feat(http): rebuild bounded HTTP/1.1 authority on current main by seonghobae · Pull Request #37 · ContextualWisdomLab/OriginWeave

seonghobae · 2026-08-09T17:19:08Z

Purpose

Canonical non-destructive reconstruction of issue #9 / historical PR #11: one bounded reusable originweave-http HTTP/1.1 authority over an existing authenticated TLS stream, with strict framing, resource budgets, integrity/MIME/disposition evidence, realistic loopback tests, ADRs, and repository quality contracts.

Implemented boundary

The branch supports one bounded HTTP/1.1 GET or HEAD exchange over AuthenticatedTlsConnection; it performs no DNS, reconnect, proxy/PAC, browser control, cookie persistence, file persistence, or model call. It enforces RFC 9110/9112 framing, bounded headers/body/chunks/trailers/interim responses/decoding/deadline, gzip/zlib decoding, RFC 9530 digest validation, conservative MIME/no-sniff/disposition handling, redirect evidence without automatic follow, and credential-safe immutable evidence.

The lineage includes the prior HTTP correctness and documentation repairs, including the WHATWG text/binary sniffing boundary, parameter-free MIME essence, HTML signature termination, no-sniff error separation, strict framing, redirect/download metadata, bounded-prefix handling, request-target debug hardening, exact Content-Length termination checking, stateful chunked parsing, and exclusion of deprecated status 305 from redirect metadata.

Fresh live-base state

Protected main is exact b05d5acca82b9d916ada2c8e82f59f92a89817e1. Current contributor head remains exact c8e0f1de85caf31299eb49730510aabf5c8f379a, but the PR's recorded base snapshot is predecessor main 0841d2ab3d8b5e60a03c0a8e818cf438e2716829. GitHub now reports the PR open, Ready, and non-mergeable after protected main moved.

The branch also contains a pre-existing .github/workflows/ci.yml coverage-diagnostics delta. Protected-main AGENTS.md prohibits this scheduled writer from altering workflows. The exact owner decision remains routed through issue #187; this writer will not remove, adopt, rewrite, or resolve that workflow change without the required authority.

Historical exact-head evidence only

On exact contributor head c8e0f1de85caf31299eb49730510aabf5c8f379a against predecessor base 0841d2ab3d8b5e60a03c0a8e818cf438e2716829:

repository CI run 32652915332: success;
Rust contracts job 97227194086: success with Rust 1.97.1, repository contracts, canonical formatting, locked workspace/all-target checks/tests, strict Clippy, and rustdoc;
Production coverage job 97227194202: success, with 492/492 functions, 5956/5956 regions, 4398/4398 lines, 612/612 branches = 100%;
exact coverage artifact 9496705860, digest sha256:02c7749a939e21315b2afeb2bff94740b27a1a75bc2a5a7ececcfe8e2e2bb7ff;
SAST Semgrep run 32652915292: success; and
Security Scan run 32652915253: success.

Those results remain branch-history evidence. They are not promoted as live-base merge evidence after protected main advanced. No skipped, cancelled, stale, predecessor-head, synthetic, status-only, or model-only result is represented as current proof.

Review and convergence state

There is no qualifying independent current-head/latest-push APPROVED review. Historical automated or model reviews do not manufacture approval.

The unresolved governance threads PRRT_kwDOTulPlM6a8XuD and PRRT_kwDOTulPlM6a8eIj remain valid for .github/workflows/ci.yml. They may be resolved only after an authorized owner actually addresses the workflow authority defect.

Before any integration decision, an authorized/suitable reconstruction path must inspect the intervening protected-main delta, preserve the unique HTTP work, deliberately reconcile the branch against the then-current live base without force-push/destructive rebase or predecessor-evidence transfer, disposition the workflow delta through issue #187, and regenerate all applicable exact-head CI/coverage/security/review evidence.

Historical predecessor

PR #11 is closed historical lineage. Its valuable HTTP source/tests/design/doctoring are represented by this reconstruction; obsolete custom coverage machinery and stale ADR-number collisions were intentionally not replayed. Issue #9 remains open until the canonical HTTP boundary is normally integrated and protected-main acceptance is freshly established.

Governance

This scheduled actor does not merge, self-approve, tag, publish, alter workflows, add secrets, weaken checks, force-push, destructively rebase, or synthesize approval.

coderabbitai · 2026-08-09T17:19:20Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

Bounded HTTP/1.1 교환

Layer / File(s)	Summary
정책 및 요청 계약 `Cargo.toml`, `crates/originweave-http/Cargo.toml`, `crates/originweave-http/src/{error,policy,request,target,field}.rs`	워크스페이스에 `originweave-http`를 추가했습니다. 요청 대상, 필드, 메서드, 정책 제한 및 구조화된 `HttpError`를 구현했습니다.
응답 파싱 및 본문 디코딩 `crates/originweave-http/src/{response_head,framing,chunked,content}.rs`	엄격한 HTTP 응답 헤드와 본문 framing을 추가했습니다. chunked/trailer 파싱과 identity·gzip·deflate 디코딩에 제한을 적용했습니다.
무결성 및 응답 메타데이터 `crates/originweave-http/src/{integrity,mime,disposition}.rs`	SHA-256·SHA-512 digest 검증, MIME 분류, 안전한 파일명 검증 및 redirect 메타데이터 처리를 추가했습니다.
TLS 교환 오케스트레이션 `crates/originweave-http/src/{exchange,evidence,lib}.rs`	인증된 TLS 연결에서 단일 HTTP/1.1 교환을 실행하고, deadline·ALPN·framing·디코딩·메타데이터와 불변 증거를 처리했습니다.
통합 검증 및 거버넌스 `crates/originweave-http/src/tests/`, `crates/originweave-http/tests/`, `tests/`, `docs/adr/`, `docs/doctoring/`, `docs/superpowers/`	계약 테스트, loopback TLS 통합 테스트, 회귀 테스트, ADR, 설계 문서 및 저장소 거버넌스 검사를 추가했습니다.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

ContextualWisdomLab/OriginWeave#5: HttpExchangePlan이 인증된 TLS 연결과 TCP 연결 모델의 전송·피어 증거를 사용하므로 관련성이 있습니다.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	`#9의` 핵심 구현과 테스트는 포함되지만, Mermaid 흐름도와 정확한 100% 프로덕션 커버리지 근거는 변경 요약에서 확인되지 않습니다.	`#9의` Mermaid 아키텍처 흐름도를 추가하고, 프로덕션 코드 100% 커버리지를 입증하는 설정과 검증 근거를 포함하세요.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	변경 사항은 HTTP 구현, 테스트, 관련 문서, 거버넌스 및 CI 개선으로 PR 목표와 `#9의` 범위에 있습니다.
Docstring Coverage	✅ Passed	Docstring coverage is 80.73% which is sufficient. The required threshold is 80.00%.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 현재 메인 브랜치 기준으로 bounded HTTP/1.1 구현을 재구축하는 핵심 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/http11-semantics-main

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

Devin Review found 1 new potential issue.

opencode-agent · 2026-08-24T08:15:21Z