ADR-0016 Phase B/C: open the Method field, support RFC 10008 QUERY

Closes the concrete complaint that started this ADR: integration-http's
Method is now an open FieldText with datalist suggestions
(GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS/QUERY), not a closed 5-value
Select -- any method is accepted and sent as-is, so a new or uncommon
method never needs a Mill code change again.

ConfigField gained Suggestions []string (meaningful only for FieldText,
non-restrictive unlike Options/FieldOptions), NodeInspector.tsx renders
a single-line TextInput + datalist for it instead of the generic
multi-row Textarea. QUERY support required no execution-layer code
change -- net/http and retryablehttp.NewRequest already send a body on
any method string -- only tests proving that directly:
TestExecute_QueryMethod_SendsBody (real httptest.Server),
TestExecuteWorkflow_IntegrationHTTP_QueryMethod_Accepted (through the
real ExecuteWorkflow path), and a new e2e spec
(request-method-field.spec.ts) proving the datalist offers QUERY, it
persists through a real save/reopen round trip, and the existing
integration-bindings.spec.ts's stale .selectOption('POST') call (from
when Method was still a closed Select) got caught and fixed by running
the suite, not assumed compatible.

The Manual Schema Editor's separate, OpenAPI-backed operation Method
field grew to all 8 methods kin-openapi's PathItem struct actually has
fields for (adding HEAD/OPTIONS/TRACE) but deliberately excludes QUERY,
verified directly against kin-openapi's source: OpenAPI 3.x has no
spec-defined field for it yet, so a schema-authored operation has to
stay representable as a real OpenAPI document.

The Params tab and Body-type picker -- Phase B's bigger, genuinely
separate Postman/Bruno-style request-builder rework -- remain real,
tracked OPEN work, not folded into this pass.

Verified: full Go build/vet/test/lint (both build tags), frontend
tsc/eslint/boundaries/vitest, and the complete 58-test Playwright e2e
suite (57 + the new spec) run twice with no leakage.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C7zUjYuMtgetjNaxMQPg2h

Author: alicoding

frontend/bindings/github.com/alicoding/mill/internal/domain/composition/models.ts

@@ -71,6 +71,19 @@ export interface ConfigField {
      * still just read the plain string ID out of Node.Config.
      */
     "RefKind": string;
+
+    /**
+     * Suggestions is only meaningful when Type == FieldText -- unlike
+     * Options (FieldOptions' closed enum), any value is still accepted;
+     * these are offered as autocomplete hints only (an HTML5 datalist on
+     * the frontend). ADR-0016: the open-vs-closed distinction this field
+     * exists for was decided directly against real precedent -- Bruno's
+     * own .bru format offers named HTTP methods but keeps an explicit
+     * `method: CUSTOM` escape hatch rather than a closed enum, since a
+     * closed list can't express a new or uncommon method (e.g. RFC
+     * 10008's QUERY, published June 2026) without a code change.
+     */
+    "Suggestions": string[] | null;
 }
 
 /**

frontend/e2e/integration-bindings.spec.ts

@@ -91,7 +91,10 @@ test('Matching an Integration node to a declared operation shows a binding edito
   const configFields = inspector.getByTestId('canvas-config-field')
   await configFields.nth(0).fill('/widgets/{id}') // path
   await configFields.nth(0).blur()
-  await configFields.nth(1).selectOption('POST') // method
+  // Method is an open TextInput with a datalist of suggestions, not a
+  // closed Select (ADR-0016) -- fill/blur, not selectOption.
+  await configFields.nth(1).fill('POST') // method
+  await configFields.nth(1).blur()
 
   const editor = inspector.getByTestId('integration-bindings-editor')
   await expect(editor).toBeVisible()

frontend/e2e/request-method-field.spec.ts

@@ -0,0 +1,85 @@
+import { test, expect } from '@playwright/test'
+
+// Exercises ADR-0016 Phase B/C: integration-http's Method field is an
+// open TextInput with a datalist of suggestions, not a closed Select --
+// any value (including RFC 10008's QUERY, not one of the old 5-item
+// list) is accepted and persists, over real Go bindings (Wails3 server
+// mode), not mocks.
+
+function workflowRow(page: import('@playwright/test').Page, label: string) {
+  return page.locator('[data-testid="workflow-row"]', { has: page.getByText(label, { exact: true }) })
+}
+
+function activePanel(page: import('@playwright/test').Page) {
+  return page.locator('[role="tabpanel"]:not([hidden])')
+}
+
+async function dragPaletteItemToCanvas(page: import('@playwright/test').Page, nodeTypeID: string) {
+  await page.evaluate((id) => {
+    const panel = document.querySelector('[role="tabpanel"]:not([hidden])')
+    if (!panel) throw new Error('no active tabpanel')
+    const palette = panel.querySelector(`[data-node-type-id="${id}"]`)
+    const canvas = panel.querySelector('.react-flow__pane')
+    if (!palette || !canvas) {
+      throw new Error(`drag setup failed: palette found=${!!palette} canvas found=${!!canvas}`)
+    }
+    const dataTransfer = new DataTransfer()
+    const rect = canvas.getBoundingClientRect()
+    const clientX = rect.x + rect.width / 2
+    const clientY = rect.y + rect.height / 2
+    palette.dispatchEvent(new DragEvent('dragstart', { bubbles: true, cancelable: true, dataTransfer }))
+    canvas.dispatchEvent(new DragEvent('dragover', { bubbles: true, cancelable: true, dataTransfer, clientX, clientY }))
+    canvas.dispatchEvent(new DragEvent('drop', { bubbles: true, cancelable: true, dataTransfer, clientX, clientY }))
+  }, nodeTypeID)
+}
+
+async function deleteStarterNode(page: import('@playwright/test').Page) {
+  await activePanel(page).locator('.react-flow__node').click()
+  await activePanel(page).getByRole('button', { name: 'Delete selected' }).click()
+  await expect(activePanel(page).locator('.react-flow__node')).toHaveCount(0)
+}
+
+test('The Method field accepts QUERY, an offered suggestion outside the old closed list, and persists it', async ({ page }) => {
+  await page.goto('/')
+  await page.getByRole('link', { name: 'Composition' }).click()
+  await page.getByTestId('new-workflow').click()
+  await deleteStarterNode(page)
+  await activePanel(page).getByTestId('toggle-palette').click()
+
+  await dragPaletteItemToCanvas(page, 'integration-http')
+  await activePanel(page).locator('.react-flow__node').click()
+
+  const inspector = activePanel(page).getByTestId('composition-inspector')
+  const methodField = inspector.getByTestId('canvas-config-field').nth(1)
+
+  // Not a closed Select -- a plain text input.
+  await expect(methodField).toHaveJSProperty('tagName', 'INPUT')
+
+  // QUERY is offered as a suggestion via the field's datalist, not
+  // required to type blind.
+  const listId = await methodField.getAttribute('list')
+  expect(listId).toBeTruthy()
+  const datalist = inspector.locator(`datalist#${listId}`)
+  await expect(datalist.locator('option[value="QUERY"]')).toHaveCount(1)
+
+  await methodField.fill('QUERY')
+  await methodField.blur()
+
+  // Save and reopen via Edit -- the real "did it persist in Node.Config,
+  // not just left in the input's own local DOM state" proof, same
+  // pattern composition.spec.ts's own save-then-reopen tests already
+  // use, rather than a same-tab reselect (which the canvas toolbar's
+  // top-left docking makes fiddly to click around).
+  await activePanel(page).getByLabel('Label').fill('E2E QUERY method workflow')
+  await activePanel(page).getByTestId('save-workflow').click()
+
+  const row = workflowRow(page, 'E2E QUERY method workflow')
+  await expect(row).toBeVisible()
+  await row.getByRole('button', { name: /Edit/ }).click()
+  await activePanel(page).locator('.react-flow__node').click()
+  await expect(activePanel(page).getByTestId('canvas-config-field').nth(1)).toHaveValue('QUERY')
+
+  await page.getByRole('tab', { name: 'Workflows' }).click()
+  await row.getByRole('button', { name: /Delete/ }).click()
+  await expect(row).toHaveCount(0)
+})

frontend/src/composition/NodeInspector.tsx

@@ -188,6 +188,25 @@ export function NodeInspector({ node, attrs, nodeType, sameKindNodeTypes, hasWor
               data-testid="canvas-config-field"
               onBlur={(e) => onConfigChange(field.Key, e.target.value)}
             />
+          ) : field.Suggestions && field.Suggestions.length > 0 ? (
+            // FieldText with Suggestions (e.g. integration-http's Method,
+            // ADR-0016) -- a single-line input with an HTML5 datalist of
+            // hints, not a closed Select: any value is still accepted,
+            // matching Bruno's own "named methods, or an explicit CUSTOM
+            // escape hatch" shape rather than a fixed enum a new or
+            // uncommon method (RFC 10008's QUERY) can't express.
+            <>
+              <TextInput
+                defaultValue={node.data.config[field.Key] ?? ''}
+                list={`${field.Key}-suggestions`}
+                block
+                data-testid="canvas-config-field"
+                onBlur={(e) => onConfigChange(field.Key, e.target.value)}
+              />
+              <datalist id={`${field.Key}-suggestions`}>
+                {field.Suggestions.map((s) => <option key={s} value={s} />)}
+              </datalist>
+            </>
           ) : (
             <Textarea
               defaultValue={node.data.config[field.Key] ?? ''}

frontend/src/configure/ManualSchemaEditor.tsx

@@ -23,7 +23,16 @@ import styles from '../shared/ListCard.module.css'
 // ever populates them from a JSON response body (bodyFields() in
 // openapispec.go), so every output field is payload, never protocol.
 
-const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE']
+// The full set kin-openapi's PathItem struct actually recognizes
+// (openapi3/path_item.go: Get/Put/Post/Delete/Options/Head/Patch/
+// Trace, verified directly against its source, not assumed) --
+// deliberately does NOT include RFC 10008's QUERY (published June
+// 2026): OpenAPI 3.x has no spec-defined field for it yet, so an
+// operation declared here has to stay representable as a real OpenAPI
+// document. integration-http's own literal Method field (ADR-0016,
+// composition/integration.go) is unconstrained by this and does
+// support QUERY -- this list is specific to the schema-authoring path.
+const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE']
 const FIELD_TYPES: ManualField['type'][] = ['string', 'number', 'integer', 'boolean', 'object', 'array', 'map', 'date', 'datetime']
 const FIELD_INS: ManualField['in'][] = ['path', 'query', 'header', 'body']
 const PARAM_INS: ManualField['in'][] = ['path', 'query', 'header']

internal/adapters/httpconnector/httpconnector_test.go

@@ -62,6 +62,39 @@ func TestExecute_SendsBody(t *testing.T) {
 	}
 }
 
+// ADR-0016 Phase C: RFC 10008's QUERY method (published June 2026)
+// carries a request body like POST but isn't one of net/http's
+// pre-defined method constants -- proves directly, not assumed, that
+// Execute (and the retryablehttp.NewRequest/http.NewRequest chain
+// underneath it) sends a body on an arbitrary non-standard method
+// string exactly like it does for POST, since neither actually
+// special-cases the method when attaching a body.
+func TestExecute_QueryMethod_SendsBody(t *testing.T) {
+	var gotMethod, gotBody string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		b, _ := io.ReadAll(r.Body)
+		gotBody = string(b)
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"results":[]}`))
+	}))
+	defer srv.Close()
+
+	resp, err := Execute(Request{Method: "QUERY", URL: srv.URL, Body: `{"filter":{"status":"active"}}`})
+	if err != nil {
+		t.Fatalf("Execute returned error: %v", err)
+	}
+	if gotMethod != "QUERY" {
+		t.Errorf("server received method %q, want QUERY", gotMethod)
+	}
+	if gotBody != `{"filter":{"status":"active"}}` {
+		t.Errorf("server received body %q, want the QUERY body", gotBody)
+	}
+	if resp.StatusCode != http.StatusOK || resp.Body != `{"results":[]}` {
+		t.Errorf("resp = %+v, want a normal 200 response", resp)
+	}
+}
+
 // go-retryablehttp's DefaultRetryPolicy doesn't retry a plain 400 (only
 // 429 and 5xx-except-501 are retryable, verified directly against its
 // source -- see httpconnector.go's own newClient comment), so this

internal/domain/composition/execute_test.go

@@ -204,6 +204,38 @@ func TestExecuteWorkflow_IntegrationHTTP_APIKeyAuth(t *testing.T) {
 	}
 }
 
+// ADR-0016 Phase B/C: method is an open FieldText field, not a closed
+// FieldOptions enum -- proves ResolveNodeDefaults accepts a method
+// value outside the old 5-item list (RFC 10008's QUERY) and that it
+// actually reaches the server unmodified, through the real
+// ExecuteWorkflow path, not just httpconnector's own lower-level test.
+func TestExecuteWorkflow_IntegrationHTTP_QueryMethod_Accepted(t *testing.T) {
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	withHTTPRequestLookup(t, func(string) (ResolvedHTTPRequest, error) {
+		return ResolvedHTTPRequest{BaseURL: srv.URL, AuthType: httprequest.AuthNone}, nil
+	})
+
+	nodes, err := ResolveNodeDefaults([]Node{{
+		NodeTypeID: "integration-http",
+		Config:     map[string]string{"requestId": "conn-1", "path": "/x", "method": "QUERY", "bodyTemplate": `{"filter":"active"}`},
+	}})
+	if err != nil {
+		t.Fatalf("ResolveNodeDefaults rejected method %q, want it accepted (open FieldText, ADR-0016): %v", "QUERY", err)
+	}
+	if _, err := ExecuteWorkflow(nodes, nil, nil); err != nil {
+		t.Fatalf("ExecuteWorkflow returned error: %v", err)
+	}
+	if gotMethod != "QUERY" {
+		t.Errorf("server received method %q, want QUERY", gotMethod)
+	}
+}
+
 func TestExecuteWorkflow_IntegrationHTTP_UnknownHTTPRequest_Rejected(t *testing.T) {
 	withHTTPRequestLookup(t, func(id string) (ResolvedHTTPRequest, error) {
 		return ResolvedHTTPRequest{}, errors.New("no such request")

internal/domain/composition/integration.go

@@ -88,11 +88,21 @@ func SetHTTPRequestLookup(fn func(requestID string) (ResolvedHTTPRequest, error)
 	lookupHTTPRequestFn = fn
 }
 
+// httpMethodSuggestions are offered as autocomplete hints on the open
+// Method field below, not a closed set -- ADR-0016. Includes RFC
+// 10008's QUERY (published June 2026: safe + idempotent like GET, but
+// carries a request body like POST) alongside the traditional verbs;
+// any string is still accepted and sent as-is.
+var httpMethodSuggestions = []string{
+	http.MethodGet, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete,
+	http.MethodHead, http.MethodOptions, "QUERY",
+}
+
 func init() {
 	RegisterNodeType(NodeType{
 		ID: "integration-http", Kind: KindProcess,
 		Label:       "Integration: HTTP call",
-		Description: "Calls a Configure-authored request's API and replaces the payload with the response body. requestId isn't a closed FieldOptions set (unlike method below) because requests are runtime, Configure-authored data composition.go has no compile-time knowledge of -- the frontend Inspector renders a live picker for it (RefKind, docs/adr/0009), not a closed option list composition.go could declare here.",
+		Description: "Calls a Configure-authored request's API and replaces the payload with the response body. requestId and method are both open FieldText, not a closed FieldOptions set -- requests are runtime, Configure-authored data composition.go has no compile-time knowledge of (the frontend Inspector renders a live picker for requestId, RefKind, docs/adr/0009), and method must accept any HTTP method (including a new or custom one, e.g. RFC 10008's QUERY) without a code change here (ADR-0016).",
 		ConfigFields: []ConfigField{
 			{
 				Key: "requestId", Label: "Request ID",
@@ -106,9 +116,8 @@ func init() {
 			},
 			{
 				Key: "method", Label: "Method",
-				Description: "HTTP method for this call.",
-				Default:     http.MethodGet, Type: FieldOptions,
-				Options: []string{http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch},
+				Description: "HTTP method for this call -- any method is accepted, not just the suggested common ones.",
+				Default:     http.MethodGet, Type: FieldText, Suggestions: httpMethodSuggestions,
 			},
 			{
 				Key: "bodyTemplate", Label: "Body",

internal/domain/composition/types.go

@@ -81,6 +81,16 @@ type ConfigField struct {
 	// box. composition itself never reads RefKind -- nodeExec functions
 	// still just read the plain string ID out of Node.Config.
 	RefKind string
+	// Suggestions is only meaningful when Type == FieldText -- unlike
+	// Options (FieldOptions' closed enum), any value is still accepted;
+	// these are offered as autocomplete hints only (an HTML5 datalist on
+	// the frontend). ADR-0016: the open-vs-closed distinction this field
+	// exists for was decided directly against real precedent -- Bruno's
+	// own .bru format offers named HTTP methods but keeps an explicit
+	// `method: CUSTOM` escape hatch rather than a closed enum, since a
+	// closed list can't express a new or uncommon method (e.g. RFC
+	// 10008's QUERY, published June 2026) without a code change.
+	Suggestions []string
 }
 
 type NodeType struct {