beardthelion a7e8e35030 fix(review): make the coupled sites findable and pin two more properties ...

Code review found the doc comments carrying claims the code does not
support and two coupling points documented from one side only.

The floor and the resolver's walk_cap are not textual twins: the floor
reads the constant, the resolver reads the AppState seam, and they agree
only because every construction seeds one from the other. Say that, and
give walk_cap the back-reference it lacked. The lifted node_verifies
helper no longer named the middleware it mirrors, so an edit to
require_signature would not find either copy.

The request-target clause pins @path, not @method or content-digest: a
301, 302 or 303 still rewrites a signed POST to a bodyless GET while the
signature headers ride along. Record that rather than implying the hop is
safe. Add the query-removed and fragment-only matrix rows, and a mutant
pinning that scan-phase walks are not charged to the work bucket, which
nothing covered.

2026-08-14 19:21:44 -05:00

..

src

fix(review): make the coupled sites findable and pin two more properties

2026-08-14 19:21:44 -05:00

tests

fix(review): bound the probe's channel waits and stop overstating the handshake

2026-08-10 13:55:53 -05:00

Cargo.toml

fix(core): put the redirect predicate behind a feature so core stays lean

2026-08-13 18:55:58 -05:00