feat(api): record active-session responses over HTTP

[cursor]

Why

A purchaser who already has an Active session still cannot submit an answer over HTTP. TRD §18 lists POST /v1/sessions/{session_ref}/responses as the next public family after session create. Domain response recording exists on protected main; this slice makes that write discoverable without creating sessions, listing instruments, or persisting ledgers.

Do not mix this onto #149 session HTTP, #165 instrument catalog HTTP, or response persist/reload (#151/#174/#182).

What

• In-process POST /v1/sessions/{session_ref}/responses records one answer on an injected Active session when item_version_ref belongs to that session's published release.
• Exact Idempotency-Key replay returns the original event without minting a second identity.
• Created, paused, unknown, numeric/encoded session identities, foreign items, missing keys, non-canonical digests, unknown JSON, and conflicting replays fail closed with RFC 9457 problem details that do not echo payload bytes.
• As-built OpenAPI 3.2.0 is limited to that one operation (openapi/responses.yaml).
• README and doctoring tell the purchaser the next action: Complete the session after every item is recorded.

Boundary

This does not create or activate sessions, list instruments, persist response ledgers, deliver item text, or implement commands/results. #149 remains the session HTTP landing vehicle. #165 remains the catalog HTTP landing vehicle.

Verification

• cargo test --test response_http_contract
• cargo test --test documentation_architecture_contract
• cargo clippy --all-targets -- -D warnings
• Runtime CI / rustdoc / security workflows on the unchanged exact PR head
• independent non-author approval under the live repository ruleset

Residual accepted on this slice

• Store is in-process only; restart durability is response persist/reload, not this transport.
• Session create/reload remains feat(api): create and reload in-process sessions over HTTP #149. Activate remains a session command.
• Item-delivery HTTP and Complete/result HTTP remain later families.

  

[cursor]

Stale comment

Review (exact head 6ca9d4e)

This is the in-process POST /v1/sessions/{session_ref}/responses landing. It records on an injected Active session and does not persist across restart. That honesty is correct.

Keep persist/reload on #182 (7a72ee1). Do not fold response_event PostgreSQL onto this HTTP slice, and do not land this beside #149 session HTTP or #165 catalog HTTP.

A Korean IPIP Quick buyer still loses answers on process restart until #182 lands. After #182, compose persist under this handler in a later successor — not by expanding this head with a second store.

Independent last-push approval is still required. This review is not an approval.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Stale comment

Exact head 6ca9d4e is the right landing vehicle for in-process POST /v1/sessions/{session_ref}/responses. Do not fold session create, catalog list, persist/reload, item text, or Complete onto this PR. Do not open a second response-event HTTP PR.

The write path is sound: Active-only new answers, release membership, exact Idempotency-Key replay (200, no second server_event_ref), conflicting reuse 409 without echoing payload bytes, and OpenAPI limited to this one operation.

This automation cannot REQUEST_CHANGES on its own PR. These findings still block treating the head as review-clean:

1. SessionNotActive always tells the purchaser to Activate. That is the wrong next action for Paused (Resume via POST /v1/sessions/{session_ref}/commands) and for Completed/Expired/Cancelled (do not reopen). The paused fixture only asserts the URN.
2. apply_request_read completes on the first header terminator before Content-Length is satisfied. A split-packet body on 0.0.0.0:$PORT becomes a false 400. The listener test writes headers+body in one write_all.
3. Missing realistic paths: Completed/Expired/Cancelled write, second-item sequence: 2, and exact-key replay after Pause/Complete (domain replay is checked before accepts_responses()). Do not add an HTTP-level Active gate before ledger.record.
4. As-built OpenAPI never states the ADR-0014 residual: this slice is anonymous/unauthenticated in-process transport with session_ref resource scope, not a hosted authorized API.

Also stop header_value from scanning past the first blank line so a body line cannot supply Idempotency-Key.

Independent non-author approval and exact-head checks remain required. This review does not approve.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review

Keep #195 as the in-process HTTP write family. Do not fold it onto persist landing PR #208.

#195 correctly records one Active-session answer, exact Idempotency-Key replay, and RFC 9457 fail-closed paths without echoing payload bytes. Restart durability is #208, not this transport.

Composition note: #208 adds WriteError::InvalidStoredSequence. After that persist head lands, write_problem on this family must handle the new variant or the HTTP crate will not compile. Do not add persist/load to this branch to paper over that. Handle the new error as a 409 that tells the operator to restore a contiguous 1..n ledger, then keep HTTP and persist as separate PRs.

Do not mix onto #149 session HTTP or #165 catalog HTTP. Independent last-push review is still required. Do not self-approve.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Exact current-head evidence (2026-08-20, Asia/Seoul): head f1127b604a1834f7f7d393cdac3a8d12dbabaf90 includes response-event HTTP plus a non-force merge of protected main 5544149ca5dc55d2bfc3402cc59c03c44830de5f. Local verification on this exact merged head: response_http_contract 5 passed; documentation architecture 11 passed; active traceability 1 passed; cargo fmt --all -- --check; git diff --check; cargo clippy --all-targets -- -D warnings; full TEST_DATABASE_URL=postgresql://seonghobae@localhost/postgres cargo test -q --all-targets passed. The response route remains in-process and persistence/live integrations are explicitly outside this slice. This is evidence only; PR is not claimed merged.

[seonghobae]

@OpenCode review Please independently review exact current head f1127b604a1834f7f7d393cdac3a8d12dbabaf90 for the response-event HTTP boundary, RFC 9457 errors, idempotency/replay behavior, documentation mapping, and protected-main merge. Report findings against this SHA; do not review an older head.