T-26 — std/ boundary carriers: HttpMethod / Url / NetworkAddress (v4 TASKS.md T-26; SCHEDULED → dispatch now, operator-authorized 2026-05-18). Feeds T-4.6 (openapi HttpMethod/Url) + the T-16 wire contract. PORT HttpMethod (the RFC 9110 method enum) and Url (a String refinement) into v4 std/ FROM the

[briansrls]

Auto-opened by session-dashboard for session swift-moth-142.
Pushing to session/swift-moth-142 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[briansrls]

Superseded by later head 326e48b and corrected follow-up comment: #3269 (comment). The current code and PR status use the CORE all-physical-lines comment metric, not the stale nonblank denominator shown here originally. — sent from swift-moth-142

[briansrls]

Superseded by corrected follow-up comment: #3269 (comment). This comment was malformed by shell backtick expansion before posting; the corrected comment names the URI carriers and src/v4/std/network.dag metric explicitly. — sent from swift-moth-142

[briansrls]

Correction to the previous comment: pre-review follow-up pushed at head 326e48b.

• Added the explicit DECISIONS.md yellow scaffold row for the live URI component carriers: UriScheme, UriAuthority, UriPath, UriQuery, UriFragment, UrlComponents. Trigger is bound to T-30 structural checker plus T-25-core refinement substrate for RFC 3986 ABNF witnesses.
• Recomputed the de-prose metric using the CORE all-physical-lines denominator: src/v4/std/network.dag is 9 comment lines / 65 total physical lines = 13.85%.

Validation rerun at this head: v2 compile --source-root src/v4 -> 70 modules, 0 diagnostics; check-r4-carve-dissolution-discipline pass; git diff --check pass.

— sent from swift-moth-142

[briansrls]

CORE ruling rework pushed at head 53e3349.

This supersedes the earlier raw-spelling follow-up. std/network.dag now follows the operator-ratified shape: Url is the RFC 3986 component bundle; UriAuthority decomposes to userinfo/host/port; UriPort carries Nat; UriScheme carries a normalized spelling; each component carries Rfc3986AbnfProduction grammar data, with named rfc3986_*_abnf data rows. DECISIONS.md now marks these modeled facts green and leaves only the fail-closed validated-ABNF refinement as yellow feature:T-25-core / T-30 residual under #3244 plan-binding.

Validation rerun before push: v2 compile --source-root src/v4 -> 70 modules, 0 diagnostics; check-r4-carve-dissolution-discipline pass; git diff --check pass; src/v4/std/network.dag all-lines comment metric 9/122 = 7.38%.

— sent from swift-moth-142

[briansrls]

Disposition for dashboard-only review 13983 (codex/codex-default, sha 3210043): SUPERSEDED-BY-RULING.

I verified 13983 was real dashboard-only feedback, but its requested direction toward raw String URL carriers is overridden by the operator-ratified boundary-carrier-port depth ruling relayed by CORE/still-hawk. RFC 3986 section 3 makes URL components first-class subjects with stated facts; Practice 8 requires modeling those spec facts with no port exemption. The current PR head therefore follows the ruling instead of the 13983 raw-spelling request: Url is the component fact bundle, UriAuthority decomposes to userinfo/host/port, UriPort carries Nat, UriScheme carries normalization, and component ABNF is declarative data now. Only the fail-closed validated-refinement check is left as T-25-core/T-30 residual.

— sent from swift-moth-142

[briansrls]

Addressed dashboard review 13997 at head 0d192cb9213ce4977a21b18bdce92a0fc93ffb10.

The finding was valid: shared std/network.dag HttpMethod now correctly includes CONNECT, but OpenAPI Path Item operation fields are only the OAS fixed eight keys get through trace. I restored OpenApiHttpMethod as the OpenAPI-specific path-item key type and changed OpenApiPathItem.routes back to Map<OpenApiHttpMethod, OpenApiOperation>. DECISIONS.md T-4.6-P4-OpenApiHttpMethod now states this is the OAS eight-key surface and intentionally excludes HTTP CONNECT.

Validation rerun before push: v2 compile --source-root src/v4 -> 70 modules, 0 diagnostics; check-r4-carve-dissolution-discipline pass; git diff --check pass; src/v4/std/network.dag all-lines comment metric remains 9/122 = 7.38%.

— sent from swift-moth-142

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 326e48b1 · Trigger: schedule
• Thinking: 329s wall

---

BLOCKING (3)

Root Cause

• src/v4/std/network.dag RFC 3986 optional authority subcomponent presence was modeled as required product fields → add explicit present/absent carriers for userinfo and port before Url or NetworkAddress consume UriAuthority.
• src/v4/std/network.dag RFC 3986 component presence was omitted from the std carrier → model the hier-part choice and defined-vs-empty query/fragment structurally instead of forcing every component to exist.
• src/v4/std/network.dag std Url lacks the URI-reference/relative-reference shape OpenAPI URL fields consume → add a URL-reference carrier or leave this OpenAPI slot on String until that carrier exists.

⚠️ The std network carrier needs to preserve RFC 3986 component presence before OpenAPI and coordination consume it.

[briansrls]

Violations (could not place on specific lines):

• src/v4/std/network.dag:88 BLOCKING: UriAuthority requires userinfo and port, but RFC 3986 authority is host with optional userinfo and optional port (https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2), so ordinary authorities need fabricated components, violating P1/P2.
• src/v4/std/network.dag:110 BLOCKING: Url requires authority, query, and fragment, but RFC 3986 URI has optional query/fragment and a hier-part that need not include authority (https://www.rfc-editor.org/rfc/rfc3986.html#section-3), so absent-vs-empty component facts are lost, violating P1/P2.
• src/v4/extdeps/formats/openapi.dag:183 BLOCKING: OpenApiLicenseUrlPresent now requires the too-narrow Url carrier, but OpenAPI 3.1 says URL properties may be relative references unless specified otherwise and license.url does not override that (https://spec.openapis.org/oas/v3.1.0.html#relative-references-in-urls), so legal OpenAPI documents become unrepresentable.

[briansrls]

Addressed the blocking review relayed at 2026-05-18T04:37:49Z on current head f4c34976a43e3f3ad4d711050127033f167f4db0.

The finding was valid against the current model: RFC 3986 optional presence had been flattened into required fields. The rework now models those facts structurally:

• UriAuthority carries host plus UriUserInfoSlot and UriPortSlot, so userinfo and port are present/absent rather than fabricated.
• Url carries scheme + UriHierPart + UriQuerySlot + UriFragmentSlot, so authority/query/fragment are not forced and the RFC 3986 hier-part alternatives are explicit.
• Added UriRelativePart, UriRelativeReference, and UriReference so absolute and relative references are represented.
• OpenAPI license.url now consumes UriReference, matching OAS relative-reference rules.
• DECISIONS.md updated so the green modeled-facts row names these presence/reference carriers.

Validation rerun before push: v2 compile --source-root src/v4 -> 70 modules, 0 diagnostics; check-r4-carve-dissolution-discipline pass; git diff --check pass; src/v4/std/network.dag all-lines comment metric 17/167 = 10.18%.

— sent from swift-moth-142

[briansrls]

Addressed dashboard review 14013 at head 49bfa5180d9d1726ed05373944811ba5904fe3a3.

The finding was valid: several T-26 coproduct tags in src/v4/std/network.dag referenced IDs that were only rolled into a broader DECISIONS row. I added explicit DECISIONS.md rows for:

• T-26-UriComponentPresence
• T-26-UriHierPart
• T-26-UriRelativePart
• T-26-UriReference

Validation rerun before push: v2 compile --source-root src/v4 -> 70 modules, 0 diagnostics; check-r4-carve-dissolution-discipline pass; git diff --check pass.

— sent from swift-moth-142

[briansrls]

Disposition for dashboard-only review 14037 (codex/codex-default, completed 2026-05-18T05:39:00Z): verified against current code and cited specs; rebutted, no code change.

1. The OpenAPI license.url finding is incorrect. OAS 3.1.1 License Object says license.url is “A URI for the license used for the API. This MUST be in the form of a URI.” OAS 3.1.1 section 4.6 also says, “Unless specified otherwise, all fields that are URIs MAY be relative references as defined by RFC3986 Section 4.2.” The License Object text does not specify otherwise. Therefore OpenApiLicenseUrlPresent.url consuming UriReference is faithful to OAS, not a boundary weakening.

Spec references:

• https://spec.openapis.org/oas/v3.1.1.html#license-object
• https://spec.openapis.org/oas/v3.1.1.html#relative-references-in-api-description-uris

2. The std Url finding repeats the raw-spelling/port-as-alias misread already superseded by the operator-tier CORE boundary-carrier-port depth ruling. RFC 3986 section 3 gives component facts for URI structure, and Practice 8 requires modeling those spec facts with no boundary-carrier-port exemption. The current Url component bundle is therefore intentional and required by the ruling.

— sent from swift-moth-142