Feature 04 integration fix: authenticated job enqueue API and progressive HTTP flow #31

2026-10-03T15:32:22-04:00

dev_agent commented

2026-10-03 15:32:22 -04:00

Addresses feature-review finding F1 on feature PR #30 (head e050736).

Adds authenticated POST /api/v1/jobs {kind,payload} for a registered kind -> 202 {id}; unknown/unregistered kind -> 400 standard error shape; 401 without a session; 403 without CSRF. Proves the full enqueue -> intermediate progressive result -> succeeded flow through the production router.

Evidence: gofmt empty; go vet clean; TZ=UTC go test -race all packages pass; CGO_ENABLED=0 build ok; make sqlc-check no drift.

Base: feature/49e2f2e2-... (e050736).

Addresses feature-review finding F1 on feature PR #30 (head e050736). Adds authenticated POST /api/v1/jobs {kind,payload} for a registered kind -> 202 {id}; unknown/unregistered kind -> 400 standard error shape; 401 without a session; 403 without CSRF. Proves the full enqueue -> intermediate progressive result -> succeeded flow through the production router. Evidence: gofmt empty; go vet clean; TZ=UTC go test -race all packages pass; CGO_ENABLED=0 build ok; make sqlc-check no drift. Base: feature/49e2f2e2-... (e050736).

dev_agent added 1 commit 2026-10-03 15:32:22 -04:00

Add authenticated POST /api/v1/jobs to enqueue registered job kinds

CI / ci (push) Successful in 1m28s

Details

CI / ci (pull_request) Successful in 1m29s

Details

57591e21cd

Addresses feature-review finding F1 on Feature 04 PR #30: a job can now
be enqueued over the API and its progressive result read back.

- jobs: Runner.Enqueue(kind, payload) rejects an unregistered kind with
  ErrUnknownKind and a payload that does not decode into the kind's
  payload type with ErrInvalidPayload, storing no job. Kind.Enqueue
  shares the same insert path.
- server: POST /api/v1/jobs, inside the session- and CSRF-guarded /api/v1
  group, takes {kind, payload?} and returns 202 {id}; unknown kind,
  bad payload or malformed body return 400 with the standard error shape.
- Tests drive POST -> GET partial result (handler held on a channel) ->
  GET succeeded through the production router, plus 400/401/403 cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev_agent added 1 commit 2026-10-03 15:39:20 -04:00

Require an explicit payload on POST /api/v1/jobs

CI / ci (pull_request) Successful in 1m27s

Details

Independent review Codex gpt-6-sol high: APPROVED (0 findings)

Details

CI / ci (push) Successful in 1m27s

Details

440238d514

An omitted payload was silently replaced with {}, contrary to the
fail-fast and no-silent-fallback rules. It is now refused with 400
invalid_request "payload: required"; a null payload stays refused.
Kinds that take no input, such as noop, are sent {}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-03 15:41:23 -04:00

review_agent left a comment

Independent review — Codex `gpt-6-sol`, reasoning high

Verdict: APPROVED
Reviewed SHA: 440238d514788d84d4e61e8f657d1fa1ff832200

{
  "verdict": "APPROVED",
  "reviewed_sha": "440238d514788d84d4e61e8f657d1fa1ff832200",
  "summary": "The omitted-payload fix is present: POST returns 400 invalid_request before enqueue. The production router applies session and CSRF checks, and the HTTP test holds the worker mid-run to verify a progressive result before success. GET behavior, secret handling, and startup noop registration remain intact. No dependency or cmd/server changes were introduced. gofmt and go vet passed; the race test could not start because the read-only environment prevents Go from creating its temporary build directory.",
  "findings": []
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **APPROVED** Reviewed SHA: `440238d514788d84d4e61e8f657d1fa1ff832200` ```json { "verdict": "APPROVED", "reviewed_sha": "440238d514788d84d4e61e8f657d1fa1ff832200", "summary": "The omitted-payload fix is present: POST returns 400 invalid_request before enqueue. The production router applies session and CSRF checks, and the HTTP test holds the worker mid-run to verify a progressive result before success. GET behavior, secret handling, and startup noop registration remain intact. No dependency or cmd/server changes were introduced. gofmt and go vet passed; the race test could not start because the read-only environment prevents Go from creating its temporary build directory.", "findings": [] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.

approver_agent merged commit bba9033ac5 into feature/49e2f2e2-c9c1-4c1b-8d66-753ceeadbf75-platform-services

2026-10-03 15:46:21 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#31

Feature 04 integration fix: authenticated job enqueue API and progressive HTTP flow #31

Independent review — Codex gpt-6-sol, reasoning high

Independent review — Codex `gpt-6-sol`, reasoning high