security: reconstruct exact HTTP method strings on current policy stack

[seonghobae]

Purpose

Reconstruct issue #124 / superseded stacked PR #129 on the current scalar-policy reconstruction without transferring predecessor checks, reviews, approvals, or base identity.

Exact test-first boundary

• exact predecessor candidate: PR security: reconstruct scalar integer sealing on current main #153 head cbba06bcbe11348ba29380b122b6df78f728030c on security/reconstruct-policy-integer-values-d3498;
• test-only reconstruction head: 02698509216af93952137fb9913e0e07504a5370;
• current delta: only tests/test_policy_method_value_integrity.py;
• historical security: require exact HTTP method policy strings #129 remains evidence only and stays Draft on its old closed-predecessor branch until this reconstruction proves the unique delta on the current stack.

The RED contract requires exact built-in str values before individual HTTP method normalization and before comma-separated allowed_methods splitting in all three public construction paths. Ordinary built-in strings, uppercase normalization, RFC 9110 token semantics, the comma-separated operator form, and unconditional CONNECT rejection must remain unchanged.

Keep Draft until exact RED is reproduced on this exact stack, the narrow source fix is applied, documentation/release-history parity is reconstructed against the current predecessor, exact-head CI/SAST are green, and the predecessor/successor graph is reconciled. Aggregate Security Scan success is not dependency-review acceptance while the organization-owned actual pinned Dependency review action is skipped.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 84e8caa0-0c45-4081-acf0-ff684b576da6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by the current integrated-stack reconstruction #161. Fresh exact-diff review shows #161 carries the same five-path method-policy delta (CHANGELOG, canonical policy-integrity guide, _policy_normalization.py, policy.py, and focused regressions) on current predecessor #159 exact head e80f83da3a22321e4fc013a05b3d94591dc304c0, while additionally proving the runtime allows_http_method(...) boundary rejects a non-exact str before normalization. #161 exact head 721f6ce10035a0e7caded2eb8417cdc6894c7e70 has exact checkout CI success across Python 3.10–3.13/package acceptance; Python 3.13.14 reports 785 passed with 1,637/1,637 production statements and 562/562 branches. No checks/reviews/approvals transfer from this historical branch, and #161 remains separately gated by its exact-current security/review evidence and the organization-owned dependency-review prerequisite. Closing this stale reconstruction unmerged.