alkhttp

T

glm-5.3-flash 6cd0fd3f86 fix(server): decoy 405 covers merged extra routes (SRV-12)

method_not_allowed_fallback(decoy_method_not_allowed) was registered on
the default router before the extras merge; axum applies the 405
fallback only to MethodRouters present at call time, so wrong-method
probes on extra routes returned axum's bare 405 (no body, no
Server: nginx) — the exact stealth probe SRV-07 neutralized for the
default surface.

Re-apply the fallback after the extras merge (idempotent for routers
the earlier call covered — axum 0.8.9 replaces only Fallback::Default).
Tests pin both shapes: decoy 405 on an extra route, and no regression
of the default-surface 405 after the merge.

Verification: cargo test, cargo clippy --all-targets -- -D warnings,
cargo fmt --check

2026-08-30 11:53:47 +00:00

.opencode/agents

chore: bootstrap repo with AGENTS.md, gitignore, and project-specific agent specs

2026-08-25 08:44:26 +00:00

docs

docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up)

2026-08-30 10:50:34 +00:00

src

fix(server): decoy 405 covers merged extra routes (SRV-12)

2026-08-30 11:53:47 +00:00

tasks

docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up)