[shivros]

Summary

Implements COD-500's bounded body_json mode for Rite's generic http_post action. It accepts JSON-compatible TOML values (rejecting datetimes and non-finite floats), substitutes supported placeholders only in configured string leaves, fails closed on missing/null references, and serializes the complete value with serde_json. The structured mode defaults to application/json and validates its explicit content type at config load. Legacy body_template and normalized-event JSON behavior remain unchanged.

Includes behavior tests for webhook and Iris subscription dispatch, hostile text preservation, nested values, no-send/error-safe failures, config/content-type validation, and generated handler list/get serialization. Updates the generic README and example. No Iris implementation or new public operation is included.

Verification

• cargo build --all-targets — passed
• cargo test --all-targets — passed (core, server, source, CLI/entrypoint tests)
• cargo clippy --all-targets -- -D warnings — passed
• cargo fmt --all -- --check — passed
• cargo run -p rite-codegen -- check — passed
• creed diff — passed (no drift)
• git diff --check — passed
• Temporary synthetic external harness (source at /opt/data/tmp/rite-cod500-iris-boundary-harness; no production credentials/network): cargo run --manifest-path /opt/data/tmp/rite-cod500-iris-boundary-harness/Cargo.toml — passed. It drove the exact adversarial body through Rite's Iris subscription into Iris's generated POST /messages/{thread_id} route and public MockProvider; exactly one send was recorded with the original body unchanged.

Scope

Local/synthetic validation only. No release, deployment, consumer repin, live forwarding, retries/receipts, or credential/auth-policy changes.

Linear: COD-500 — https://linear.app/codefold/issue/COD-500/rite-serialize-structured-json-bodies-for-generic-http-actions

[shivros]

🤖 Automated Review Panel

Reviewer A — OpenAI Codex (inherited runner reviewer)

• Blocking correctness findings: none.
• Confirmed bounded TOML-to-JSON conversion, rejection of TOML datetimes/non-finite floats, one-pass opaque string-leaf substitution, missing/null no-send behavior, value-free failures, shared builder use by both dispatch paths, and legacy behavior preservation.
• Non-blocking coverage note: suggested one committed test carrying hostile input through the generated Iris sink. The committed Rite tests exercise the hostile text through webhook and Iris subscription dispatch to a local receiver. In addition, this run's temporary external harness exercised that same adversarial body end-to-end through the actual generated Iris POST /messages/{thread_id} route and public MockProvider; exactly one send was recorded and the original body matched. The harness is temporary and not part of this PR, so a persistent cross-repository test remains a possible follow-up.

Reviewer B — Gemini 3 Flash (OpenRouter)

• Blocking correctness findings: none.
• Confirmed TOML domain restrictions, template opacity, fail-closed missing data, Content-Type policy, generated handler list/get serialization, shared webhook/subscription request construction, and unchanged legacy branches. No additional correctness concerns raised.

Runner verification

• All seven Rite gates passed: build, all-target tests, strict Clippy, fmt, codegen freshness, creed diff, and git diff --check.
• Local generated-Iris boundary harness passed with MockProvider; no Iris source files were modified. No release, deployment, repin, live forwarding, or credential-policy changes were made.

[shivros]

Auto-Merge Gate

Confidence: 0.91

• Goal alignment: Implements COD-500's bounded generic body_json mode: JSON-compatible TOML conversion, string-leaf-only opaque interpolation, fail-closed missing/null data, load-time configuration and content-type validation, and the shared webhook/Iris request path.
• Validation: GitHub CI test and Creed context drift are successful. The gate independently ran cargo fmt --all -- --check, cargo test --locked --all-targets, cargo clippy --locked --all-targets -- -D warnings, cargo run --locked -p rite-codegen -- check, creed diff, and git diff --check successfully at cea5aee.
• Scope: Five coherent Rite/docs/example files; no secret, auth-policy, deploy, release, consumer-repin, or destructive behavior changes.
• Tracker/reviews: COD-500 was rechecked for manual-review / no-auto-merge markers (none found). The visible dual-model review panel has no blocking finding.

Self-approval may be unavailable because this gate operates as the PR author; this comment is the approval rationale audit record.