The governed Data/AI Context reassessment parsers use urllib.parse.urlparse. Semicolon/matrix parameters are split into parsed.params; allowing that component to be ignored before route/UUID binding is a request-target canonicalization defect at a purpose-bound authorization boundary. Do not normalize or silently discard matrix parameters.
Dependency-root repair remains on parent PR #30. Current exact #30 head is e5242d6a1cffcfbee906e417f280bf007b7e0198. The request-target RED fixture requires _PATH + ';unexpected=1' to fail with PlannerRequestError, and the production parser rejects parsed.params together with scheme/netloc/query/fragment before route binding. The same defect class on target-state replanning was repaired test-first (cbe446d46a09a3a0fd7762530b5d68b6acdb8eb1 RED -> 288ae907c859d0a40475b866d593943253213f94 GREEN), rejecting matrix-parameter and absolute-form targets instead of silently normalizing them.
The live #30 lineage has since also added an explicit reassessment PostgreSQL acceptance-order contract (1f85fe6bfcee110edea0c21994b33a64e3fd42db RED -> e5242d6a1cffcfbee906e417f280bf007b7e0198 documentation/contract GREEN) after review exposed hidden shared-fixture ordering. Current #30 inline review threads are resolved.
Remote GREEN remains unavailable: a fresh exact-head Actions lookup for e5242d6a... returns zero pull-request workflow runs. Therefore no focused/full test, 100% coverage/docstring, PostgreSQL, package, runtime-readiness or supply-chain result is claimed for this head. .github#712 owns the missing workflow/event materialization specimen and .github#1137 owns the protect-main-first/default-branch control-plane transition.
Keep this issue open until the unchanged repaired head, or its later protected-main reconstruction, executes the hostile fixture and full required gates successfully. Then non-force restack #31 and verify the equivalent status-route hostile fixture there; no predecessor evidence transfers.
The governed Data/AI Context reassessment parsers use
urllib.parse.urlparse. Semicolon/matrix parameters are split intoparsed.params; allowing that component to be ignored before route/UUID binding is a request-target canonicalization defect at a purpose-bound authorization boundary. Do not normalize or silently discard matrix parameters.Dependency-root repair remains on parent PR #30. Current exact #30 head is
e5242d6a1cffcfbee906e417f280bf007b7e0198. The request-target RED fixture requires_PATH + ';unexpected=1'to fail withPlannerRequestError, and the production parser rejectsparsed.paramstogether with scheme/netloc/query/fragment before route binding. The same defect class on target-state replanning was repaired test-first (cbe446d46a09a3a0fd7762530b5d68b6acdb8eb1RED ->288ae907c859d0a40475b866d593943253213f94GREEN), rejecting matrix-parameter and absolute-form targets instead of silently normalizing them.The live #30 lineage has since also added an explicit reassessment PostgreSQL acceptance-order contract (
1f85fe6bfcee110edea0c21994b33a64e3fd42dbRED ->e5242d6a1cffcfbee906e417f280bf007b7e0198documentation/contract GREEN) after review exposed hidden shared-fixture ordering. Current #30 inline review threads are resolved.Remote GREEN remains unavailable: a fresh exact-head Actions lookup for
e5242d6a...returns zero pull-request workflow runs. Therefore no focused/full test, 100% coverage/docstring, PostgreSQL, package, runtime-readiness or supply-chain result is claimed for this head..github#712owns the missing workflow/event materialization specimen and.github#1137owns the protect-main-first/default-branch control-plane transition.Keep this issue open until the unchanged repaired head, or its later protected-main reconstruction, executes the hostile fixture and full required gates successfully. Then non-force restack #31 and verify the equivalent status-route hostile fixture there; no predecessor evidence transfers.