feat(composition): bind request routing to current route authority

[seonghobae]

Scope

Request-routing owner, ordinary-forward on #437 exact a09d6fb928e0272673b82ef7353ed83213aa994d. Current source head is 6cd7a9081696c29fd3ce43a9f776fccfbf9ecaab, open · Draft · mergeable, 8 commits / 5 files. This PR consumes durable composition authority and returns only a stable composition route_id; it does not copy owner schema or introduce cross-service SQL. Declaration-first concrete-before-template selection prevents an unavailable concrete path from widening into a broader template.

#437 remains the durable currentness owner and separates expected ServingEvidenceExpiredError from ActivationAuthorizationError integrity/security failure. This PR consumes that typed authority; it does not infer state from error strings or hold a deployment lock across owner I/O.

Descendant authority — current

Current ordinary-forward descendants are #439 dbee7dcd6ce641e23fe93dcc59b643c066eed526 → #440 0050f14701ea92fd85a2691a280d29c46a97b63b → #442 9bbb792ef43fca8b08684f4f55a8bfe65e1120da → #443 728f07a8c86f92bbf33586f2a8007da9f31f5e06 → #444 e1af671deeeec682dffdf809cb8579dcc4d439da → current response-completion leaf #446 7954f5bf606584ddb5bbcd29e1b64e49041b9409.

#439 binds raw ASGI request-target evidence; #440 owns method/error/current-Allow/GET-HEAD semantics; #442 owns typed currentness projection; #443 owns bounded receive/body lifecycle; #444 owns the core response-event/send primitive; #446 owns complete non-streaming response prevalidation, no-content/framing/transfer-coding authority and caller-header detachment. No descendant moves routing-selection truth out of #438.

Fresh #443 RED 6b61a5c... → repair 728f07a... aligns receive with #444 send: non-callable/non-awaitable shape fails closed locally, while invocation/await exceptions and cancellation remain caller/server lifecycle authority. #444 adopted that owner repair via ordinary-forward merged #445; later #444/#446 response repairs remain transport/HTTP-only.

No #438-or-later transport/HTTP lifecycle repair changes SQL. PostgreSQL lineage remains 0018→0025.

Verification boundary

Canonical acceptance must use one unchanged exact #446 7954f5bf606584ddb5bbcd29e1b64e49041b9409 tree so this routing contract, raw transport, HTTP/currentness, receive/send and complete-response lifecycle execute together. #447 exact 47ac3556dfef7d5d27af2af8ae2ba5038b837e7c is the current Draft implementation of #260 Foundation service discovery/runtime compatibility; it remains blocked from canonical GREEN by normal #64/#305 metadata integration and protected-base execution/review evidence. #261 separately owns installed wheel/sdist acceptance, and #311 exact dbc2fcf70ba6a6883381e8526cd62c6e19ce159c owns the complete inherited 0018→0025 PostgreSQL inventory. Predecessor/bot evidence and mergeability do not transfer.

Proposed architecture #433 is source-current at exact ff50182c25ccf45928b1413f947c992f62be2ded; ADR 0432 remains Proposed, so source currentness is not architecture admission.

Keep Draft until parent stack, canonical same-tree package/install/PostgreSQL execution and review prerequisites clear. No self-approval, administrator bypass, gate weakening, synthetic status, feature-local workflow, mutable sibling source, cross-service SQL, force-push/destructive rebase, predecessor-GREEN transfer or premature Ready/merge/release is authorized.

Refs #432 #433 #435 #437 #439 #440 #442 #443 #444 #445 #446 #447 #260 #261 #311 #100.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ff7fd5df-276a-4591-af63-21d5649bf02a

📥 Commits

Reviewing files that changed from the base of the PR and between 9475175 and f3a0ba7.

📒 Files selected for processing (4)

• services/product-composition-api/src/orgmetra_product_composition/__init__.py
• services/product-composition-api/src/orgmetra_product_composition/request_routing.py
• services/product-composition-api/tests/test_activation_owned_production_docstrings.py
• services/product-composition-api/tests/test_request_routing_currentness.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

요청 라우팅 리졸버를 추가했습니다. 리졸버는 요청 형식, 선언된 경로, 허용 메서드 및 현재 라우트 가용성을 확인합니다. 관련 오류와 라우팅 함수를 패키지 공개 API로 노출하고, 동작을 테스트합니다.

Changes

요청 라우팅

Layer / File(s)	Summary
요청 검증 및 라우트 해석 services/product-composition-api/src/orgmetra_product_composition/request_routing.py, services/product-composition-api/src/orgmetra_product_composition/__init__.py	요청 메서드와 경로를 검증한 뒤, 정확히 일치하는 경로와 템플릿 경로 순으로 라우트를 선택합니다. 허용 메서드와 현재 가용성을 확인하고, 라우팅 함수와 오류 유형을 패키지 공개 API로 추가합니다.
라우팅 테스트 및 문서 검증 services/product-composition-api/tests/test_request_routing_currentness.py, services/product-composition-api/tests/test_activation_owned_production_docstrings.py	구체 경로와 템플릿 경로의 선택, 경로 및 메서드 오류, 비정규 요청 입력을 테스트합니다. 새 모듈을 docstring 검증 목록에 추가합니다.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to f3a0b

This change adds an internal helper that maps a canonical request to the currently available route ID. It returns distinct errors for invalid requests, unknown paths, disallowed methods, and unavailable routes. An unavailable specific route does not fall back to a broader route, and overlapping route templates are already rejected when a configuration is admitted. No concrete merge-blocking risk was found. The change adds no HTTP host or owner execution.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 현재 라우팅 권한에 요청 라우팅을 연결하는 주요 변경 사항을 정확히 설명하며, 간결하고 구체적입니다.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please focus on declared concrete-before-template precedence versus availability filtering, method authority, canonical decoded-path assumptions, stale/current snapshot use, and any trust-boundary case where request routing could widen to a broader owner route. Do not infer hosted GREEN from source shape.

[coderabbitai]

@seonghobae I’ll review PR #438 for concrete-before-template precedence, availability filtering, method authority, canonical decoded-path assumptions, snapshot currentness, and routes that could widen owner authority. I will not treat source shape as hosted GREEN evidence.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

CodeRabbit's only pre-merge warning is a scope mismatch, not a production-docstring finding: its 20% figure counts test fixtures/test functions in the four changed files. Orgmetra's executable contract is production-only and test_activation_owned_production_docstrings.py now includes request_routing.py; every function in that production module has a docstring. I am not adding filler docstrings to test helpers merely to satisfy the bot's broader heuristic. This still needs canonical pytest/coverage execution; source shape alone is not GREEN.

[seonghobae]

Descendant transport slice opened: Draft #439 exact 2256112d09a7130cd361264eda8303b12d7ad027, ordinary-forward 5 commits / 4 files on this exact #438 head d642eb71c05ae3990349a26facf30593a5703914 with #438 as merge base.

#438 remains request selection/current durable availability authority. #439 only binds ASGI raw request-target evidence before calling current_route_id_for_request(): it requires an exact HTTP scope, mandatory raw_path for this narrow product profile, empty query/root path, admitted ASCII raw bytes, no encoded/query/fragment material, and byte-for-byte raw/decoded path identity. No SQL, migration, auth, owner execution, receive/send application, deployment or performance claim is added.

Canonical acceptance should now use one unchanged #439 candidate so the transport regressions and this PR's preselection/currentness tests execute together; predecessor GREEN does not transfer.