miroir/crates
jedarden 7188e1b9a0 P2.9: Implement conditional _miroir_expires_at write rejection (miroir_reserved_field)
Per plan §5 "Reserved fields", the _miroir_expires_at field is now conditionally
reserved when ttl.enabled: true. Previously, writes always accepted this field;
now they are rejected with HTTP 400 miroir_reserved_field when TTL is enabled.

Changes:
- Added ttl.enabled and ttl.expires_at_field config access to documents.rs validation
- Added conditional rejection of _miroir_expires_at when ttl.enabled: true
- Updated comments to reflect new behavior (field is reserved when TTL enabled)
- Updated unit tests to cover all four matrix cells:
  * _miroir_shard: Always rejected (unconditional)
  * _miroir_updated_at: Rejected when anti_entropy.enabled: true
  * _miroir_expires_at: Rejected when ttl.enabled: true
  * All fields: Allowed when their respective configs are disabled

The orchestrator stamping path (injecting _miroir_shard after validation) remains
exempt from this rejection.

Resolves: bf-5xqk

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-20 07:52:41 -04:00
..
miroir-core P6.10 Wire §14.8 resource-aware config defaults into Rust + values.yaml 2026-05-20 07:35:03 -04:00
miroir-ctl P3: Phase 3 Task Registry + Persistence — COMPLETE 2026-05-02 16:50:42 -04:00
miroir-proxy P2.9: Implement conditional _miroir_expires_at write rejection (miroir_reserved_field) 2026-05-20 07:52:41 -04:00