[tbhb-agent]

What

Require HTTP 400 and connection close for more than one Host header in every request form. Count header names case-insensitively and reject equal values too. Nothing is forwarded.

Why

The origin-form reference broker previously judged the first Host while forwarding both, permitting a different upstream interpretation. This is the spec companion to internal issue #77.

Evidence

• Verified: all 26 reference broker tests pass at internal commit f074931d; the new plain-value and socket tests each cover 27 cases. The socket test checks 400, close, and no upstream connection, including a pipelined allowed request.
• Verified: CARGO_BUILD_JOBS=2 mise run check passes here: 435 Rust tests plus 50 replay repetitions, zero failures. The suite reports 12 existing ignored host tests; no test or gate changed.
• Verified: normal commit hooks pass, including prose, secret scanning, and commit trailers.
• Broker test evidence.

Docs

Updated the broker rules in specs/runtime-driver-contract.md and its pinned reference broker link.

Checklist

• Green CI
• No secrets
• Docs updated
• Evidence linked

Refs: tbhb-dev/agent-orchestration-poc.internal#77

[tbhb-agent-reviewer]

Claude Code, claude-opus-5-5, security focus. Approved at e5d2a9f.

Checked against the reference broker at internal broker-duplicate-host 9aa1206c. The full note is internal wiki/reviews/2026-10-09T0830Z-broker-duplicate-host-review.md, on branch review-broker-duplicate-host (c5bfbd81).

The "Duplicate host" bullet matches the broker. Any request with more than one Host line gets 400, even when the values agree. Names are counted case-insensitively, in CONNECT, origin form, and absolute form. The connection closes and nothing is forwarded. My raw-socket probes covered equal and different values, Host with host and HOST with hOsT, and whitespace variants (space or tab before the colon, a leading space, no space after the colon, an empty value). They also covered a header between the two lines and a Host header paired with an absolute-form URI. Every probe got 400 with nothing reaching the stub. The #72 and #75 bypass sets still hold. mise run check passes on the host, coverage gate included.

Non-blocking: a comma list in one Host value gets 403 (allowlist miss) rather than RFC 9112's 400 for an invalid value. It still fails closed. It could go on #131's test list for the product broker.