Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review needs authenticated completion exchange and receipt recovery without exposing these operations to browser sessions or capability-read credentials. This adds an optional HTTPS service handler with explicit
completion.exchangeandreceipt.readscopes, strict bounded JSON, credential-window rechecks, request deadlines and concurrency/rate limits. It remains unmounted and unconfigured.Validation: 17 transport tests pass, including rotation, incomplete uploads, duplicate keys, invalid UTF-8, scope separation and backend errors. The shared HTTPS client suite also passes. The full suite passes 754 cases with 73 environment-dependent cases pending; TypeScript, lint and frontend build pass. Fifty synthetic loopback HTTP receipt reads measured median 3.07 ms and p95 4.90 ms. A separate review-repository test uses the actual Go client and this TypeScript handler over verified TLS, covering replay, expiry recovery, policy mismatch, untrusted certificates and read-key rejection on exchange.
Stacks on #848. No startup mount, provider configuration, browser callback activation or deployment is included. Capabilities remain unavailable.