feat: framework v1 slice 2 — the remaining ledger, ten items
- After seam: interface After + Aw + use_after; dispatch funnels every
response (handler/short-circuit/404/405) through the after chain;
the WS 101 sentinel skips it (never serialized)
- http/secure.wo: SecurityHeaders (nosniff/DENY/referrer; HSTS stays
at the TLS proxy), Cors (preflight 204 before + origin stamp after,
one class both halves), HostAllow (421), client_ip (XFF parsing —
peer VERIFY stays story 35)
- http/nego.wo: accepts() (exact, type/*, */*; q stripped not ranked),
etag_for (quoted base64 sha256), with_etag (If-None-Match -> 304)
- router: *rest wildcard (last segment, empty rest matches), Group
(prefix + routes + group middleware) + Gmw prefix-scoped entries,
App.mount; new App fields carry defaults so standing ctor literals
keep compiling
- Req grows ctx bag; parse rejects duplicate Content-Length (400,
RFC 9112 §6.3)
- web-app exercises all of it; gate grows 26 -> 38 checks (wildcards,
group+ctx, etag+304, 406/200 negotiation, sec headers, 421,
preflight+origin stamp, dup-CL 400)
- ledger rows flipped; dep graph section 3 grown (slice-2 done nodes,
crypto gate cleared, cookie/CSRF/session/webhook/JWT now ready)
- merges: chat-ws-lifecycle (digests for ETag; WS + lifecycle ride
along) + site-sample (second consumer gate); battery 13/13
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shoney.arickathil
82713e4010