auto-data-snapshot: 2026-08-28T22:35:10 (2 data files) — README.md verification/e2e-proof.json

ef09b11a584d619ff3149ffe787b2dda7b4d7b4b · 2026-08-28 22:36:58 -0700 · auto-commit-fleet
Files touched

M README.md
M verification/e2e-proof.json
Diff

commit ef09b11a584d619ff3149ffe787b2dda7b4d7b4b
Author: auto-commit-fleet <steve@designerwallcoverings.com>
Date:   Fri Aug 28 22:36:58 2026 -0700

    auto-data-snapshot: 2026-08-28T22:35:10 (2 data files) — README.md verification/e2e-proof.json
---
 README.md                   |  5 ++++-
 verification/e2e-proof.json | 26 ++++++++++++++++++++++----
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 3233f07..cb82fab 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,10 @@ specifications and price before quoting. It does not query or mutate Shopify or
 height at 100 ft, and `num_walls` must be an integer from 1 through 100. These
 conservative bounds prevent coercion and overflow. A Shopify SKU alias is accepted
 only for an exact `shopify_match:true` record. Prototype/stand-in rows still return
-coverage metrics, but return null prices with `quote_authoritative:false`.
+coverage metrics, but return null prices with `quote_authoritative:false`. JSON request
+bodies are capped at 16 KiB (`413` when exceeded; malformed JSON is `400`). At process
+startup the entire checked-in roll snapshot is schema-validated before the server binds;
+an empty, malformed, duplicate-SKU, or invalid-spec snapshot fails closed.
 
 ## Fill it in
 - `data/products.json` — array of `{ title, sku, price, hex, image }`.
diff --git a/verification/e2e-proof.json b/verification/e2e-proof.json
index fa1437b..d7e25ce 100644
--- a/verification/e2e-proof.json
+++ b/verification/e2e-proof.json
@@ -2,10 +2,10 @@
   "intent": "Provide a read-only room-dimensions-to-roll-count API contract using the existing local calculator.",
   "risk_tier": "R1 isolated backend API; no production data or external integration",
   "environment": "local Node HTTP server on an ephemeral loopback port",
-  "build_identity": "git parent 7dabb56 plus the owned Cycle 12 server/test/documentation diff",
-  "timestamp": "2026-08-29T05:11:00Z",
-  "ticket": "TK-10948-add-local-dw-room-coverage-api-contract",
-  "precondition": "estimate-instant exposed /api/estimate for inch dimensions but had no stable room-level snake_case API contract.",
+  "build_identity": "git parent 062bfad plus the owned Cycle 14 server/test/documentation diff",
+  "timestamp": "2026-08-29T05:39:00Z",
+  "ticket": "TK-10951-cap-json-bodies-and-validate-roll-snapshot",
+  "precondition": "POST bodies were unbounded and decoded per stream chunk; roll loading silently returned an empty array without validating the complete snapshot.",
   "checks": [
     {
       "verdict": "PASS",
@@ -24,6 +24,18 @@
       "boundary": "syntax and diff",
       "command": "node --check server.js && git diff --check",
       "assertions": "server parses and diff has no whitespace errors"
+    },
+    {
+      "verdict": "PASS",
+      "boundary": "request size and JSON parsing",
+      "command": "node --test test/calculate-coverage.test.js",
+      "assertions": "all three POST routes return 413 above 16 KiB and 400 for malformed JSON; split multibyte UTF-8 round-trips exactly and aborted streams settle"
+    },
+    {
+      "verdict": "PASS",
+      "boundary": "startup snapshot schema",
+      "command": "node --test test/calculate-coverage.test.js",
+      "assertions": "complete checked-in snapshot passes while empty, duplicate, invalid-spec, invalid-match, and invalid exact-match inputs fail"
     }
   ],
   "negative_checks": [
@@ -39,6 +51,12 @@
     "negative roll width/length/repeat and unsupported match",
     "non-finite estimator output from malformed roll data",
     "empty HTTP payload"
+    ,"oversized HTTP payload"
+    ,"malformed JSON"
+    ,"invalid whole-snapshot schema"
+    ,"split multibyte UTF-8 and invalid UTF-8"
+    ,"aborted request stream"
+    ,"noncanonical snapshot strings"
   ],
   "side_effects": "none; test server is ephemeral and closed by the test; no Shopify, dw_unified, lead, send, deploy, restart, or scheduled-job action",
   "cleanup": "ephemeral HTTP server closed after assertions",
← 062bfad Harden roll specs and SKU resolution · back to Estimate Instant · fix: return HTTP 400 on estimate error (null roll / invalid 014cf2e →