[XiNiHa]

Summary

greem::http::handle owns the whole GraphQL-over-HTTP exchange that the axum example and greem-bench's serve each used to hand-write. CI then audits it with graphql-http.

handle(schema, roots, ctx, RequestParts { method, query_string, content_type, accept, body }, options)
  method            GET | POST | QUERY, else 405 Allow: GET, POST, QUERY
  negotiate(Accept) graphql-response+json | json | multipart (q-values), else 406
  request(method)   GET query string | POST, QUERY application/json (415 / 400 / 422)
  schema.operation  RequestErrorKind::Parse → 400, any other kind → 422
  GET + mutation    405 Allow: POST
  QUERY + mutation  422
  execute_stream    first payload has hasNext, and multipart q ≥ JSON's → multipart 200
                    multipart-only Accept → even a single result as one part, 200
                    else 200, or 294 when data comes with errors

Status codes follow the GraphQL-over-HTTP draft, not graphql-http's audits where the two disagree (ADR-0012). A legacy application/json client gets the same codes, and only a 2xx keeps application/json. QUERY (RFC 10008) is served like POST but only for queries, as graphql-over-http#411 proposes ahead of the draft, whose "MAY support other methods" already allows it.

 greem/src/
-├── http.rs
+├── http/
+│   ├── mod.rs        # handle, Request, multipart_part
+│   ├── accept.rs     # Accept negotiation
+│   ├── request.rs    # RequestParts, GET/POST/QUERY parsing, well-formedness
+│   ├── response.rs   # Response, Body, status per payload
+│   └── convert.rs    # `http` feature: http::request::Parts in, http::Response<Body> out
+http-audit/           # graphql-http 1.23.1 audits + overrides.json (root pnpm workspace)
+.github/workflows/http-audit.yml          # audit the example, job summary, artifact
+.github/workflows/http-audit-comment.yml  # workflow_run: sticky PR comment, forks included

The http feature is opt-in. actix-web sits on http 0.2, so the core takes plain &str/&[u8] parts. bench/ becomes its own pnpm workspace, and mise.toml now pins pnpm.

Evidence

• Before: graphql-http 1.23.1 against examples/axum had 0 errors, 4 warnings (22EB, 572B, FDE2, 7B9B) and 15 notices. GET wasn't served (5A70, D6D5, 6A70), and nothing ever answered application/graphql-response+json.
  After: 39 pass, 0 errors, and 4 warnings, all overridden as draft conflicts:

  Audit	graphql-http expects	greem, per the draft
  572B, FDE2	200 for a parse failure under application/json	400
  7B9B	200 for a coercion failure under application/json	422
  86EE	400 for a coercion failure under graphql-response+json	422

  The 18 notices are the MAY-level "400 for malformed parameters" audits; greem answers 422, as the draft says. 74FF passes, because its "validation failure" document doesn't even lex.

• Over a real socket, curl -X QUERY against the example gets 200 for a query and 422 for a mutation, and PUT gets 405 Allow: GET, POST, QUERY. graphql-http has no QUERY audits, so the audit result is unchanged.

• The gate fails as it should: with 86EE removed from the overrides and the passing 74FF added, the audit exits 1 and reports both problems.

• cargo test -p greem --all-features --test http: 13 cases covering every status path, plus http round-trips. The example and serve tests, workspace clippy, docs, MSRV 1.96, and the bench/ workspace build all pass.

Merge Danger

Door: two-way

The comment workflow only runs from main (workflow_run), so this PR shows the report in the job summary; the first sticky comment will appear on the next PR.

Blast Radius: API

• These are breaking changes to greem's public API: RequestErrors becomes { kind, errors }, PayloadKind::RequestError carries a RequestErrorKind, and greem::http::accepts_multipart is gone.
• Existing HTTP clients of the example see new status codes. Validation errors go from 400 to 422, and partial success is 294, an unregistered 2xx code that intermediaries which allow only known codes may reject.
• JSON responses now include ; charset=utf-8 in their content type.
• QUERY follows graphql-over-http#411, which is still open. If it lands differently, for example with 405 for a mutation, handle needs a follow-up.

Closes #21

🤖 Generated with Claude Code

[codspeed]

Merging this PR will not alter performance

✅ 28 untouched benchmarks

---

_{Comparing http-audit (51d3f27) with main (b5403a6)}

[XiNiHa]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T06:42:27.251996Z	6950f1f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6950f1f27b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".