spec(port): port specs/port/trios-railway/crates/trios-railway-core/src/transport.t27 (Closes #9795)

[dmitrii-f-t27]

Summary

Port gHashTag/trios-railway:crates/trios-railway-core/src/transport.rs (at 8b229e9489ee, 210+ lines) as specs/port/trios-railway/crates/trios-railway-core/src/transport.t27 — Roadmap Stage 6 (goal #4548), target t27c gen-rust. Closes #9795.

The original is RW-02: the minimal Railway GraphQL client with two authorization styles — team (the default) sending Authorization: Bearer for account tokens, project sending Project-Access-Token for project-scoped tokens — where the env read allows operators to force the mode and otherwise guesses from the token's shape: a canonical 8-4-4-4-12 hex UUID means a project token.

Per the issue's rule ("Port the decision, not the plumbing"), the eight listed functions are ported under their names — seven as tested pure functions, Client_token_fingerprint as the one undefined; transport (its body delegates to the hash module's audit-safe fingerprint, never exposing the token) — with 9 tests (36 runtime asserts, 0 vacuous, 13/14 coverage — the only untested function is that transport):

• is_uuid_like — the canonical UUID shape check byte by byte: 36 bytes, dashes at 8, 13, 18, 23, hex digits elsewhere, with uuid_hex_digit and is_dash_position as its tested helpers (original lines 16-33);
• Client_from_env — the MissingToken gate, the RAILWAY_TOKEN_AUTH override chain (team | bearer | personal → team, project → project), and the UUID heuristic (a UUID-shaped token guesses project) (lines 88-100);
• Client_with_token (the team default) / Client_with_token_and_mode (explicit) / Client_auth_mode (the readback) / Client_with_endpoint (the override);
• Client_query — the two header names and the verdicts: GraphQL errors answer kind graphql, absent data answers empty data (lines 139-170).

The token itself is never stored in the port — presence flags carry its decisions.

A note on the second commit

A post-commit dupe_scan found is_hex_digit already carried by two other specs (specs/compiler/lexer.t27, specs/igla/race/backend.t27) — the name is not mandated by the issue — so it is renamed to uuid_hex_digit, making every introduced name unique across the 2040 specs. Both commits carry their Closes #9795 reference, satisfying the per-commit L1 TRACEABILITY rule.

Verification (all run live from the worktree root, zig 0.16.0, after the rename)

• t27c parse: OK. t27c spec-status: IMPLEMENTED. t27c typecheck: 0 errors, 0 warnings.
• t27c coverage: 13/14 tested — the only untested function is the Client_token_fingerprint transport, by design.
• t27c test-report: 9 tests / 9 pass / 0 FAIL / 0 BLOCKED, 0 vacuous passes — the canonical UUID accepted; wrong length, a broken dash and a non-hex digit rejected; the hex-digit and dash-position tables; the missing-token gate; every override; the heuristic both ways; the team default and readback; the endpoint override; both headers and all three query verdicts.
• t27c gen | grep -c 'not yet implemented': 0; gen | wc -l: 197 (> 12).
• grep -cE '^\s*(pub )?fn (is_uuid_like|Client_from_env|Client_with_token|Client_with_token_and_mode|Client_auth_mode|Client_with_endpoint|Client_token_fingerprint|Client_query)\(': 8. grep -cE '^\s*test\s+(["|[A-Za-z_])': 9 (≥ 8).
• Boundary: git status --short — exactly this one file. The repo's lefthook pre-commit passed on both commits.
• dupe_scan: all 16 introduced names unique across 2040 specs (after the rename); the bare body scan adds no duplicate group (752 bodies / 221 groups on base, identical with this spec present).

Dmitrii Fedorov (@dmitrii-f-t27)

[dmitrii-f-t27]

@gHashTag Please merge this PR into master via the golden chain — rights on gHashTag/t27 are read-only for me (403), so the merge itself needs your action.

What this is: the #9795 port — crates/trios-railway-core/src/transport.rs (gHashTag/trios-railway, at 8b229e9489ee, 210+ lines) re-authored as specs/port/trios-railway/crates/trios-railway-core/src/transport.t27. One file, head c4bcca674, Closes #9795. The second commit is a helper rename (is_hex_digit → uuid_hex_digit, the old name carried by two other specs); both commits carry their Closes #9795 reference, so the per-commit L1 TRACEABILITY rule is satisfied — Check L1 is green.

What is verified:

• t27c parse OK, spec-status IMPLEMENTED, typecheck 0 errors / 0 warnings, coverage 13/14 — the only untested function is the Client_token_fingerprint transport (its body delegates to the hash module's audit-safe fingerprint, never exposing the token), by design; t27c test-report 9 tests / 9 pass / 0 FAIL / 0 BLOCKED, 0 vacuous.
• gen → 197 lines, 0 not yet implemented; the 8 required names count exactly 8; 9 test blocks; boundary exactly the one file.
• dupe_scan: all 16 introduced names unique across 2040 specs (after the rename); the bare body scan adds no duplicate group (752/221 unchanged).
• The t27b-native-run artifact of this head (commit c4bcca6, run 39010623310): transport.t27 row — reference pass, t27b pass, tests 9, invariants 0, asserts 36, blockers [], detail empty, reference_disagree: [].

CI (head c4bcca6): required trio green — validate, check-linked-issue, parse-ratchet — and Check L1 TRACEABILITY green; 26 checks pass overall, incl. emit-bitexact, t27b-native-linux, t27b-native-macos.

The 3 reds are the base-red trio, not this change: cli-tri (the #3324 include_str!), duplicate-bodies (only the known base names), t27b-native-ratchet (the same verdict red the Queen's port PRs carry; this spec's own row is reference pass + t27b pass — the registration debt is the UNLISTED class).

After the merge I will: verify the spec file live on the merge SHA, confirm #9795 auto-closed, and file the 14-step report.

Dmitrii Fedorov (@dmitrii-f-t27)