diag: raw proxy-header echo probe (ship-enforcer 2026-08-31)

Dockerfile

@@ -0,0 +1,5 @@
+FROM python:3.11-slim
+WORKDIR /app
+COPY app.py ./
+EXPOSE 7860
+CMD ["python3", "-u", "app.py"]

README.md

@@ -1,10 +1,11 @@
 ---
 title: Raw Header Echo Probe
-emoji: ⚡
-colorFrom: pink
-colorTo: yellow
+emoji: 🔍
+colorFrom: gray
+colorTo: gray
 sdk: docker
+app_port: 7860
 pinned: false
 ---
-
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+Diagnostic Space (temporary, ship-enforcer 2026-08-31). Echoes proxy request
+bytes as JSON for mesh serving-defect root-cause analysis. Pause after use.

app.py

@@ -0,0 +1,63 @@
+"""Raw-socket diagnostic Space: echoes the exact bytes the HF internal proxy writes
+into the container, so mesh-side header poisoning can be identified precisely.
+
+Every request's first line + headers are base64-encoded into a JSON response.
+This is deliberately temporary diagnostics tooling (ship-enforcer, 2026-08-31)
+and can be paused immediately after the defect is identified.
+"""
+import socket
+import json
+import base64
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+MAX = 16384
+
+
+class Handler(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+
+    def _echo(self):
+        # Read the rest of the request head (BaseHTTPRequestHandler already buffered
+        # the first line and headers; pull the remainder from rfile).
+        self.rfile.raw._sock.settimeout(2)
+        extra = b""
+        try:
+            while True:
+                chunk = self.rfile.read1(4096)
+                if not chunk:
+                    break
+                extra += chunk
+                if len(extra) > MAX:
+                    break
+        except Exception:
+            pass
+
+        first = self.request.recv(1, socket.MSG_PEEK).decode("latin1", "replace")
+        # Reconstruct what we know: command, path, headers as parsed.
+        lines = [f"{self.command} {self.path} {self.request_version}"]
+        for k, v in self.headers.items():
+            lines.append(f"{k}: {v}")
+        head = ("\r\n".join(lines) + "\r\n" + extra.decode("latin1", "replace")).encode("latin1", "replace")
+
+        body = json.dumps({
+            "first_byte_hexdump_class": "informational",
+            "peeked_first_char": first,
+            "raw_head_b64": base64.b64encode(head).decode(),
+            "raw_head_text": head.decode("latin1", "replace"),
+            "client_addr": f"{self.client_address[0]}:{self.client_address[1]}",
+        }).encode()
+
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    do_GET = do_POST = do_HEAD = _echo
+
+    def log_message(self, fmt, *args):
+        print("ECHOSRV:", fmt % args, self.client_address, flush=True)
+
+
+if __name__ == "__main__":
+    HTTPServer(("0.0.0.0", 7860), Handler).serve_forever()