[shivros]

Summary

Implements COD-487's bounded, operation-declared typed HTTP error responses.

• Adds explicit, validated http_error_responses declarations to Hydra operations.
• Generates private-state Axum IntoResponse types and public typed constructors for unary and SSE HTTP operations without changing the existing SSE binding hook.
• Adds compiled router fixtures for exact 400/409/429/503 JSON responses, optional-field omission, collision validation, fresh-generation parity, and deterministic double writes.
• Uses Rust-valid string-literal generation for declared constants, including control characters.

Validation

• cargo build --all-targets
• cargo test --all-targets (49 codegen + 14 Notes surface + 6 security-scan tests)
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p hydra-codegen --bin hydra-codegen -- check from examples/notes and examples/security-scan
• creed diff
• git diff --check

Scope boundary

This does not add replay classification, authentication, new routes, changed SSE binding signatures, consumer adoption, release/tag work, deployment, or live behavior. Hydra owns only the declared wire representation; consumers retain runtime classification and stream decisions.

Linear: https://linear.app/codefold/issue/COD-487

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra (Codex)

Final: clean.

The initial pass found a blocking generator bug: JSON's four-digit control-character escape form is not valid Rust source syntax. The implementation was corrected to emit Rust-valid string literals, and the compiled/fresh fixture now exercises a real control character using Rust's braced Unicode escape form. Final review verified the remediation, typed error model/validation, collision handling, SSE bind-hook preservation, compiled router behavior, and deterministic fixture generation.

Reviewer B — Gemini 3 Flash (OpenRouter)

Final: clean.

Confirmed bounded HTTP-only declarations, exact status/body construction, private response state, omitted optional fields, preserved SSE runtime binding, Rust-valid control-character literal rendering, and deterministic fixture checks. No correctness or goal-alignment issues found.

[shivros]

Auto-Merge Gate

Confidence: 0.92

COD-487 directly implements its bounded declared-HTTP-error contract: declaration models and validation, deterministic generated private response state with public constructors, preserved SSE binding ownership, and compiled router fixtures covering exact status, JSON content type, optional omission, control-character literal generation, and byte-deterministic output. The linked Linear ticket contains no do-not-merge/manual-review instruction.

Checks observed: CI Test and Creed context drift succeeded. Independent local verification on the PR head passed: cargo test --all-targets (49 codegen + 14 Notes + 6 security-scan tests), cargo clippy --all-targets -- -D warnings, and cargo fmt --all -- --check.

Scope limits: no replay classification, authentication, consumer adoption, release/tag, deployment, or live behavior is included.