[kixelated]

Problem

This PR holds the claim on quest/m0/backport-release-hardening.md. Its first scope, the dot-segment and auth-redirect refusals, shipped in moq-dev/moq#7599 (moq-auth 0.2.3, moq-relay 0.17.11). What remains is two release ports: moq-dev/moq#7210's relay HTTP hardening and moq-dev/moq#7414's credit-starved withdrawal, then the patch cut.

Decisions

• Who ports, and how many quests:

  • ✅ One quest, one release PR per port, as fix(auth): backport dot-segment and redirect refusals #7599 did, with this PR as the main-side checkpoint.
  • Split the two ports into their own quests and delete this one.

  Decided 2026-11-04 (maintainer, /quest-unblock). Recorded in the quest Plan.

Approach

• Opened the two ports against release, each reproduced on release first, checked from a checkout outside the main checkout (so release's own .cargo/config.toml applies), and reviewed locally by Codex with no findings. Both are ready for review:

  • moq-dev/moq#7920 fix(relay): backport HTTP response and ops-listener hardening: /fetch serves application/octet-stream, /fetch and /announced send nosniff and private, no-store, and the ops listener refuses Origin and any authority other than the accepted socket's.
  • moq-dev/moq#7922 fix(net): backport withdrawing IETF advertisements without send credit to release: the announce loop buffers each PUBLISH_NAMESPACE and REQUEST_UPDATE and writes and reads it in its event wait, so a starved request no longer pins the loop and its withdrawal resets it in both directions. A hand-port: release's publisher lacks main's per-request machinery.

• Earlier: merged origin/main and updated the quest: the 2026-11-04 decision, the two open ports, and a ## Waiting item for the maintainer's merge and cut.

• Both ports shipped: the maintainer cut the patch release (moq-dev/moq#7936, merged 2026-11-05), and crates.io's moq-net 0.3.21 and moq-relay 0.17.13 contain fix(relay): backport HTTP response and ops-listener hardening #7920 and fix(net): backport withdrawing IETF advertisements without send credit to release #7922. So this PR now merges origin/main and deletes the finished quest and its milestone link with quest rm.

Impact

• This PR: quest documents only. No public API or wire change.
• The ports: no public API change (sh/api-diff/run.sh --deny rust: all 30 crates unchanged on each). Wire details are in each PR.
• No versions, tags, publication, deployment, or merges.

Choices made without asking

• moq-dev/moq#7922 keeps release's handling of a request stream the peer ends before answering (it ends the announce loop), where main ends only that advertisement; that change predates fix(net): withdraw IETF advertisements without send credit #7414 on main. Main's epoch-replacement and credential cases are not ported, since release has neither.

Validation

At head bca4eeb6e0, against origin/main:

• quest check --base origin/main --branch quest/m0/backport-release-hardening: pass, 578 documents.

Review

Skipped for head bca4eeb6e0: the diff against origin/main only deletes quest/m0/backport-release-hardening.md and its line in quest/m0/README.md; no code. Each port has its own record: Codex gpt-6.1-sol, medium, round 1, no findings, on moq-dev/moq#7920 and moq-dev/moq#7922.

Follow-ups

• The Rust crate selector should fail loud when cargo metadata fails. On release, a Cargo config merge failure made just ci check and just ci test print rs: no crates affected; skipping. and exit 0. Main's sh/rs/select.sh captures cargo metadata the same way, inside a command substitution, but it has not been reproduced there.

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5302ea33-7a3d-4685-af7c-4fd2c52fb9a5

Commits

Reviewing files that changed from the base of the PR and between 020dd7f and bca4eeb.

Files selected for processing: 2

• quest/m0/README.md
• quest/m0/backport-release-hardening.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: bca4eeb6e0b5fe3dbe992470b4ae8dd8054514a7

Findings: No actionable issues found in this documentation-only diff.

• The diff removes only quest/m0/backport-release-hardening.md and its entry in quest/m0/README.md (23 deleted lines). The milestone no longer links to the deleted quest; GitHub's indexed code search found that entry as the only reference to its filename.
• The completion record is supported by merged release PRs #7599, #7920, and #7922, followed by the merged release cut #7936. The moq-net-v0.3.21 and moq-relay-v0.17.13 tags both point to #7936's release commit. No implementation, API, wire format, or version is changed here.
• No earlier submitted review or outstanding finding was present on this PR, so there is no prior fix to reassess.

Direction: Removing the finished quest and its index entry is consistent with the completed release work. No change requested.

Limits: GitHub-only static review of this PR and its completion evidence, not a fresh audit of the backported implementations. I did not run quest context, quest check, builds, or tests, or independently inspect crates.io artifacts. The latest Check workflow for this exact head was still in progress at the final check; this is not a CI-pass or merge-readiness claim.

[pullfrog]

✅ No new issues found.

Reviewed changes

• Quest file deleted — quest/m0/backport-release-hardening.md is removed in full (22 lines), with no replacement prose, matching the repo's convention for a completed quest.
• Milestone link removed — its ## Required line is dropped from quest/m0/README.md, leaving the m0 list well formed.
• Completion verified — the diff against origin/main is only these two deletions, and both remaining ports plus the patch cut are merged: #7920 and #7922 into release, then #7936. The earlier dot-segment and auth-redirect items shipped in #7599.
• No dangling references — a repo-wide grep for backport-release-hardening and for the quest title returns nothing on the head, including .github/ audit notes and other quest plans.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}