feat(composition): map route failures to HTTP problem responses

[seonghobae]

Scope

HTTP method/error-semantics owner stacked on #439 exact dbee7dcd6ce641e23fe93dcc59b643c066eed526. Current source head is 0050f14701ea92fd85a2691a280d29c46a97b63b, open · Draft · mergeable. This PR changes no SQL/migration bytes and does not claim authentication, owner HTTP dispatch, a complete ASGI application, deployment packaging or buyer-path performance.

Current contract

This owner keeps distinct HTTP authorities:

• malformed request/method syntax → 400;
• valid HTTP token outside the fixed Orgmetra composition method profile → 501 before Path Item/PostgreSQL authority;
• concrete-before-template Path Item selection before availability;
• implemented method rejected by the selected resource → 405 with Allow derived from currently serviceable selected-Path-Item route authority;
• selected method whose route lacks current positive serviceability → 503;
• HEAD error emission sends response metadata but no response content;
• RFC 9457 problem responses use deterministic about:blank status-phrase titles without internal exception detail;
• 405 Allow is bound to the exact authority issued at CompositionMethodNotAllowedError construction rather than later mutable public state.

Earlier RED→repair history establishes deterministic RFC 9457 mapping, 405/501 separation, RFC token grammar, removal of an artificial method-length cap, HEAD no-content emission, inherited ASGI token preservation, request-time 405 serviceability, GET/HEAD parity, wire-time Allow validation and lifetime-bound issued authority. Current exact 0050f147... ordinary-forward preserves those deltas and #437's typed serving-expiry repair. No force-push or destructive rebase was used.

PostgreSQL lineage remains 0018→0025.

Descendant lifecycle authority — current

• fix(composition): classify superseded serving snapshots before HTTP projection #442 exact 9bbb792ef43fca8b08684f4f55a8bfe65e1120da maps only typed ActivationConflictError currentness outcomes to CompositionRouteUnavailableError; ActivationAuthorizationError remains unwrapped.
• feat(composition): bound ASGI request-body lifecycle #443 exact 728f07a8c86f92bbf33586f2a8007da9f31f5e06 owns bounded inbound ASGI request-body/receive lifecycle.
• fix(composition): preserve ASGI response-send lifecycle #444 exact e1af671deeeec682dffdf809cb8579dcc4d439da owns core outbound ASGI response-event/send validation and preserves server/runtime invocation/await failures rather than laundering them into routing errors.
• current response-completion leaf feat(composition): prevalidate complete ASGI responses before start #446 exact 7954f5bf606584ddb5bbcd29e1b64e49041b9409 prevalidates complete non-streaming responses before http.response.start, enforces no-content/Content-Length/Transfer-Encoding framing rules and detaches validated caller header pairs before the first await.

#440 remains HTTP mapping/method semantics owner. Descendant receive/send/completion boundaries do not move problem-response policy out of this PR.

Standards / security boundary

Primary HTTP authority remains RFC 9110 for method token, 501/405, Allow and HEAD semantics; RFC 9112 constrains HTTP/1.1 framing; RFC 9457 constrains problem details. ASGI defines receive/send as awaitable callables and assigns closed-connection send failure to server/runtime lifecycle. Request syntax, selected Path Item declaration, serviceability, construction-time 405 authority, typed currentness classification, send lifecycle and final complete-response framing remain separate authorities.

Verification boundary

Canonical package/install/PostgreSQL acceptance must use one unchanged exact #446 7954f5bf606584ddb5bbcd29e1b64e49041b9409 candidate. #447 exact 47ac3556dfef7d5d27af2af8ae2ba5038b837e7c is the current Draft implementation of #260 owner-neutral service discovery/runtime execution; it remains non-GREEN pending normal #64/#305 metadata integration plus protected-base checks/review. #261 owns installed wheel/sdist acceptance. #311 exact dbc2fcf70ba6a6883381e8526cd62c6e19ce159c must execute the complete inherited 0018→0025 PostgreSQL inventory on the same exact composition tree. Unchanged SQL is not database GREEN; predecessor/bot evidence does not transfer.

Proposed architecture #433 is source-current at ff50182c25ccf45928b1413f947c992f62be2ded, but ADR 0432 remains Proposed and requires independent admission after canonical execution.

Keep Draft until same-tree package/install/PostgreSQL execution, prerequisite checks and qualifying independent review exist. No self-approval, routine administrator bypass, gate weakening, synthetic status, force-push/destructive rebase, mutable sibling source, migration-number reuse, predecessor-GREEN transfer or premature Ready/merge/release is authorized.

Refs #432 #433 #434 #435 #436 #437 #438 #439 #442 #443 #444 #446 #447 #260 #261 #311 #100.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}