[csdev19]

Refs NIW2-315. Spec: design/schema-validation-rules.md. ADRs: 0023 (laqi.config.json is repository content), 0024 (endpoint paths are literal routes).

Verified while writing the spec

• ReDoS: GET /x/:id{(a+)+$} blocks the event loop. 27 characters take 1.6 s, and the time multiplies by 4 every two characters.
• Serve-time 500s: 1xx, 204 with a body, a bad header name and a CRLF in a header value all answer 500 on every request.
• New (high): CORS bypass. A mock header Access-Control-Allow-Origin: * overrides the cors allowlist, including through the tunnel. That bypasses ADR-0007.

Decisions

• Config paths must be project-relative. The --dir and --file flags stay free.
• The config is strictObject at every level, and "*" is refused in cors.
• An invalid config stops the CLI with exit 5.
• Endpoint paths follow a literal grammar.
• Status must be at least 200, with no body on 204/205/304.
• Header names and values are validated against RFC 9110, with at most 64 headers. Framing and access-control-* headers are refused.
• Mock objects with unknown keys are still served, but flagged as degraded. Writes that carry unknown keys are refused.
• Ships as one feat!, laqi@3.0.0.

Open questions

1. Refuse a monorepo schemaSources.root that points to ../../? Recommendation: refuse.
2. Refuse a trailing slash? Recommendation: refuse.
3. Exit code: reuse 5, or add a new 9?
4. $schema in mock files is a load error today. Which ticket fixes it?

Status

This PR contains only the design spec and ADR drafts. It is opened as a draft so the design is not lost. The implementation will land on this same branch after the open questions are answered. Everything is "proposed, not implemented".

Part of the 2026-10-12 audit, umbrella NIW2-302. Specs were written by Fable agents against a read-only export of main at ee34302. The ADR numbers (0014–0026) are assigned across all eight audit PRs. decisions/index.md is not edited in these PRs, to avoid eight-way conflicts; add the index rows when each PR is promoted.

🤖 Generated with Claude Code