feat(composition): bind ASGI request target to route authority

[seonghobae]

Scope

Raw ASGI request-target normalization owner, directly stacked on #438 exact 6cd7a9081696c29fd3ce43a9f776fccfbf9ecaab. Current source head is dbee7dcd6ce641e23fe93dcc59b643c066eed526, open · Draft · mergeable, 6 commits / 4 files. This PR owns exact HTTP ASGI scope evidence, mandatory raw_path, raw/decoded identity and fail-closed rejection of percent-encoded, fragment, non-ASCII, dot-segment or malformed transport material before canonical request routing. It adds no SQL, owner schema, cross-service query, authentication, deployment packaging or performance claim.

Descendant authority — current

Current stack above this transport owner is #440 0050f14701ea92fd85a2691a280d29c46a97b63b → #442 9bbb792ef43fca8b08684f4f55a8bfe65e1120da → #443 728f07a8c86f92bbf33586f2a8007da9f31f5e06 → #444 e1af671deeeec682dffdf809cb8579dcc4d439da → response-completion leaf #446 7954f5bf606584ddb5bbcd29e1b64e49041b9409. #440 owns HTTP method/error/current-Allow/GET-HEAD/wire authority; #442 owns typed currentness projection; #443 owns inbound body/receive lifecycle; #444 owns core outbound response-event/send validation; #446 owns complete non-streaming response prevalidation, no-content/framing/transfer-coding authority and detached caller headers.

Fresh #443 RED 6b61a5c... → repair 728f07a... removed the stale inference that a callable receive raising before returning an awaitable is necessarily local capability failure. #444 adopted that owner delta by ordinary-forward merged #445, then later response validation repairs moved #444 to e1af671...; #446 extends only the response-completion boundary. Receive/send fail closed on demonstrable shape defects while invocation/await exceptions and cancellation remain caller/server lifecycle authority. None of this moves raw request-target ownership out of #439.

PostgreSQL lineage remains 0018→0025; this PR and later transport/HTTP lifecycle descendants add no SQL.

Verification boundary

Canonical package/install/PostgreSQL acceptance must use one unchanged exact #446 7954f5bf606584ddb5bbcd29e1b64e49041b9409 candidate so this raw-transport contract executes together with current HTTP/currentness/receive/send/completion semantics. #447 exact 47ac3556dfef7d5d27af2af8ae2ba5038b837e7c is the current Draft #260 Foundation discovery/runtime implementation and remains non-GREEN pending normal #64/#305 owner integration plus protected-base checks/review. #261 owns installed wheel/sdist acceptance; #311 exact dbc2fcf70ba6a6883381e8526cd62c6e19ce159c owns the inherited 0018→0025 PostgreSQL inventory on the same tree. Predecessor/bot status and mergeability do not transfer.

Proposed architecture #433 is source-current at ff50182c25ccf45928b1413f947c992f62be2ded, but ADR 0432 remains Proposed; this is not architecture admission.

Keep Draft until canonical same-tree execution and review/prerequisite gates clear. No self-approval, administrator bypass, gate weakening, feature-local quality workflow, synthetic status, force-push/destructive rebase, mutable sibling source, predecessor-GREEN transfer, premature Ready/merge/release or simple Close is authorized.

Refs #432 #433 #435 #437 #438 #440 #442 #443 #444 #445 #446 #447 #260 #261 #311 #100.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Standards check for the transport boundary: verified against the official ASGI HTTP/WebSocket sub-specification, version 2.5 (2024-06-05): https://asgi.readthedocs.io/en/latest/specs/www.html . The spec defines path as the Unicode path after percent/UTF-8 decoding, raw_path as the original unmodified path bytes and explicitly permits raw_path to be absent, while query_string remains byte-oriented and root_path defaults to empty.

The stricter #439 decision is therefore deliberate product fail-closed behavior, not an ASGI-conformance claim: Orgmetra requires raw_path for this narrow route-authority boundary because a server that omits it cannot prove that a canonical decoded path was not produced by percent-decoding/normalization. Non-empty query/root path remain unsupported in this slice rather than being silently dropped. Any future broadening needs owner-contract evidence and transport-level conformance tests.