v0.1.1057 Aug 2026·Networking, Media, Privacy & Shields

HTTP/2: the modern web transport, from scratch

Floati's network stack spoke only HTTP/1.1. Every modern site is served over HTTP/2, so an h1-only client pays a connection and header-size tax the whole way. This release adds a real HTTP/2 client, built from scratch: HPACK header compression (RFC 7541), the binary frame layer (RFC 7540), a synchronous single-stream client with real flow control, and ALPN so the browser negotiates h2 automatically and falls back to h1. It is proven end to end: the HPACK codec passes the RFC's own conformance vectors byte for byte, a local deterministic h2 test server round-trips a request in the gate, and it really fetches from large public resolvers over h2 (including a 1.3 MB body, which exercises flow control past the 64 KB window). The innovation is HPACK that is bomb-free BY CONSTRUCTION: the decoder's dynamic table can never exceed the negotiated size, its output is hard-bounded so a decompression bomb has no blast radius, and encode-then-decode is proven to be the identity over 2000 generated header lists - all as gate invariants, not example tests. Networking moves 46 to 52; overall 50 to 51, as HTTP/2 was one of the named parity floors and it has now landed tested. Research note: docs/http2-transport.md.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 3 changes

Media	Added a from-scratch HTTP/2 client: HPACK compression (RFC 7541 - integer/string primitives, Huffman, the 61-entry static table, and a dynamic table with eviction), the binary frame codec (RFC 7540 - DATA/HEADERS/SETTINGS/WINDOW_UPDATE/RST_STREAM/GOAWAY/PING/CONTINUATION), and a synchronous single-stream connection with preface + SETTINGS exchange, HEADERS+CONTINUATION reassembly, and real connection/stream flow control. The browser now negotiates h2 via TLS ALPN and falls back to HTTP/1.1, transparently to everything above the socket.
Media	HTTP/2 is proven, not asserted: the HPACK codec replays the RFC 7541 Appendix C conformance vectors byte for byte (including the Huffman and dynamic-table-eviction cases), a local deterministic in-process h2 server round-trips a real request/response in the gate, and a live test fetches large public resolvers over h2 and reassembles their full bodies. It correctly discards 1xx informational responses (a large network provider sends 103 Early Hints before the real status). Workspace tests and the 6375/6375 conformance gate stay green.
Privacy & Shields	The HPACK decoder is decompression-bomb-proof by construction, a stronger guarantee than a corpus of example tests: its dynamic table can never exceed the size the connection negotiated (eviction runs on every insert), its decoded output is hard-capped so a crafted stream cannot inflate memory, and encode-then-decode is a proven bijection over two thousand generated header lists. These hold for every input, as machine-checked invariants in the gate.