alkdev/alkhttp
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(tasks): mark fwd16, fwd13, cli01 completed

Browse Source
This commit is contained in:
glm-5.3-flash
2026-08-31 00:23:46 +00:00
parent d5446c2780
commit a7f10ed04c
3 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/adapters/review-002-fwd13-dot-segments.md
+6 -2
View File
@@ -1,7 +1,7 @@
--- ---
id: review-002-fwd13-dot-segments id: review-002-fwd13-dot-segments
name: Reject lone dot-dot path values that Url-set_path normalizes away (FWD-13) name: Reject lone dot-dot path values that Url-set_path normalizes away (FWD-13)
status: pending status: completed
depends_on: [] depends_on: []
scope: narrow scope: narrow
risk: medium risk: medium
@@ -64,4 +64,8 @@ spec/content leakage beyond the parameter name — follow the existing
message style in `render_path_template`'s unbound-placeholder error). message style in `render_path_template`'s unbound-placeholder error).
FWD-18 (object/array placeholder values double-routing to query) is FWD-18 (object/array placeholder values double-routing to query) is
tracked separately in review-002-fwd17-19-contract-decisions — do not tracked separately in review-002-fwd17-19-contract-decisions — do not
fold it here, the mechanisms are adjacent but the decisions differ. fold it here, the mechanisms are adjacent but the decisions differ.
## Summary
Lone ./.. (and %2e spellings) path values rejected INVALID_INPUT at value_to_path_segment; post-set_path normalization invariant in assemble_request_url; url 2.5.8 normalization empirically pinned; dotted-value legitimacy + segment-survival corpus tests.
tasks/adapters/review-002-fwd16-missing-capability.md
+6 -2
View File
@@ -1,7 +1,7 @@
--- ---
id: review-002-fwd16-missing-capability id: review-002-fwd16-missing-capability
name: Loud error on missing capability instead of silent unauthenticated request (FWD-16) name: Loud error on missing capability instead of silent unauthenticated request (FWD-16)
status: pending status: completed
depends_on: [] depends_on: []
scope: narrow scope: narrow
risk: low risk: low
@@ -67,4 +67,8 @@ succeed without the assembly layer changing. If a deployment legitimately
runs authed-ops with *optionally*-present credentials (none known runs authed-ops with *optionally*-present credentials (none known
today), that would be a new config flag — do not preemptively add one; today), that would be a new config flag — do not preemptively add one;
the invariant (ADR-014: credentials flow only via Capabilities) argues the invariant (ADR-014: credentials flow only via Capabilities) argues
loud-and-closed. loud-and-closed.
## Summary
Silent missing-capability arm now fails with INTERNAL naming both key forms (api_key:/http_token:) and refusing the unauthenticated send; module doc loud-missing-matrix paragraph; 3 tests incl. a zero-upstream-requests wire test. Two pre-existing no-env-vars tests updated (they pinned the silent arm).
tasks/client/review-002-cli01-retry-after-budget.md
+6 -2
View File
@@ -1,7 +1,7 @@
--- ---
id: review-002-cli01-retry-after-budget id: review-002-cli01-retry-after-budget
name: Budget-aware Retry-After sleep — stop re-arming a full ceiling per attempt (CLI-01) name: Budget-aware Retry-After sleep — stop re-arming a full ceiling per attempt (CLI-01)
status: pending status: completed
depends_on: [] depends_on: []
scope: narrow scope: narrow
risk: medium risk: medium
@@ -67,4 +67,8 @@ cross-request throttle map (FWD-11's eviction/jitter behavior is
already fixed and correct). The natural seam is threading the budget already fixed and correct). The natural seam is threading the budget
handle into the middleware order so RetryAfter sees it — small, handle into the middleware order so RetryAfter sees it — small,
testable, no public API change (the budget is already a testable, no public API change (the budget is already a
`HttpClientConfig` field). `HttpClientConfig` field).
## Summary
BudgetClock extension anchored per logical request; sleeps truncated to min(deadline, budget); record() keeps earliest deadline, refreshes clamped to hard stop (drop-on-exhaustion). No public API change; tests/retry_after_budget.rs wire tests added.