dceaf82934
Full-codebase-audit 2026-05-30 outputs: - Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md - 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer). - Scanner docs from scratch (was zero): architecture, data model, API ref, payment flow, operations runbook + repo README. - Doc-sync updates across API reference, data models, flows, design system. - Secret Rotation Runbook (08 - Operations) for the exposed credentials. - Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js. Issues remain status:open intentionally — the code fixes are uncommitted-then-committed working-tree changes per repo and aren't "resolved" until merged/deployed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1.1 KiB
1.1 KiB
issue, title, severity, domain, labels, status, created, source
| issue | title | severity | domain | labels | status | created | source | ||
|---|---|---|---|---|---|---|---|---|---|
| 128 | Scanner: POST /intents returns 200 instead of 201 for new resource creation | low | Scanner |
|
open | 2026-05-30 | Full Codebase Audit 2026-05-30 |
Scanner: POST /intents returns 200 instead of 201 for new resource creation
Severity: low Domain: Scanner Labels: scanner, api-contract
Description
scanner/api.go:234 returns HTTP 200 for both new intent creation and idempotent replays. REST convention is 201 for new resource creation and 200 for idempotent replays. Clients that check status codes to distinguish creation from replay cannot do so currently.
Options
- Return 201 on new creation, 200 on idempotent replay.
- Always 201.
- Add a header/body flag indicating replay vs new.
Recommendation
Return 201 for new resources and 200 for idempotent replays. Could affect clients keyed on status codes.
Affected Files
scanner/api.go:234
References
- Full Codebase Audit 2026-05-30 — DEC-63