Mirrors the WS-13 progress semantics onto the axum upgrade path with
three integration tests over the real HttpAdapter surface (also the
COV-11b dark-knob gate — with_ws_idle_timeout had no test caller):
the forever-dribble client is evicted with 1001 despite arriving
messages; a productive session round-trips calls across many windows
without eviction; the None knob never evicts a dribbling client.
The router-wide bearer_auth_middleware route_layer wraps every route
registered before the call (axum 0.8 RouteManager semantics, verified
against the vendored axum 0.8.9 source), so it double-wrapped the WS
upgrade route (own ws_bearer_auth layer) and the /mcp nest (own inner
bearer layer) — the token resolved twice per request on both, and the
SRV-10 comment claimed the opposite.
Restructure build_router: /mcp is merged and the WS upgrade route is
registered after the router-wide route_layer, so each keeps exactly one
auth layer. The WS MethodRouter now carries the decoy 405 fallback
explicitly (MethodRouter::route_layer wraps method endpoints, not the
fallback), preserving the SRV-07 decoy shape for wrong-method probes on
/alk/channels. Comments state axum's actual route_layer semantics.
Tests: a counting IdentityProvider pins one resolution per WS upgrade
request and per /mcp initialize (verified to fail with left: 2/3 under
the pre-fix ordering); the 401 enforcement and the WS-path decoy 405
are pinned.
Verification: cargo test (304), cargo test --all-features (376 + 5
integration suites), clippy -D warnings (default + all-features),
cargo fmt --check, cargo doc --no-deps
Decides the WS-13 legitimate-silence question as option (b): 60s of no
chunk progress is an intentional eviction line even for silent
subscriptions; no WS ping/pong keepalive is added because a keepalive
can only rescue app-silence by re-arming the deadline, which reopens
the dribble hole the knob exists to seal. Documented in the byte_adapter
module doc, on DEFAULT_WS_IDLE_TIMEOUT, on the unchanged
HttpAdapter::with_ws_idle_timeout knob, and in websocket.md (new
'Idle-read timeout' section, including the FWD-15 SSE-keepalive
layering note). Deployment posture for long-lived silent sessions:
with_ws_idle_timeout(None) + WsSessions abort + write-side caps.
The WS-01 idle timer reset on WS message arrival, so the forever-dribble
stall (declare a chunk, deliver its payload one byte per message) reset
the deadline forever while the demux stayed parked on the partial chunk;
conversely the reset-on-message rule was the only thing slow-but-alive
sessions survived on.
Semantics: the deadline now resets on demux progress — bytes actually
forwarded into read_tx that complete inbound chunks (the frames the
demux routes), tracked byte-for-byte in line with alkcall's parse walk
(8-byte header -> payload skip). Message arrival without a completed
chunk resets nothing, so the dribble hits the deadline; every completed
chunk (even one per message, slowly) re-arms the window.
Tests (tungstenite path): the forever-dribble eviction with 1001 despite
arriving messages; a productive-progress session that survives across
many windows; the knob-disabled (None) arm; the stall and text/cap arms
unchanged.
http-adapters.md: forwarding-handler step 5 documents the time/bytes
split for Sub forwards (stream client without the total request
timeout, total streamed-bytes cap, read timeout as the staleness
guard); the HTTP Client section documents the two derived clients
(request vs stream), the reqwest 0.13 per-request-override limitation
that forces the derived-client design, and that only the total timeout
differs between them.
http-server.md: the per-endpoint dispatch deadline paragraph now covers
the outbound half — unbounded time, bounded bytes on both the gateway
and the forwarding side (ADR-049/021 note: unbounded time by design for
subscriptions, bounded bytes per subscription).
Verified: cargo doc --no-deps clean, full suite green.
FWD-15: forward_stream now sends through SharedHttpClient::stream_client
— a client derived from the same config with the total request timeout
removed and connect + read timeouts retained. reqwest 0.13's per-request
override can lengthen a client-level total timeout but never clear it
(request-scoped None falls back to the client default), so the derived
client is the only correct mechanism. Both clients rebuild-and-swap
together atomically (FWD-12). A healthy >30s subscription survives; the
read timeout stays as the staleness guard, matching the gateway's
deadline: None dispatch contract (alkcall ADR-021).
FWD-14: the streaming branch enforces a total streamed-bytes cap per
subscription (HttpClientConfig::stream_total_byte_cap, default 1 GiB),
accumulated across every chunk fed to the SSE parser; exceeding it
terminates with a single terminal HTTP_413 error envelope. The SSE
line-cap check moved before extend_from_slice so the reassembly buffer
can never exceed the cap. Removing the total timeout without this cap
would open an unbounded-memory window, so both land together.
Wire tests: keepalive trickle past a scaled total-timeout deadline keeps
delivering; over-cap stream terminates with exactly one terminal error;
parser boundary tests for pre-extend cap checks.
Verified: cargo test (302+5), --all-features (373+41), clippy
--all-targets -D warnings (default + all-features), fmt --check,
doc --no-deps clean.
method_not_allowed_fallback(decoy_method_not_allowed) was registered on
the default router before the extras merge; axum applies the 405
fallback only to MethodRouters present at call time, so wrong-method
probes on extra routes returned axum's bare 405 (no body, no
Server: nginx) — the exact stealth probe SRV-07 neutralized for the
default surface.
Re-apply the fallback after the extras merge (idempotent for routers
the earlier call covered — axum 0.8.9 replaces only Fallback::Default).
Tests pin both shapes: decoy 405 on an extra route, and no regression
of the default-surface 405 after the merge.
Verification: cargo test, cargo clippy --all-targets -- -D warnings,
cargo fmt --check
Replace rmcp's unbounded Peer::list_all_tools with a bounded walk over
list_tools: hard cap of 100 pages (MCP_MAX_TOOLS_LIST_PAGES) plus a 60 s
overall deadline (MCP_TOOLS_LIST_DEADLINE). Tripping either budget fails
loudly with AdapterError::DiscoveryFailed naming pages fetched and tools
accumulated — no silent truncation, no partial registration (import
fails closed, as before). A slow or hung page is cut off by a per-page
tokio timeout sized to the remaining budget.
Bounds are documented in the module doc. Integration test added: a
cycling-cursor server (next_cursor always Some("a")) terminates with
the clean budget error inside an outer 10 s guard; the existing 3-page
pagination test is unchanged and passes.
Verification: cargo test (304 pass), cargo test --features mcp,
cargo test --all-features (412 pass), clippy -D warnings both default
and --all-features --all-targets, cargo fmt --check, cargo doc --no-deps.
- build_error_schemas: default/wildcard response keys dropped with a
warn instead of emitting a dead HTTP_0 ErrorDefinition — /search
never advertises a code that can't match (the runtime mapper already
synthesizes HTTP_<actual> for unmapped statuses)
- check_parameter_style: non-default style/explode parameter forms
(spaceDelimited, pipeDelimited, deepObject, form+explode:false,
simple+explode:true) fail import with a feature-naming SchemaParse;
wire-equivalent defaults (form, simple) import unchanged — no more
silent "[1,2]" array mis-serialization
- servers overrides rejected at import at all three levels (document,
path, operation) — the adapter pins one base_url at assembly time
- trace-only paths: skip is now logged (warn naming path + methods),
documented-as-inert instead of silent
- detect_op_type + build_output_schema sweep 2XX/default keys for
text/event-stream — a default-declared SSE stream classifies as Sub
instead of returning one giant text body
Tests: 11 new (error-drop, style rejections + default accept, servers
3-level rejections + baseline, trace skip, SSE default/2XX detection).
Verified: cargo test (299), --all-features (370 + suites), clippy
--all-targets -D warnings (default + all-features), fmt --check.
Tasks: review-001-openapi-loud-degradation
- new gateway::schema_cache — PublishSchemaCache: compile the op's
publish_schema once per registration (value-keyed invalidation for
hot reload), cache compile failures (logged once at error level,
never retried per request)
- /publish compile failure is now fail-closed: the chunk stream
terminates with INTERNAL (500), the error text stays in the log
(no schema internals on the wire) — the per-request warn-and-skip
unvalidated ingest path is removed
- schema resolution is lazy (first chunk poll, after invoke_sink's
404/403/422 pre-checks — GW-11 order preserved) and keyed by schema
value, so re-registration/hot reload is picked up (test)
- NdjsonChunkStream: first Err item is terminal (done + stream end),
mirroring the wire pump's send(Err) + break — Ok chunks can never
follow an error on the HTTP path either (found by spy-handler test)
Verified: cargo test (308), cargo test --all-features, clippy
--all-targets -D warnings (default + all-features), fmt --check.
Tasks: review-001-publish-schema-validation-robust
Found in the sweep of completed review-001 remediation:
- /publish schema validation fails open on compile error + recompiles
per request (remediation-introduced, routes.rs:254-268)
- OAI-06 loud-degradation unblocked and still open (HTTP_0 marker)
- HY-06 ExponentialBackoff in public API + COV-02 mTLS success path
both unblocked post client-config rework
- HY-02/04/11 publish-prep docs gate (104 missing-docs warnings
re-measured)
Also flagged, not tasked here: WS-12 (alkcall demux 4 GiB discard
alloc) was never actually filed in alkcall's consumer-findings-ledger —
only CF-001 is there. File it when next touching alkcall.
taskgraph: validate clean (42), no cycles
Record the v1 cut for browser-opened data channels over WS (review-001
WS-03): the design (ADR-067) stands; only the wiring is deferred.
- open-questions.md: add OQ-05 (deferred(scope: v1 cut)) with gap
detail and deferred scope
- ADR-067: dated status amendment + v1-cut note at the data-channel
step; References point to OQ-05
- ADR-048: dated reconciliation note — overlay bidirectionality is
decided design, not a v1 implementation commitment
- websocket.md: status notes on §"Data channels for browsers" and
upgrade step 7
- task review-001-ws-data-channel-decision: completed, Summary filled
Verification: taskgraph validate (38 tasks OK); cargo doc --no-deps
(pre-existing warnings only).
- build_request takes the op's input_schema and rejects undeclared
input keys (INVALID_INPUT) before any outbound request is built;
explicit `additionalProperties: true` opts into catch-all input;
non-object inputs rejected (OAI-02)
- in: header parameters are stamped `wire: header` in the generated
input schema and sent as upstream request headers, not query params;
in: cookie fails import with a clear error (OAI-03)
- a spec parameter named `body` is rejected at import unconditionally
(OAI-07)
- FromJsonSchema::new returns Result and validates method/path template/
base_url at construction; registered visibility forced to Internal
like from_openapi; module doc corrected (OAI-09)
Verified: cargo test, cargo test --all-features, clippy (both feature
sets, -D warnings), cargo fmt --check
- /search, /schema: document the envelope wrapper and the real item/spec
fields (PRJ-01/02); /search drops unreachable 401/403, documents 404
(PRJ-15)
- error statuses: 422 for dispatch-path INVALID_INPUT /
INVALID_OPERATION_TYPE; extractor 400s documented as the plain-text
gap they are (PRJ-03); operation-declared errors projected by
http_status with x-runtime-behavior: 500 on non-HTTP_* codes (PRJ-04
project-honest decision) — no runtime changes
- /subscribe: 200+SSE only; event:error terminal contract documented
(PRJ-05, GW-12)
- components for requests/responses; CallRequest no longer inlined
per-path (PRJ-14); all library expect() paths removed (PRJ-11)
- error projections folded into BTreeMaps: same registry =>
byte-identical doc, sorted enums (PRJ-12)
- components.securitySchemes.bearerAuth + top-level security (PRJ-15)
- info.version 1.1.0 -> 1.2.0 (ADR-045 minor: additive documentation of
the settled runtime contract)
- 31 unit tests incl. golden print-level assertions mirroring the routes
tests' actual bodies and a determinism test
Verification: cargo test (288), clippy --all-targets -D warnings, fmt
--check, cargo doc --no-deps, cargo test --all-features (all green in a
clean worktree at HEAD; shared tree carries parallel agents' edits).
- index components/parameters + requestBodies in OpenAPISpec; resolve
bare $ref parameter and requestBody entries through the cycle-guarded
resolver; unresolvable refs abort spec parse loudly
- reject path placeholders with no matching input-schema property at
registration (no more silently percent-encoded literal placeholders)
- reject duplicate operationIds and path+method routes in one import
batch instead of silent last-write-wins registration
- also reject a parameter named 'body' shadowed by requestBody (OAI-07
adjacency, same code path)
Verified: cargo test (243), --all-features (322), clippy -D warnings
(default + all-features), fmt --check, doc --no-deps
- percent-encode path-parameter values with a WHATWG path-segment
superset (/, %, ?, #, \\, controls): traversal values, query/fragment
structure, and later-placeholder strings can no longer alter the
request line (FWD-01)
- single-pass template rendering; rendered values are never
re-substituted; unbound or unterminated placeholders error loudly
- append the request path to the base URL directory (https://host/v1
+ /chat/completions keeps /v1) instead of Url::join semantics,
with a post-assembly origin-equality check (FWD-02)
- base_url validation: https/http-only scheme allowlist, explicit
host required, userinfo rejected (credentials flow via
Capabilities only); request_path is never empty
Verification: cargo test (238 lib tests incl. 8 new FWD-01/02 tests),
cargo clippy --all-targets -- -D warnings, cargo fmt --check
Add tests for the /mcp body cap and complete the task file.
- oversized POST /mcp with declared Content-Length > 8 MiB -> 413
before any body read
- oversized chunked POST /mcp -> 413 (counting-stream cut mid-body;
rmcp maps body errors to 500, so the middleware sources the status)
- normal-size initialize round-trip unchanged
- task file: status completed, Summary filled
Verified: cargo test (219), cargo test --features mcp --lib (257),
cargo test --all-features (269 + integration), clippy default and
--all-features (-D warnings), cargo fmt --check.
- Replace the axum/tungstenite pump paths' Notify-based read-EOF signal
with a retained tokio watch channel: a late subscriber (monitor
spawned after session setup, or pump EOF before the receiver is
taken) still observes EOF (WS-02).
- from_wss drop monitor: on EOF (or session close) fail all pendings
retryable, then keep sweeping the pending map every 1 s — calls
registered after the initial fail_all (the forgotten-session import
path) resolve instead of hanging (CON-02).
- Tests: drop-during-registration race variants (forget + held
session) and a post-EOF registration resolved via the sweep; the
existing no-hang test stays green.
cargo test (219), cargo test --features wss (231, 3x for flake check),
cargo clippy --all-targets -- -D warnings, cargo fmt --check
Replace the axum/tungstenite pump paths' Notify-based read-EOF signal
with a retained tokio watch channel so a late subscriber observes EOF
regardless of when it fired. Extend the from_wss drop monitor to sweep
the pending map (1 s interval) once EOF is observed, so calls
registered after the initial fail_all also resolve retryable instead
of hanging.
cargo test; cargo clippy --all-targets -- -D warnings (default +
all-features); cargo fmt --check
glm-5.3-flash