alkhttp

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
glm-5.3-flash	802d94ec07	docs(review 007 Unit 2): WS-31 discovery-shadowing note + record corrections - WS-31: websocket.md §"Data channels for browsers" + ADR-067's landed note record that WS-session discovery is the bootstrap set — the hook's bootstrap `services/` registrations overwrite a base-registry `services/` registration on the WS path by design (a deployment's custom `services/list` is shadowed on WS sessions only). - ADR-048's landed note: correction + completion — the WS-26 retention sentence was aspirational at the landed commit (WS-28) and is now real; the UP-02 posture's override half is now an explicit surface (`with_ws_op_register_acl` / `OpRegisterAcl`), with the note that `ChannelsPolicy` could not carry an op ACL. - ADR-067's landed note: review-007 notes (WS-28 fix + gate, WS-29 surface, WS-31 record). - OQ-05 resolution: the retention claim carries the WS-28 correction. - review-006 UP-02 log + WS-26 paragraph: corrections marking what the pre-fix tree did not have, with the landed remediation named. - review-002 WS-17: the "bounded at 64 sessions" claim corrected — the bare-registry semaphore was per-request and bounded nothing; `SessionSlots` is the shared-cap surface. - review-007 status: open for remediation → remediated, with the decisions taken (both "implement" options) and the gate names. Verification: cargo test 454 passed / 0 failed; cargo doc --no-deps clean (6 pre-existing warnings, identical at baseline). Review: docs/reviews/007-ws-data-channel-surface-review.md	2026-09-05 05:45:31 +00:00
glm-5.3-flash	e2c255d40c	docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up) Decomposition of docs/reviews/002-post-remediation-review.md per its 5-unit remediation plan: - Unit 1 (security-critical): gw15-publish-body-cap, prj16-schema-via-call (CF-004 filed alkcall-side), fwd13-dot-segments, fwd16-missing-capability, oai11-ref-memoization - Unit 2 (timeout/terminality): ws13-idle-progress, fwd15-stream-timeout, cli01-retry-after-budget, con17-mcp-pagination, con18-wss-sweep-exit - Unit 3 (projection/docs): projection-truthfulness, mcp-batch-cap, gw16-status-drift - Unit 4 (spec-import): yaml-normalization, oai13-path-item-wildcards, import-loudness-cluster, js01-placeholder-check, fwd17-19-contract-decisions - Unit 5 (WS polish + tests): con18b-ws-polish, client-policy-wire-tests, cov-deployment-knobs, cov13-dead-code, srv11-srv12-router-ordering - review-002-bracketed-followup: tentatively planned post-bulk pass (stale-check, OQA-18 enforcement decision, CON-08/09 close() lever, cross-crate re-checks) — deliberately not serialized against the bulk Also: review-002 numbering repair (CON-14 was double-booked; MCP pagination now CON-14, from_wss monitor renumbered CON-18, missing CON-14 section added). taskgraph: 66 valid, no cycles; 24 pending (all review-002); gen-1/gen-2 parallel waves identified; workflow-cost hotspots are prj16 (12.8) and ws13 (11.1), both carrying the reviewed slicing guidance in their Notes.	2026-08-30 10:50:34 +00:00
glm-5.3-flash	5452785f0d	docs(review 002): post-remediation review — 40 findings across 6 passes + coverage analysis Review 002 of the post-remediation tree (`91483a7`): six parallel subsystem passes + coverage analysis, consolidated with direct source re-verification of all consequential findings. - Regression check: 76/82 review-001 findings verified FIXED; residuals filed as new findings (SRV-11/SRV-12, WS-13, CON-14, OAI-10..19, JS-01..03, PRJ-16..24, CLI-01..03, FWD-13..19, GW-15..17) - Critical-class: GW-15 (unbounded /publish body), OAI-11 (exponential $ref expansion hangs import) - Security: PRJ-16 (Internal op schema disclosure via services/schema over /call), FWD-13 (lone .. path escape with credentials) - Coverage: 94.87% regions; redirect policy 100% dark (top gap), forward_stream terminal arms dark, COV-13 dead code batch Headline counts: 5 major security/availability, 6 major correctness, 23 minor, 2 info; 2 agent findings rejected at verification.	2026-08-30 09:52:10 +00:00

802d94ec07

docs(review 007 Unit 2): WS-31 discovery-shadowing note + record corrections

- WS-31: websocket.md §"Data channels for browsers" + ADR-067's landed
  note record that WS-session discovery is the bootstrap set — the
  hook's bootstrap `services/*` registrations overwrite a
  base-registry `services/*` registration on the WS path by design
  (a deployment's custom `services/list` is shadowed on WS sessions
  only).
- ADR-048's landed note: correction + completion — the WS-26
  retention sentence was aspirational at the landed commit (WS-28) and
  is now real; the UP-02 posture's override half is now an explicit
  surface (`with_ws_op_register_acl` / `OpRegisterAcl`), with the
  note that `ChannelsPolicy` could not carry an op ACL.
- ADR-067's landed note: review-007 notes (WS-28 fix + gate, WS-29
  surface, WS-31 record).
- OQ-05 resolution: the retention claim carries the WS-28 correction.
- review-006 UP-02 log + WS-26 paragraph: corrections marking what the
  pre-fix tree did not have, with the landed remediation named.
- review-002 WS-17: the "bounded at 64 sessions" claim corrected —
  the bare-registry semaphore was per-request and bounded nothing;
  `SessionSlots` is the shared-cap surface.
- review-007 status: open for remediation → remediated, with the
  decisions taken (both "implement" options) and the gate names.

Verification: cargo test 454 passed / 0 failed; cargo doc --no-deps
clean (6 pre-existing warnings, identical at baseline).

Review: docs/reviews/007-ws-data-channel-surface-review.md

2026-09-05 05:45:31 +00:00

glm-5.3-flash

e2c255d40c

docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up)

Decomposition of docs/reviews/002-post-remediation-review.md per its
5-unit remediation plan:

- Unit 1 (security-critical): gw15-publish-body-cap,
  prj16-schema-via-call (CF-004 filed alkcall-side), fwd13-dot-segments,
  fwd16-missing-capability, oai11-ref-memoization
- Unit 2 (timeout/terminality): ws13-idle-progress,
  fwd15-stream-timeout, cli01-retry-after-budget, con17-mcp-pagination,
  con18-wss-sweep-exit
- Unit 3 (projection/docs): projection-truthfulness, mcp-batch-cap,
  gw16-status-drift
- Unit 4 (spec-import): yaml-normalization, oai13-path-item-wildcards,
  import-loudness-cluster, js01-placeholder-check,
  fwd17-19-contract-decisions
- Unit 5 (WS polish + tests): con18b-ws-polish,
  client-policy-wire-tests, cov-deployment-knobs, cov13-dead-code,
  srv11-srv12-router-ordering
- review-002-bracketed-followup: tentatively planned post-bulk pass
  (stale-check, OQA-18 enforcement decision, CON-08/09 close() lever,
  cross-crate re-checks) — deliberately not serialized against the
  bulk

Also: review-002 numbering repair (CON-14 was double-booked; MCP
pagination now CON-14, from_wss monitor renumbered CON-18, missing
CON-14 section added).

taskgraph: 66 valid, no cycles; 24 pending (all review-002);
gen-1/gen-2 parallel waves identified; workflow-cost hotspots are
prj16 (12.8) and ws13 (11.1), both carrying the reviewed slicing
guidance in their Notes.

2026-08-30 10:50:34 +00:00

glm-5.3-flash

5452785f0d

docs(review 002): post-remediation review — 40 findings across 6 passes + coverage analysis

Review 002 of the post-remediation tree (91483a7): six parallel
subsystem passes + coverage analysis, consolidated with direct source
re-verification of all consequential findings.

- Regression check: 76/82 review-001 findings verified FIXED; residuals
  filed as new findings (SRV-11/SRV-12, WS-13, CON-14, OAI-10..19,
  JS-01..03, PRJ-16..24, CLI-01..03, FWD-13..19, GW-15..17)
- Critical-class: GW-15 (unbounded /publish body), OAI-11 (exponential
  $ref expansion hangs import)
- Security: PRJ-16 (Internal op schema disclosure via services/schema
  over /call), FWD-13 (lone .. path escape with credentials)
- Coverage: 94.87% regions; redirect policy 100% dark (top gap),
  forward_stream terminal arms dark, COV-13 dead code batch

Headline counts: 5 major security/availability, 6 major correctness,
23 minor, 2 info; 2 agent findings rejected at verification.

2026-08-30 09:52:10 +00:00