pporlock Request Lifecycle

pporlock Request Lifecycle A sequence diagram generated by Archify. TLS ClientHello (SNI) exclusions.decide(sni, ip) intercept, or tunnel undecrypted + passthrough record decrypted request evaluate_request: short-circuit rules, then header rules RequestDecision: block · map_local · redirect · mutate · pass forward the mutated request (skipped on short-circuit) response headers evaluate_response_headers, then decide_buffering header mutation · stream or buffer (size, type, wants_body) body, streamed or buffered evaluate_response_body, on a worker thread when heavy (still one core) ResponseDecision + provenance (skipped if streamed or over budget) the response Chrome actually receives record_http(request, response, provenance, timing) flow event → SSE, /flows, MCP list_flows 1 · ClientHello 2-3 · Request 4-5 · Response headers 6 · Response body Record Chrome · browser · Sequence participant Chrome browser mitmproxy Addon · hooks · apply · Sequence participant mitmproxy Addon hooks · apply Rules Engine · evaluator · Sequence participant Rules Engine evaluator Origin · upstream · Sequence participant Origin upstream Capture · ring sink · Sequence participant Capture ring sink Readers · SSE · MCP · panel · Sequence participant Readers SSE · MCP · panel Legend request return security async trace default message

Order is the contract

  • • Six phases in fixed order: clienthello, request short-circuit, request headers, buffering decision, response headers, response body
  • • Header mutations are applied in responseheaders(), because once a response streams its headers are already on the wire
  • • First match wins for short-circuit actions; the origin is never contacted

Stream or buffer

  • • A body is buffered only when some rule wants it, it is under the size cap, and its content type is on the allowlist
  • • A streamed body is never held in memory, so body transforms are recorded as skipped rather than silently not run
  • • Heavy body transforms are handed to a worker thread (PXY-024). That relieves head-of-line blocking on the loop; it does not lift the single-core ceiling (OI-21), and Python hooks ride along on that thread

What gets recorded

  • • The request and response are re-normalized after mutation, so the record shows what was sent and received, not the input
  • • Provenance is built alongside the flow and explains every match, skip, and budget exhaustion
  • • Redaction happens in capture; the ring is what the web UI, DevTools panel, and MCP tools all read