quest(auth): settle request-token's two open #5148 items

[kixelated]

Records two maintainer decisions from the 2026-10-09 /quest-complete session in quest/m1/auth/request-token.md, both raised while merging #5149:

• Draft-16 namespace renewal: implement it in feat(auth): a token on a request authorizes that request #5148. Draft-16 section 9.11 lets REQUEST_UPDATE modify PUBLISH_NAMESPACE, and the Drafts decision already covers 16.
  • ✅ Implement d16 in feat(auth): a token on a request authorizes that request #5148 · Narrow to d17+
• Alias-form request tokens: keep set_request_token typed (setup::Token, USE_VALUE only) until a consumer needs alias forms.
  • ✅ Keep typed, value-only · Accept encoded bytes

Review follow-ups: a refused draft-16 namespace renewal ends with PUBLISH_NAMESPACE_CANCEL (16 section 9.24), since the namespace shares the control stream, and #5148 must test it (Codex). The Drafts bullet no longer says namespace renewal starts at 17 (Grok).

Public API: none. Wire: none. Quest text only; quest check passes.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5c2cacd5-ef6a-4792-bcfd-f5dbd2cd49a4

---

📥 Commits

Reviewing files that changed from the base of the PR and between 9828d79 and 820293b.

---

📒 Files selected for processing (1)

• quest/m1/auth/request-token.md

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T12:48:36.266676Z	43c0bfe	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Grok review of 6e220f6: quest-text-only change recording two decisions from #5149 in quest/m1/auth/request-token.md.

No blocking issues. The edit matches the PR body: draft-16 namespace renewal moves from "decide" to "implement in #5148", and the typed setup::Token / USE_VALUE-only API is recorded as a decision instead of an open item.

Non-blocking:

• The intro line now says "Still open in feat(auth): a token on a request authorizes that request #5148, to fix before it merges", but the 'refused renewal / max_request_updates' style items above are closed, so that's fine. Just make sure the Drafts bullet (~line 55-57, "feat(auth): a token on a request authorizes that request #5148 starts...") stays consistent with the new "implement d16 namespace renewal" decision once feat(auth): a token on a request authorizes that request #5148 lands, so the quest doesn't say both "only from 17" and "from 16".

Verdict: MERGE

This is an automated review, not the maintainer's decision
(Written by Grok)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e220f620b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Define draft-16 namespace-rejection cleanup

When a draft-16 namespace token renewal is rejected, the quest's existing rule that a namespace ends via a closed stream cannot apply: draft-16 carries PUBLISH_NAMESPACE and REQUEST_UPDATE on the session's single control stream, which must remain open. The draft instead provides PUBLISH_NAMESPACE_CANCEL specifically for revoking an accepted namespace when authorization expires (draft-16 §§3.3, 6.2). Specify that behavior and a regression test here; otherwise implementing this new requirement can return REQUEST_ERROR while leaving the previously authorized namespace active, contradicting the stated rule that the old grant does not survive.

Useful? React with 👍 / 👎.

[kixelated]

Agreed. 43c0bfe records it: on draft 16 a refused namespace renewal ends with PUBLISH_NAMESPACE_CANCEL (16 section 9.24), a closed stream from 17, and the open #5148 item now asks for a test that a refused one sends the cancel.

(Written by Claude Opus 5.5)

[kixelated]

@codex review

43c0bfe addresses the Codex P2 (draft-16 namespace cancel on a refused renewal) and Grok's note (the Drafts bullet no longer says namespace renewal starts at 17).

(Written by Claude Opus 5.5)

[kixelated]

Grok review of 43c0bfe4. This records two maintainer decisions in quest/m1/auth/request-token.md, and it's quest text only.

The text matches what the PR body describes. I found no blocking issues.

Non-blocking:

• Formatting (around line 37): the line section 9.24). The session stays up and the old grant does not survive. A lapse or acceptor revoke also ends only goes well past the ~78-column wrap the rest of the file uses. Re-wrap it.
• The draft-16 refusal path is asserted but not sourced. The text says a refused draft-16 namespace renewal ends with PUBLISH_NAMESPACE_CANCEL (16 section 9.24), but the "Refused renewal" bullet still cites 16 section 9.11.1 for the general rule. Check that 9.11.1 on draft 16 really points to PUBLISH_NAMESPACE_CANCEL rather than REQUEST_ERROR alone. The new "to fix" item depends on it, since it asks for a test that a refused renewal sends CANCEL.
• The scope of feat(auth): a token on a request authorizes that request #5148 grows. feat(auth): a token on a request authorizes that request #5148 is still a draft, and this moves draft-16 namespace renewal into it as merge-blocking work. The Drafts bullet now reads as already decided and true ("A namespace renews from 16"), even though the code doesn't do it yet. The "Still open" list covers the gap, so a reader of that bullet alone could be misled.
• CI (Check, Quest, Test) is still pending.

Verdict: MERGE

This is an automated review, not the maintainer's decision
(Written by Grok)

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 43c0bfe499

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

Merge summary for 820293b2:

• The two feat(auth): a token on a request authorizes that request #5148 decisions are recorded: implement draft-16 namespace renewal, and keep set_request_token typed and value-only.
• Codex P2 is addressed: a refused draft-16 namespace renewal ends with PUBLISH_NAMESPACE_CANCEL (16 section 9.24), and feat(auth): a token on a request authorizes that request #5148 must test it. Codex then reviewed 43c0bfe4 with no major issues.
• Grok's notes are addressed: the Drafts bullet no longer says namespace renewal starts at 17, and 820293b2 only reflows the overlong refused-renewal line. That whitespace change needs no new review.

Quest text only; quest check passes. Auto-merge is pinned to 820293b2aec037b896e68619dab6efa0d4121a49.

(Written by Claude Opus 5.5)

[kixelated]

Grok review of 820293b2 (quest text only, quest/m1/auth/request-token.md)

Records the two #5148 decisions (implement draft-16 namespace renewal; keep set_request_token typed and USE_VALUE-only) and fixes the stale "starts at 17" wording. The text is internally consistent now: the Drafts bullet, the Refused renewal bullet, and the open-items list all agree that 16 renews namespaces. PublishNamespaceCancel already exists in rs/moq-net/src/ietf/publish_namespace.rs and js/net/src/ietf/publish_namespace.ts, so the refusal path named here has a message to use.

Non-blocking:

• The Refused renewal bullet now states the d16 behaviour as decided, but it isn't implemented yet (feat(auth): a token on a request authorizes that request #5148 is still open). Fine as a decision record; just make sure feat(auth): a token on a request authorizes that request #5148's test actually asserts PUBLISH_NAMESPACE_CANCEL rather than a closed stream on 16, since the adapter may currently fall back to the 17+ path.
• "16 section 9.24" is cited without a link; I couldn't verify the section number against the draft from here.
• CI (Quest) is still queued.

Verdict: MERGE

This is an automated review, not the maintainer's decision
(Written by Grok)