": "`Serve a FastHTML app through the ASGI bridge` (every PR)"
    },
    {
      "id": "L12",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Cross-worker pub/sub as `scope[\"state\"][\"m0\"]`",
      "status": "verified",
      "evidence": "`ASGI cross-worker fan-out over the BroadcastBus` (every PR)"
    },
    {
      "id": "L13",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "`http.response.pathsend`",
      "status": "out of scope",
      "evidence": "`--static` serves files in Mojo ahead of the application, which is the same saving without the extension"
    },
    {
      "id": "L14",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "`http.response.zerocopysend`, `early_hint`, `trailers`",
      "status": "out of scope",
      "evidence": "no application has asked; the extensions are additive and can be taken later"
    },
    {
      "id": "L15",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "An app-initiated close ends in a FIN, not an RST (RFC 6455 \u00a75.5.1's order)",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR) \u2014 `ws_probe.py` runs 64 concurrent app-initiated closes and requires every one to end in a clean FIN; concurrency is what widens the window, so one close at a time would pass on the broken server"
    },
    {
      "id": "L16",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "...and the wait for the peer's reply is BOUNDED, so a peer that never answers does not hold its slot",
      "status": "verified",
      "evidence": "`Smoke test the idle connection timeout` (every PR) \u2014 the linger used to re-arm on every loop pass, which held the slot for the life of the process; L15 alone passes on that server"
    },
    {
      "id": "L18",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "ASGI on a free-threaded CPython build is refused with exit 78, naming modular/modular#5726",
      "status": "verified",
      "evidence": "`py-canary` (weekly) \u2014 `smoke-django-realtime` phase 6 on 3.14t: the executor's Python type cannot be built there (the stdlib lays `PyObject` out for the GIL build), so the mixed server exits 78 alone, through `--doctor`, and under `--workers 2` without a respawn; on the pinned GIL interpreter the same phase runs the full mixed server"
    },
    {
      "id": "L17",
      "section": "L",
      "category": "L. ASGI 3.0",
      "capability": "Inbound `websocket.receive` is flow-controlled: a stalled client is throttled, never silently dropped",
      "status": "verified",
      "evidence": "`Inbound WebSocket messages survive a stalled client` (every PR) \u2014 the loop suspends the read rather than discarding what the executor cannot take; a concurrently-reading client loses nothing even on the broken build, so the gate stalls first and only then reads"
    },
    {
      "id": "M1",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Several applications in one process, routed by prefix",
      "status": "verified",
      "evidence": "`Serve two mounted applications from one process` (every PR) \u2014 `--mount`"
    },
    {
      "id": "M2",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Flags over environment over defaults",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--host`, `--port`, `--workers`, `--threads`, `--blocking-threads`"
    },
    {
      "id": "M3",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Application discovery from a bare module name",
      "status": "verified",
      "evidence": "`Conformance test the ASGI bridge` (every PR)"
    },
    {
      "id": "M4",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "`--app-dir` prepended to `sys.path`, shadowing an installed package",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--app-dir`"
    },
    {
      "id": "M5",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Usage errors exit 2, startup errors exit 1, refusals exit 78",
      "status": "verified",
      "evidence": "`Smoke test --doctor against the server's own exit codes` (every PR)"
    },
    {
      "id": "M6",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "`--help` names every documented flag; `--version` matches the release",
      "status": "verified",
      "evidence": "`Smoke test the serve CLI` (every PR) \u2014 `--help`, `--version`"
    },
    {
      "id": "M7",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Installable wheel with no toolchain and no dependencies",
      "status": "verified",
      "evidence": "`Build and smoke test the installable wheel` (every PR)"
    },
    {
      "id": "M8",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "The aarch64 wheel built and served on arm64 hardware",
      "status": "verified",
      "evidence": "`Build and smoke test the aarch64 wheel` (every PR)"
    },
    {
      "id": "M9",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "C-ABI shared library loadable by `dlopen`/`ctypes`",
      "status": "verified",
      "evidence": "`Smoke test the C-ABI shared library` (every PR)"
    },
    {
      "id": "M10",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "The documented quickstart is executed, not asserted",
      "status": "verified",
      "evidence": "`Execute the quickstart` (every PR)"
    },
    {
      "id": "M11",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Correct signal handling as PID 1 in a container",
      "status": "verified",
      "evidence": "`Smoke test SIGTERM delivered to PID 1 in a container` (every PR) \u2014 the wheel exec'd as PID 1 in `python:3.12-slim` (checked via `/proc/1/cmdline`, not trusted); `docker stop` must be the drain's exit 0 well inside the grace, never SIGKILL at the deadline, alone and as a supervisor reaping two workers whose exits must be clean rather than by the propagated signal"
    },
    {
      "id": "M12",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Configuration from a TOML file",
      "status": "out of scope",
      "evidence": "flags and `M0_*` environment variables cover it; a third source is a third precedence rule"
    },
    {
      "id": "M13",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "systemd socket activation (`LISTEN_FDS`)",
      "status": "out of scope",
      "evidence": "no request for it. The old reason said `SO_REUSEPORT` covered the restart case, which is not true for anyone running `m0serve`: no flag or variable enables it (D6). What a restart here does get is the supervisor's graceful drain, so in-flight work finishes; a listener that outlives the process is a different property and nothing has asked for it"
    },
    {
      "id": "M14",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "An HTTP client in Mojo, for server-to-server calls",
      "status": "verified",
      "evidence": "`Smoke test the HTTP client` (every PR)"
    },
    {
      "id": "M15",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "Windows, musl",
      "status": "out of scope",
      "evidence": "no Mojo toolchain for either \u2014 see the platform table in README.md"
    },
    {
      "id": "M16",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "No second process: the running server is one process tree of m0serve binaries, and the wheel requires nothing",
      "status": "verified",
      "evidence": "`Execute the quickstart` (every PR) \u2014 under `--workers 2`, `pgrep -x m0serve` counts exactly a supervisor and two workers (the console script `execve`s, so no Python parent survives), and `pip show m0serve` lists an empty `Requires:`. The exact count is the self-test: a check that only looks for a broker it does not expect passes on an empty machine"
    },
    {
      "id": "M17",
      "section": "M",
      "category": "M. Deployment and operations",
      "capability": "The live demo: the quickstart's shape as a public page with per-visitor channels and rate and size limits, served from its deploy image",
      "status": "verified",
      "evidence": "`Smoke test the live demo's deploy image` (every PR) \u2014 `deploy/demo/Dockerfile` built from the tree's own wheel and probed through a published port by `scripts/demo_probe.py`: a first visitor is handed a token cookie and the page names the served version; without the cookie the hold views answer 403 and a foreign-`Origin` upgrade is refused; one publish reaches a second stream on the visitor's channel and a stranger's stream hears nothing for a measured silence; a WebSocket frame comes back to the socket and to the streams; a message over the cap is 413 and a burst meets 429 with `Retry-After` after the first LIMIT attempts and within workers\u00d7LIMIT+1; m0serve is PID 1 by `/proc/1/cmdline` and `docker stop` drains to exit 0 with held connections open. The same probe, pointed at a URL instead of the image, verifies the live deploy"
    }
  ]
}