From 032163769c238cb8737b537249c67dea3756d56b Mon Sep 17 00:00:00 2001
From: antoinetoussaint-byte
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Sun, 25 Oct 2026 16:05:10 -0400
Subject: [PATCH] fix!: the authority is asked about the operation dispatched,
 never the decoded path

Review fixes for #75 (r1):

- F1 (blocker, security) and F2: wrapRequest asked the authority about
  r.Method+" "+r.URL.Path, the decoded path, while the mux dispatches on the
  escaped one, so /pages/secret%2Fhistory ran /pages/{id} under the
  /pages/{id}/history row; and a subtree beside {id} matched two rows, which
  the authority refuses as ambiguous. mountOperations now hands wrapRequest
  the dispatched operation's own row, verb+" "+servedRoute(path), which the
  authority finds by exact name.
- F4: InterfaceInfo.BasePath is deleted. The CLI prefixes every row with it
  while the edge forwards on /v1/<id> and the runtime checks routes as
  served, so no non-empty value matched a request.
- F5: InvalidArgument/OutOfRange from the authority's Check is 400 with the
  authority's reason (ErrRequestInvalid), not 503 "try again".
- F6: a relayed stream's first message is bounded by the method's Timeout
  again.
- F3 is recorded in the CHANGELOG and README: closes when authority#1 merges
  with a merge commit and the runtime re-pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                  |  33 ++++++++++
 README.md                     |  32 +++++++---
 authority.go                  |  20 ++++--
 authority_test.go             | 111 ++++++++++++++++++++++++++++------
 dispatch_test.go              | 107 ++++++++++++++++++++++++++++++++
 enforced_test.go              |   2 +-
 operations.go                 |  28 ++++-----
 operations_test.go            |   7 ++-
 passthrough.go                |   4 +-
 passthrough_authority.go      |   7 ++-
 passthrough_authority_test.go |  17 +++++-
 passthrough_test.go           |   2 +-
 request_handler_test.go       |   6 +-
 solution.go                   |  14 ++++-
 stream.go                     |  24 ++++++--
 typed_boundary_test.go        |   4 +-
 16 files changed, 349 insertions(+), 69 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2054f2..051c5dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,38 @@
 # Changelog
 
+## Unreleased — review fixes for #75: the authority is asked about the operation dispatched (breaking)
+
+From the independent review of #75 (r1):
+
+- **The route checked is the operation dispatched (F1, security; F2).** The
+  authority was asked about `r.Method + " " + r.URL.Path`, the decoded path,
+  while the mux dispatches on the escaped one: `GET /v1/page/pages/secret%2Fhistory`
+  ran the `/pages/{id}` operation and was checked against the
+  `/pages/{id}/history` row, so a caller holding only the weaker history row
+  ran the page handler. The same root made a subtree `/x/` beside `/x/{id}`
+  (legal for the mux) a path the authority refuses as matching two routes.
+  `wrapRequest` now asks about the dispatched operation's own row,
+  `"<VERB> " + servedRoute(path)`, which the authority finds by exact name.
+- **`InterfaceInfo.BasePath` is deleted (F4).** The CLI prefixes every route
+  row with the document's base path, while the edge forwards a solution's
+  requests on `/v1/<id>` and the runtime checks routes as served, so no
+  non-empty base path ever matched a request. A backend still setting it no
+  longer compiles, naming the field: drop it and carry `/v1/<id>` in each
+  operation's path, as the migrated solutions do.
+- **A malformed request is refused with its reason (F5).** An
+  `InvalidArgument` or `OutOfRange` from the authority's `Check` is answered
+  400 (`invalid_argument` on a relayed call) with the authority's reason,
+  `ErrRequestInvalid`, never 503 "try again"; an issue refused that way is a
+  `WorkContextRefusal` of 400 with its reason.
+- **A stream's first message is bounded again (F6).** A relayed
+  server-streaming call cuts off a module that accepts the stream and sends
+  nothing at the method's `Timeout`, as `StreamFirstAnswerWithin` did before
+  the authority move, instead of holding it for the whole `MaxStreamDuration`.
+- **Open (F3):** `go.mod` pins the authority client and hop libraries at
+  commits only on the unmerged `authority/vision` branch. This closes when
+  authority#1 merges with a merge commit and this runtime re-pins; no runtime
+  release before then.
+
 ## Unreleased — the operation checked is the operation run; every served route publishes its policy (breaking)
 
 From the independent review of 2026-10-25 (F1–F4, F10, F11):
diff --git a/README.md b/README.md
index 3acac18..a5e8e87 100644
--- a/README.md
+++ b/README.md
@@ -119,18 +119,23 @@ nothing:
   calling a route as a tool sends the child the authority issued it through
   its binding: `WorkContextPrincipals` names the person as owner and the module
   as current actor, and `ActorChain()` the whole chain.
-- **Which routes it reaches**: the `Check` names the route, `"<VERB> <path>"`
-  as this module serves it, and the authority applies this module's delivered
-  route policy (the `"<VERB> <template>"` rows the CLI derives from the
-  published contract's `x-codefly-authority-policy`). A route the call does
+- **Which routes it reaches**: the `Check` names the operation the request was
+  dispatched to, `"<VERB> <template>"` exactly as its row is published, and
+  the authority applies this module's delivered route policy (the
+  `"<VERB> <template>"` rows the CLI derives from the published contract's
+  `x-codefly-authority-policy`). The request's own path is never what is
+  asked about: an encoded `/` in a segment (`/pages/a%2Fhistory`) runs the
+  `/pages/{id}` operation while its decoded path reads as `/pages/{id}/history`,
+  and a subtree and a `{id}` route the mux tells apart would both match it. A route the call does
   not hold, one that declares nothing, and one not served are answered 403
   with the authority's reason. Under `hop/ENFORCEMENT=warn` the check is
   advisory: the route goes through and the refusal is logged. An authority
   that cannot be reached refused nobody: the request is answered 503, naming
   that, never 401.
 - **The operation checked is the operation run.** A request is served by the
-  operation declared for its method on its path, so the `"<VERB> <path>"` the
-  authority is asked about is the operation whose handler runs. A method the
+  operation declared for its method on its path, and the `"<VERB> <template>"`
+  the authority is asked about is that operation's, so it is the operation
+  whose handler runs. A method the
   path does not declare is answered 405, naming the methods it serves (and
   `Allow`), before the authority is asked or any handler runs. The boot
   refuses an operation with no policy, an undocumented one, one method
@@ -642,9 +647,10 @@ hold: `solution.Requires(kind, actions...)` or `solution.AnyCheckedCaller()`,
 the same shape as the authority's `authority.hop.v1.Policy`. The artifact
 writes it as the operation's `x-codefly-authority-policy`, the extension the
 CLI derives the solution's route rows from, and an operation that declares
-none, or both, is refused at generation by name. A backend renders its artifact with no `BasePath`: its operations already
-carry the `/v1/<id>` the edge forwards them on, so each route is written as
-served and matches the `"<VERB> <path>"` the runtime's `Check` names. A path
+none, or both, is refused at generation by name. The artifact has no base path
+(`InterfaceInfo` has no `BasePath`): the edge forwards a solution's requests on
+`/v1/<id>`, which its operations already carry, so each route is written as
+served and is the `"<VERB> <template>"` the runtime's `Check` names. A path
 ending in `/` serves its subtree and is written `/…/{path=**}`. The passthrough
 routes `InterfaceArtifact` publishes beside the solution's own are any checked
 caller's: see [why](#letting-the-page-call-a-consumed-module-the-passthrough).
@@ -655,6 +661,14 @@ caller's: see [why](#letting-the-page-call-a-consumed-module-the-passthrough).
 > decoding and frontend validation; sdk-go owns resolution and endpoint
 > admission; the authority client owns the authority's wire. Local source
 > composition does not require publishing a release.
+>
+> **Open: the authority pins.** `codefly-dev/authority/libraries/authority-client/go`
+> and `.../hop/go` are pinned at commits that are, today, only on the unmerged
+> `authority/vision` branch of `codefly-dev/authority`. The module is private
+> and fetched direct, so a squash merge and a branch deletion would orphan both
+> commits. This closes when authority#1 merges **with a merge commit** (which
+> keeps both commits reachable from `main`) and this runtime re-pins to that
+> merge or a tag; no runtime release is cut before then.
 ### Shared frontend validation and headless components
 
 `Manifest.Frontend == nil` declares a headless component: it boots normally and
diff --git a/authority.go b/authority.go
index 721dfb5..6b7cc35 100644
--- a/authority.go
+++ b/authority.go
@@ -59,6 +59,12 @@ var ErrNoViewer = errors.New("the authority does not check the Work Context this
 // the authority's reason.
 var ErrRequestRefused = errors.New("the authority refuses this request")
 
+// ErrRequestInvalid is a request the authority refuses as malformed: the Work
+// Context or the route it was asked about is not one it can read. The refusal
+// is permanent, so it is answered 400 with the authority's reason, never as
+// an outage a retry would get past.
+var ErrRequestInvalid = errors.New("the authority refuses this request as malformed")
+
 // ErrAuthorityUnavailable is a request the authority could not be asked about:
 // it did not answer, or failed. Nobody refused it, so it is not answered as a
 // sign-in (401) but 503, by this name; the transport's own text, which can
@@ -113,17 +119,21 @@ func dialAuthority(endpoint string, transport workcontext.TransportSource, token
 
 // viewer asks the authority's Check whose the Work Context a request carries
 // is, addressed to this module, and, when route is named, whether it holds
-// what this module's delivery declares for that route: "<VERB> <path>", the
-// request as this module serves it, which the authority matches against the
-// "<VERB> <template>" rows the CLI derives from the published contract. A
+// what this module's delivery declares for that route: "<VERB> <template>",
+// the operation the request was dispatched to, spelled exactly as one of the
+// rows the CLI derives from the published contract, so the authority finds
+// that row by name rather than by matching a path against every template. A
 // context the authority does not check is no viewer, whatever it claims.
 func (h *hostAuthority) viewer(ctx context.Context, workContext, route string) (*authorityv1.WorkContextV1, error) {
 	ctx, cancel := context.WithTimeout(ctx, authorityCallTimeout)
 	defer cancel()
 	checked, err := h.authority.Check(ctx, &authorityv1.CheckRequest{Token: workContext, Audience: h.principal, Method: route, Advisory: h.advisory && route != ""})
 	if err != nil && refusalStatus(err) < http.StatusInternalServerError {
-		if status.Code(err) == codes.Unauthenticated {
+		switch refusalStatus(err) {
+		case http.StatusUnauthorized:
 			return nil, fmt.Errorf("%w: %s", ErrNoViewer, status.Convert(err).Message())
+		case http.StatusBadRequest:
+			return nil, fmt.Errorf("%w: %s", ErrRequestInvalid, status.Convert(err).Message())
 		}
 		return nil, fmt.Errorf("%w: %s", ErrRequestRefused, status.Convert(err).Message())
 	}
@@ -218,6 +228,8 @@ func refusalStatus(err error) int {
 	switch status.Code(err) {
 	case codes.Unauthenticated:
 		return http.StatusUnauthorized
+	case codes.InvalidArgument, codes.OutOfRange:
+		return http.StatusBadRequest
 	case codes.PermissionDenied, codes.NotFound, codes.FailedPrecondition:
 		return http.StatusForbidden
 	case codes.Unavailable, codes.DeadlineExceeded:
diff --git a/authority_test.go b/authority_test.go
index 27e1970..466f02a 100644
--- a/authority_test.go
+++ b/authority_test.go
@@ -2,6 +2,7 @@ package solution
 
 import (
 	"context"
+	"errors"
 	"log"
 	"net"
 	"net/http"
@@ -40,6 +41,10 @@ type interfaceAuthority struct {
 // edgeContext is the person's Work Context the edge sends the page.
 const edgeContext = "edge-context-for-the-page"
 
+// malformedContext is a Work Context the authority refuses as malformed
+// (InvalidArgument).
+const malformedContext = "malformed-context"
+
 // robinChild is a module's tool call to the page: Maya's Work Context, issued
 // by the authority as a child through robin's declared binding, robin acting,
 // addressed to the page.
@@ -50,6 +55,9 @@ func (a *interfaceAuthority) Check(_ context.Context, r *authorityv1.CheckReques
 	a.checked = append(a.checked, proto.Clone(r).(*authorityv1.CheckRequest))
 	held := a.held
 	a.mu.Unlock()
+	if r.GetToken() == malformedContext {
+		return nil, status.Error(codes.InvalidArgument, "the Work Context is not a token the authority can read")
+	}
 	var wc *authorityv1.WorkContextV1
 	switch {
 	case r.GetAudience() != "page":
@@ -62,7 +70,14 @@ func (a *interfaceAuthority) Check(_ context.Context, r *authorityv1.CheckReques
 	if wc == nil {
 		return nil, status.Error(codes.Unauthenticated, "not a context for this audience")
 	}
-	if r.GetMethod() != "" && held != nil && !slices.ContainsFunc(held, func(row string) bool { return routeRowMatches(row, r.GetMethod()) }) {
+	if r.GetMethod() != "" && held != nil {
+		matched, ambiguous := heldRoute(held, r.GetMethod())
+		if ambiguous != "" {
+			return nil, status.Error(codes.PermissionDenied, ambiguous)
+		}
+		if matched {
+			return &authorityv1.CheckResponse{Context: wc}, nil
+		}
 		refusal := "page requires pages:write for " + r.GetMethod() + ", which the call does not hold (it holds pages:read)"
 		if !r.GetAdvisory() {
 			return nil, status.Error(codes.PermissionDenied, refusal)
@@ -72,15 +87,46 @@ func (a *interfaceAuthority) Check(_ context.Context, r *authorityv1.CheckReques
 	return &authorityv1.CheckResponse{Context: wc}, nil
 }
 
-// routeRowMatches is the authority's reading of a request "<VERB> <path>"
-// against a declared row "<VERB> <template>", "{name}" standing for one
-// segment: enough of it to prove the runtime spells the request the way the
-// rows are matched.
+// heldRoute is the authority's reading (state.admitMethod) of a checked
+// method against the held rows: a row named exactly is that row; otherwise a
+// request "<VERB> <path>" is matched against every "<VERB> <template>",
+// "{name}" standing for one segment and a trailing "{name=**}" for the rest
+// of the path, and two templates matching one path is refused as ambiguous,
+// never guessed between. matched reports a held row; ambiguous, when set, is
+// the authority's refusal.
+func heldRoute(held []string, method string) (matched bool, ambiguous string) {
+	if slices.Contains(held, method) {
+		return true, ""
+	}
+	var found []string
+	for _, row := range held {
+		if routeRowMatches(row, method) {
+			found = append(found, row)
+		}
+	}
+	if len(found) > 1 {
+		return false, method + " matches more than one declared route (" + strings.Join(found, ", ") + ")"
+	}
+	return len(found) == 1, ""
+}
+
+// routeRowMatches is the authority's routeOf for one row: a request "<VERB>
+// <path>" against a declared row "<VERB> <template>", "{name}" standing for
+// one non-empty segment and a last "{name=**}" for the rest of the path.
 func routeRowMatches(row, request string) bool {
 	verb, template, _ := strings.Cut(row, " ")
 	got, path, _ := strings.Cut(request, " ")
+	if verb != got {
+		return false
+	}
 	want, have := strings.Split(template, "/"), strings.Split(path, "/")
-	if verb != got || len(want) != len(have) {
+	if last := want[len(want)-1]; strings.HasPrefix(last, "{") && strings.HasSuffix(last, "=**}") {
+		if len(have) < len(want) || strings.Join(have[len(want)-1:], "/") == "" {
+			return false
+		}
+		want, have = want[:len(want)-1], have[:len(want)-1]
+	}
+	if len(want) != len(have) {
 		return false
 	}
 	for i, segment := range want {
@@ -157,7 +203,7 @@ func authorityServer(t *testing.T) (*Server, *interfaceAuthority) {
 func TestUnderTheAuthorityTheViewerIsTheEdgesWorkContext(t *testing.T) {
 	s, _ := authorityServer(t)
 	var seen *Gateway
-	handler := s.wrapRequest(func(_ *http.Request, gw *Gateway) (any, error) {
+	handler := s.wrapRequest("GET /v1/page/types", func(_ *http.Request, gw *Gateway) (any, error) {
 		seen = gw
 		return map[string]string{"ok": "yes"}, nil
 	})
@@ -279,7 +325,7 @@ func TestUnderTheAuthorityAModulesToolCallActsForThePerson(t *testing.T) {
 	var principals WorkContextPrincipals
 	var actors []string
 	ran := 0
-	handler := s.wrapRequest(func(r *http.Request, gw *Gateway) (any, error) {
+	handler := s.wrapRequest("GET /v1/page/pages/{page_id}", func(r *http.Request, gw *Gateway) (any, error) {
 		ran++
 		var err error
 		principals, err = gw.WorkContextPrincipals(r.Context())
@@ -324,36 +370,39 @@ func TestUnderTheAuthorityAModulesToolCallActsForThePerson(t *testing.T) {
 	}
 }
 
-// Row 7: the Check names the route a request calls, "<VERB> <path>" as the
-// page serves it, the spelling the CLI's route-policy rows ("<VERB>
-// <template>") are matched against, so the authority applies the page's
-// delivered per-route policy. A route the call does not hold is refused with
-// the authority's own reason, before the handler runs.
+// Row 7: the Check names the operation a request was dispatched to, "<VERB>
+// <template>" exactly as the CLI's route-policy row for it is spelled, so the
+// authority applies the page's delivered per-route policy to the operation
+// that runs, whatever the request's own path reads as. A route the call does
+// not hold is refused with the authority's own reason, before the handler
+// runs.
 func TestUnderTheAuthorityTheCheckNamesTheRoute(t *testing.T) {
 	s, stand := authorityServer(t)
 	stand.held = []string{"GET /v1/page/pages/{page_id}"}
 	ran := 0
-	handler := s.wrapRequest(func(*http.Request, *Gateway) (any, error) {
+	handler := func(*http.Request, *Gateway) (any, error) {
 		ran++
 		return map[string]string{"ok": "yes"}, nil
-	})
+	}
+	read := s.wrapRequest("GET /v1/page/pages/{page_id}", handler)
+	write := s.wrapRequest("POST /v1/page/pages", handler)
 
 	request := httptest.NewRequest(http.MethodGet, "/v1/page/pages/p-1?revision=3", nil)
 	request.Header.Set(WorkContextHeader, robinChild)
 	answer := httptest.NewRecorder()
-	handler(answer, request)
+	read(answer, request)
 	if answer.Code != http.StatusOK || ran != 1 {
 		t.Fatalf("a held route answered %d (%s)", answer.Code, answer.Body)
 	}
 	checked := stand.checks()
-	if len(checked) != 1 || checked[0].GetMethod() != "GET /v1/page/pages/p-1" || checked[0].GetAudience() != "page" || checked[0].GetAdvisory() {
+	if len(checked) != 1 || checked[0].GetMethod() != "GET /v1/page/pages/{page_id}" || checked[0].GetAudience() != "page" || checked[0].GetAdvisory() {
 		t.Fatalf("the check asked %v", checked)
 	}
 
 	request = httptest.NewRequest(http.MethodPost, "/v1/page/pages", strings.NewReader(`{}`))
 	request.Header.Set(WorkContextHeader, robinChild)
 	answer = httptest.NewRecorder()
-	handler(answer, request)
+	write(answer, request)
 	if answer.Code != http.StatusForbidden || ran != 1 || !strings.Contains(answer.Body.String(), "page requires pages:write for POST /v1/page/pages") {
 		t.Fatalf("a route the call does not hold answered %d (%s), handler ran %d times", answer.Code, answer.Body, ran)
 	}
@@ -370,7 +419,7 @@ func TestUnderAdvisoryEnforcementARefusedRouteIsLoggedAndLetThrough(t *testing.T
 	logged := &strings.Builder{}
 	log.SetOutput(logged)
 	defer log.SetOutput(os.Stderr)
-	handler := s.wrapRequest(func(*http.Request, *Gateway) (any, error) {
+	handler := s.wrapRequest("POST /v1/page/pages", func(*http.Request, *Gateway) (any, error) {
 		return map[string]string{"ok": "yes"}, nil
 	})
 
@@ -412,3 +461,27 @@ func TestHopEnforcementWarnMakesTheRouteCheckAdvisory(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = codefly.LoadEnvironmentVariables() })
 }
+
+// r1 F5: an authority status outside the sign-in and permission classes was
+// answered 503 "try again" with its reason only in the log. A malformed
+// request (InvalidArgument) is a permanent refusal: it is answered 400 with
+// the authority's reason, to a REST caller and a relayed Connect call alike,
+// and an outage is still 503.
+func TestAMalformedRequestIsRefusedWithTheAuthoritysReason(t *testing.T) {
+	s, _ := authorityServer(t)
+	ran := false
+	handler := s.wrapRequest("GET /v1/page/types", func(*http.Request, *Gateway) (any, error) { ran = true; return nil, nil })
+	request := httptest.NewRequest(http.MethodGet, "/v1/page/types", nil)
+	request.Header.Set(WorkContextHeader, malformedContext)
+	answer := httptest.NewRecorder()
+	handler(answer, request)
+	if answer.Code != http.StatusBadRequest || ran || !strings.Contains(answer.Body.String(), "not a token the authority can read") {
+		t.Fatalf("a malformed request answered %d %s (handler ran: %v)", answer.Code, answer.Body, ran)
+	}
+	if _, err := s.viewerGateway(context.Background(), malformedContext, "GET /v1/page/types"); !errors.Is(err, ErrRequestInvalid) || errors.Is(err, ErrAuthorityUnavailable) {
+		t.Fatalf("viewerGateway = %v, want ErrRequestInvalid", err)
+	}
+	if got := refusalStatus(status.Error(codes.Unavailable, "down")); got != http.StatusServiceUnavailable {
+		t.Fatalf("an outage maps to %d, want 503", got)
+	}
+}
diff --git a/dispatch_test.go b/dispatch_test.go
index 6ea9ab5..b935d18 100644
--- a/dispatch_test.go
+++ b/dispatch_test.go
@@ -90,6 +90,113 @@ func TestTheOperationCheckedIsTheOperationRun(t *testing.T) {
 	}
 }
 
+// The reviewer's reproduction (r1 F1): the mux matches the escaped path, so
+// "/pages/secret%2Fhistory" runs the "/pages/{id}" operation with id
+// "secret/history", while its decoded path reads as "/pages/{id}/history".
+// The authority used to be asked about that decoded path and so applied the
+// history row's weaker policy to the page handler. It is asked about the
+// operation dispatched now: a caller holding only the history row is refused
+// before the page handler runs.
+func TestAnEncodedSlashIsCheckedAsTheOperationItRuns(t *testing.T) {
+	ran := []string{}
+	handler := func(name string) Handler {
+		return func(context.Context, *Gateway) (any, error) {
+			ran = append(ran, name)
+			return map[string]string{"ran": name}, nil
+		}
+	}
+	page, history := "/v1/page/pages/{id}", "/v1/page/pages/{id}/history"
+	server := New(Manifest{ID: "page", Frontend: []byte(testFrontend)}).Operations(
+		Operation{Path: page, Method: "get", Summary: "Read a page", Callers: "Readers.", Behavior: "The page.",
+			Response: map[string]string{}, Policy: Requires("page.page", "read"), Handler: handler("page-handler")},
+		Operation{Path: history, Method: "get", Summary: "Read a page's history", Callers: "Anyone checked.", Behavior: "Its revisions.",
+			Response: map[string]string{}, Policy: AnyCheckedCaller(), Handler: handler("history-handler")},
+	)
+	b := boot(t, server)
+	b.authority.mu.Lock()
+	b.authority.held = []string{"GET " + history}
+	b.authority.mu.Unlock()
+
+	get := func(path string) (int, string) {
+		t.Helper()
+		request, err := http.NewRequest(http.MethodGet, b.base+path, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		request.Header.Set(WorkContextHeader, edgeContext)
+		response, err := b.client.Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer response.Body.Close()
+		body, _ := io.ReadAll(response.Body)
+		return response.StatusCode, string(body)
+	}
+
+	if code, body := get("/v1/page/pages/secret%2Fhistory"); code != http.StatusForbidden {
+		t.Fatalf("an encoded slash answered %d %s: the page handler ran under the history row's policy", code, body)
+	}
+	if len(ran) != 0 {
+		t.Fatalf("a refused request ran %v", ran)
+	}
+	if checks := b.authority.checks(); len(checks) != 1 || checks[0].GetMethod() != "GET "+page {
+		t.Fatalf("the authority was asked %v, want the dispatched operation %q", checks, "GET "+page)
+	}
+
+	// The history route itself is what the caller holds, and it runs.
+	if code, body := get("/v1/page/pages/secret/history"); code != http.StatusOK || !strings.Contains(body, "history-handler") {
+		t.Fatalf("the held history route answered %d %s", code, body)
+	}
+	if checks := b.authority.checks(); len(checks) != 2 || checks[1].GetMethod() != "GET "+history {
+		t.Fatalf("the authority was asked %v", checks)
+	}
+}
+
+// r1 F2: a subtree pattern and a "{id}" route under the same prefix are legal
+// for the mux, which runs the more specific one, but a request path matches
+// both templates, and the authority refuses a path that matches two declared
+// routes as ambiguous. The runtime names the dispatched operation's own row,
+// which the authority finds exactly, so each request is checked against one
+// row and the overlap is never ambiguous.
+func TestOverlappingRoutesAreEachCheckedAgainstTheirOwnRow(t *testing.T) {
+	answer := func(name string) Handler {
+		return func(context.Context, *Gateway) (any, error) { return map[string]string{"ran": name}, nil }
+	}
+	subtree, item := "/v1/page/pages/", "/v1/page/pages/{id}"
+	server := New(Manifest{ID: "page", Frontend: []byte(testFrontend)}).Operations(
+		served("get", subtree, answer("subtree-handler")),
+		served("get", item, answer("item-handler")),
+	)
+	b := boot(t, server)
+	b.authority.mu.Lock()
+	b.authority.held = []string{"GET " + servedRoute(subtree), "GET " + item}
+	b.authority.mu.Unlock()
+
+	for path, want := range map[string]struct{ handler, row string }{
+		"/v1/page/pages/p-1":         {"item-handler", "GET " + item},
+		"/v1/page/pages/p-1/history": {"subtree-handler", "GET /v1/page/pages/{path=**}"},
+	} {
+		before := len(b.authority.checks())
+		request, err := http.NewRequest(http.MethodGet, b.base+path, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		request.Header.Set(WorkContextHeader, edgeContext)
+		response, err := b.client.Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, _ := io.ReadAll(response.Body)
+		response.Body.Close()
+		if response.StatusCode != http.StatusOK || !strings.Contains(string(body), want.handler) {
+			t.Errorf("%s answered %d %s, want %s", path, response.StatusCode, body, want.handler)
+		}
+		if checks := b.authority.checks(); len(checks) != before+1 || checks[before].GetMethod() != want.row {
+			t.Errorf("%s was checked as %v, want %q", path, checks[before:], want.row)
+		}
+	}
+}
+
 // served is one documented operation any checked caller may make, for a test
 // that is about something other than the operation's documentation.
 func served(method, path string, handler Handler) Operation {
diff --git a/enforced_test.go b/enforced_test.go
index a7d2fd4..c49c88e 100644
--- a/enforced_test.go
+++ b/enforced_test.go
@@ -162,7 +162,7 @@ func TestAnAuthorityOutageIsNamedNotAnsweredAsASignIn(t *testing.T) {
 	request := httptest.NewRequest(http.MethodGet, "/v1/page/types", nil)
 	request.Header.Set(WorkContextHeader, edgeContext)
 	answer := httptest.NewRecorder()
-	s.wrapRequest(func(*http.Request, *Gateway) (any, error) { ran = true; return nil, nil })(answer, request)
+	s.wrapRequest("GET /v1/page/types", func(*http.Request, *Gateway) (any, error) { ran = true; return nil, nil })(answer, request)
 	if answer.Code != http.StatusServiceUnavailable || ran || !strings.Contains(answer.Body.String(), ErrAuthorityUnavailable.Error()) || strings.Contains(answer.Body.String(), gone) {
 		t.Fatalf("an outage answered %d %s (handler ran: %v)", answer.Code, answer.Body.String(), ran)
 	}
diff --git a/operations.go b/operations.go
index db90a19..c8abe81 100644
--- a/operations.go
+++ b/operations.go
@@ -25,10 +25,10 @@ import (
 // be documented without being served.
 //
 // Each operation also declares what a call to it must hold (Policy). Under
-// the authority interface the runtime asks the authority's Check for every
-// request "<VERB> <path>" as served, and the authority holds it to the row the
-// CLI derives from this artifact: the operation's x-codefly-authority-policy
-// at its path. An operation that declares none is refused at generation, by
+// the authority interface the runtime asks the authority's Check, for every
+// request, about the operation it was dispatched to, "<VERB> <template>" as
+// served (servedRoute), and the authority holds it to the row the CLI derives
+// from this artifact: the operation's x-codefly-authority-policy at its path. An operation that declares none is refused at generation, by
 // name, so no served route reaches the artifact with nothing to be held to.
 
 // Operation is one public route of a solution backend.
@@ -139,7 +139,7 @@ type QueryParameter struct {
 // Operations declares the routes this backend serves itself. Chainable. Each
 // is served for its own method only: a request is answered by the operation
 // declared for its method on its path, which is the operation the authority's
-// Check is asked about ("<VERB> <path>"), and a method the path does not
+// Check is asked about ("<VERB> <template>"), and a method the path does not
 // declare is refused by name before the authority is asked or any handler
 // runs. The boot refuses an operation that is undocumented, declares no
 // policy, names a method twice on one path, or takes the MCP route.
@@ -184,7 +184,8 @@ func (s *Server) operationTable() (map[string]map[string]RequestHandler, error)
 }
 
 // mountOperations serves each declared path on mux, dispatching on the
-// request's method to the operation declared for it.
+// request's method to the operation declared for it, and asking the authority
+// about that operation's own published row.
 func (s *Server) mountOperations(mux *http.ServeMux) error {
 	table, err := s.operationTable()
 	if err != nil {
@@ -193,7 +194,7 @@ func (s *Server) mountOperations(mux *http.ServeMux) error {
 	for path, methods := range table {
 		served := make(map[string]http.HandlerFunc, len(methods))
 		for method, handler := range methods {
-			served[method] = s.wrapRequest(handler)
+			served[method] = s.wrapRequest(method+" "+servedRoute(path), handler)
 		}
 		mux.HandleFunc(path, withCORS(byMethod(path, served)))
 	}
@@ -230,10 +231,10 @@ type InterfaceInfo struct {
 	Title       string
 	Version     string
 	Description string
-	// BasePath, when set, is a prefix a caller reaches every route under. An
-	// authority-served backend leaves it empty: its operations already carry
-	// the /v1/<id> the edge forwards them on.
-	BasePath string
+	// There is no base path. The authority's edge forwards a solution's
+	// requests on /v1/<id>, which its operations already carry, and the
+	// runtime asks the authority about each route as served; a base path
+	// prefixed every row the CLI derives and matched no request.
 	// OperationPrefix starts every operationId ("Notes" renders GET "/sources"
 	// as "Notes_Get_Sources"); Tag is the one tag every operation carries.
 	OperationPrefix string
@@ -331,11 +332,6 @@ func swaggerDocument(info InterfaceInfo, ops []Operation) (map[string]any, error
 		"paths":       paths,
 		"definitions": definitions,
 	}
-	// No base path is the routes as served: an authority-served backend's
-	// operations already carry the /v1/<id> its edge forwards them on.
-	if info.BasePath != "" {
-		doc["basePath"] = info.BasePath
-	}
 	return doc, nil
 }
 
diff --git a/operations_test.go b/operations_test.go
index 6ef79c9..99769c9 100644
--- a/operations_test.go
+++ b/operations_test.go
@@ -38,7 +38,7 @@ func documentedOperations() []Operation {
 }
 
 func TestInterfaceDocumentDescribesGeneratedMessagesFromTheirDescriptor(t *testing.T) {
-	raw, err := InterfaceDocument(InterfaceInfo{Title: "example backend", Version: "1.2.3", BasePath: "/solutions/example", OperationPrefix: "Example", Tag: "example"}, documentedOperations())
+	raw, err := InterfaceDocument(InterfaceInfo{Title: "example backend", Version: "1.2.3", OperationPrefix: "Example", Tag: "example"}, documentedOperations())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -55,7 +55,7 @@ func TestInterfaceDocumentDescribesGeneratedMessagesFromTheirDescriptor(t *testi
 	if err := json.Unmarshal(raw, &doc); err != nil {
 		t.Fatal(err)
 	}
-	if doc.BasePath != "/solutions/example" || doc.Paths["/nodes/tree"]["get"]["operationId"] != "Example_Get_Nodes_Tree" {
+	if doc.BasePath != "" || doc.Paths["/nodes/tree"]["get"]["operationId"] != "Example_Get_Nodes_Tree" {
 		t.Fatalf("document = %s", raw)
 	}
 	rule, ok := doc.Definitions["GoogleApiHttpRule"]
@@ -135,7 +135,8 @@ func authorityOperations() []Operation {
 // TestInterfaceDocumentWritesEachOperationsPolicyAtTheRouteAsServed: the row
 // the CLI derives is "<VERB> <basePath><path>" with the operation's
 // x-codefly-authority-policy, and the runtime asks the authority's Check for
-// "<VERB> <path>" as served, so an authority-served document has no base path,
+// the dispatched operation's "<VERB> <template>" as served, so the document
+// has no base path (InterfaceInfo has none to give),
 // every route its full served path, a subtree its "{path=**}" template, and
 // each policy in the authority.hop.v1.Policy JSON the CLI decodes.
 func TestInterfaceDocumentWritesEachOperationsPolicyAtTheRouteAsServed(t *testing.T) {
diff --git a/passthrough.go b/passthrough.go
index 7d60e47..ba95e39 100644
--- a/passthrough.go
+++ b/passthrough.go
@@ -103,8 +103,8 @@ type ConsumedMethod struct {
 	MaxResponseBytes int64
 	// Timeout bounds one call, the issue of the viewer's Work Context
 	// included; zero is DefaultPassthroughTimeout. For a server-streaming
-	// method it bounds the issue alone; the stream itself is bounded by
-	// MaxStreamDuration.
+	// method it bounds the issue, and then the module's first message; the
+	// stream after that is bounded by MaxStreamDuration.
 	Timeout time.Duration
 	// MaxStreamDuration bounds how long one stream of a server-streaming
 	// method stays open, from the call to its last message; zero is
diff --git a/passthrough_authority.go b/passthrough_authority.go
index cb18631..ea07cd4 100644
--- a/passthrough_authority.go
+++ b/passthrough_authority.go
@@ -117,8 +117,9 @@ func dialModule(endpoint string, transport workcontext.TransportSource, what str
 // carries — the edge's for the page, or a module's child of it for a tool call:
 // who it is for, and which module acts for them, is the authority's Check of
 // that context, never a header the request wrote about itself. route, when
-// named, is the request "<VERB> <path>" the authority applies this module's
-// delivered route policy to.
+// named, is the dispatched operation "<VERB> <template>", spelled as its
+// published row, that the authority applies this module's delivered route
+// policy to.
 func (s *Server) viewerGateway(ctx context.Context, carried, route string) (*Gateway, error) {
 	if carried == "" {
 		return nil, errors.New("no Work Context: this page is reached through the authority's edge, which signs the person in")
@@ -153,6 +154,8 @@ func (s *Server) asTheViewer(ctx context.Context, route passthroughRoute, req *c
 		switch {
 		case errors.Is(err, ErrRequestRefused):
 			code = connect.CodePermissionDenied
+		case errors.Is(err, ErrRequestInvalid):
+			code = connect.CodeInvalidArgument
 		case errors.Is(err, ErrAuthorityUnavailable):
 			code = connect.CodeUnavailable
 		}
diff --git a/passthrough_authority_test.go b/passthrough_authority_test.go
index 834f20f..e248dea 100644
--- a/passthrough_authority_test.go
+++ b/passthrough_authority_test.go
@@ -294,6 +294,21 @@ func TestAStreamEndsAsTheModuleOrItsBoundsSay(t *testing.T) {
 	if got, err := watch(t, page.URL, edgeContext); len(got) != 1 || connect.CodeOf(err) != connect.CodeDeadlineExceeded || !strings.Contains(err.Error(), "declared duration") {
 		t.Fatalf("a held stream: received %d, then %v", len(got), err)
 	}
+	// r1 F6: a module that accepts the stream and never sends is cut off at
+	// the method's Timeout, its first-answer bound, not at the whole
+	// duration; once it has answered, only the duration bounds it.
+	start := time.Now()
+	page, _ = relayedPage(t, watchModule(ConsumedMethod{Timeout: 200 * time.Millisecond, MaxStreamDuration: time.Minute}), &relayedModule{hold: true}, "things-binding")
+	if got, err := watch(t, page.URL, edgeContext); len(got) != 0 || connect.CodeOf(err) != connect.CodeDeadlineExceeded || !strings.Contains(err.Error(), "did not start its stream within 200ms") {
+		t.Fatalf("a silent stream: received %d, then %v", len(got), err)
+	}
+	if elapsed := time.Since(start); elapsed > 10*time.Second {
+		t.Fatalf("a silent stream was cut off after %s, not at its 200ms first-answer bound", elapsed)
+	}
+	page, _ = relayedPage(t, watchModule(ConsumedMethod{Timeout: 200 * time.Millisecond, MaxStreamDuration: 700 * time.Millisecond}), &relayedModule{streamed: 1, hold: true}, "things-binding")
+	if got, err := watch(t, page.URL, edgeContext); len(got) != 1 || connect.CodeOf(err) != connect.CodeDeadlineExceeded || !strings.Contains(err.Error(), "declared duration") {
+		t.Fatalf("a stream that answered within its first-answer bound: received %d, then %v", len(got), err)
+	}
 }
 
 // A relay the composition cannot complete refuses the boot, naming the slot;
@@ -353,7 +368,7 @@ func TestABootedPassthroughRelaysProceduresThatCarryNoHTTPBinding(t *testing.T)
 // an authority refusal a handler returns keeps the authority's code and reason.
 func TestARefusalIsWrittenInTheCallersProtocol(t *testing.T) {
 	s, _ := authorityServer(t)
-	handler := s.wrapRequest(func(r *http.Request, gw *Gateway) (any, error) {
+	handler := s.wrapRequest("POST /v1/page/things", func(r *http.Request, gw *Gateway) (any, error) {
 		_, err := gw.ForParent(r.Context(), "refused", Scope{ResourceKind: "things", Actions: []string{"read"}})
 		return nil, err
 	})
diff --git a/passthrough_test.go b/passthrough_test.go
index 50be837..65bbcb6 100644
--- a/passthrough_test.go
+++ b/passthrough_test.go
@@ -256,7 +256,7 @@ func TestPassthroughOperationsDocumentTheDeclaration(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	doc, err := InterfaceDocument(InterfaceInfo{Title: "t", Version: "0.0.1", Description: "d", BasePath: "/v1/test", OperationPrefix: "Test", Tag: "test"}, ops)
+	doc, err := InterfaceDocument(InterfaceInfo{Title: "t", Version: "0.0.1", Description: "d", OperationPrefix: "Test", Tag: "test"}, ops)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/request_handler_test.go b/request_handler_test.go
index 254a2c3..70e4e0b 100644
--- a/request_handler_test.go
+++ b/request_handler_test.go
@@ -37,7 +37,7 @@ func TestRequestHandlerPreservesCallerAndInput(t *testing.T) {
 			req.Header.Set(WorkContextHeader, workContext)
 		}
 		rec := httptest.NewRecorder()
-		s.wrapRequest(ask)(rec, req)
+		s.wrapRequest("POST /ask", ask)(rec, req)
 		want := http.StatusOK
 		if workContext == "" {
 			want = http.StatusUnauthorized
@@ -86,7 +86,7 @@ func TestRequestHandlerRejectsInvalidInput(t *testing.T) {
 			req := httptest.NewRequest("POST", "/ask", strings.NewReader(tc.body))
 			req.Header.Set(WorkContextHeader, edgeContext)
 			rec := httptest.NewRecorder()
-			withCORS(s.wrapRequest(ask))(rec, req)
+			withCORS(s.wrapRequest("POST /ask", ask))(rec, req)
 			if rec.Code != tc.status {
 				t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
 			}
@@ -131,7 +131,7 @@ func TestHandlerErrorStatusContract(t *testing.T) {
 				req := httptest.NewRequest("POST", path, nil)
 				req.Header.Set(WorkContextHeader, edgeContext)
 				rec := httptest.NewRecorder()
-				s.wrapRequest(op.requestHandler())(rec, req)
+				s.wrapRequest("POST "+path, op.requestHandler())(rec, req)
 				if rec.Code != tc.status {
 					t.Fatalf("%s: status %d: %s", path, rec.Code, rec.Body.String())
 				}
diff --git a/solution.go b/solution.go
index ee184cd..8474154 100644
--- a/solution.go
+++ b/solution.go
@@ -782,14 +782,24 @@ func (s *Server) handleCapabilities(w http.ResponseWriter, _ *http.Request) {
 // for is the authority's Check of that context, which also applies this
 // module's delivered policy for the route. No session bearer reaches this
 // process, and no header a request wrote about itself is read.
-func (s *Server) wrapRequest(handler RequestHandler) http.HandlerFunc {
+//
+// route is the operation the mux dispatched to, "<VERB> <template>" exactly as
+// its row is published (servedRoute), never the request's own path. The mux
+// matches the escaped path while the request's decoded path can read as a
+// different route ("/pages/a%2Fhistory" runs "/pages/{id}" but decodes to
+// "/pages/a/history"), and two templates the mux tells apart by specificity
+// can both match one path, which the authority refuses as ambiguous. Naming
+// the dispatched row makes the operation checked the operation run.
+func (s *Server) wrapRequest(route string, handler RequestHandler) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		gw, err := s.viewerGateway(r.Context(), r.Header.Get(WorkContextHeader), r.Method+" "+r.URL.Path)
+		gw, err := s.viewerGateway(r.Context(), r.Header.Get(WorkContextHeader), route)
 		if err != nil {
 			code := http.StatusUnauthorized
 			switch {
 			case errors.Is(err, ErrRequestRefused):
 				code = http.StatusForbidden
+			case errors.Is(err, ErrRequestInvalid):
+				code = http.StatusBadRequest
 			case errors.Is(err, ErrAuthorityUnavailable):
 				code = http.StatusServiceUnavailable
 			}
diff --git a/stream.go b/stream.go
index 9248873..d9afff5 100644
--- a/stream.go
+++ b/stream.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"sync/atomic"
 	"time"
 
 	"connectrpc.com/connect"
@@ -22,8 +23,10 @@ import (
 // child Work Context issued for that method, and the declared response fields
 // applied to every message before it reaches the page.
 //
-// Every stream is bounded: its duration by the method's MaxStreamDuration, and
-// each message by MaxStreamMessageBytes. The page disconnecting cancels the
+// Every stream is bounded: the module's first message by the method's Timeout
+// (a module that accepts the stream and sends nothing is cut off then, not at
+// the end of the whole duration), its duration by the method's
+// MaxStreamDuration, and each message by MaxStreamMessageBytes. The page disconnecting cancels the
 // module's stream at once; the module ending it with a status ends the page's
 // with the same code, by moduleRefusal's rule.
 
@@ -85,7 +88,16 @@ func (s *Server) relayStream(ctx context.Context, route passthroughRoute, req *c
 	if err != nil {
 		return err
 	}
-	calling := grpcmetadata.AppendToOutgoingContext(ctx, WorkContextHeader, token)
+	// The module's first answer is bounded like a unary call (route.timeout):
+	// until it arrives, a timer cancels the stream, so a module that accepts
+	// it and sends nothing holds the page's request, a goroutine and an HTTP/2
+	// stream for that long and no longer.
+	streaming, cancelStream := context.WithCancel(ctx)
+	defer cancelStream()
+	var late atomic.Bool
+	firstAnswer := time.AfterFunc(route.timeout(), func() { late.Store(true); cancelStream() })
+	defer firstAnswer.Stop()
+	calling := grpcmetadata.AppendToOutgoingContext(streaming, WorkContextHeader, token)
 	module, err := relay.conn.NewStream(calling, &grpc.StreamDesc{StreamName: string(route.md.Name()), ServerStreams: true}, route.procedure(),
 		grpc.MaxCallRecvMsgSize(int(route.streamMessageLimit())))
 	if err == nil {
@@ -96,7 +108,9 @@ func (s *Server) relayStream(ctx context.Context, route passthroughRoute, req *c
 	}
 	for err == nil {
 		out := dynamicpb.NewMessage(route.md.Output())
-		if err = module.RecvMsg(out); err != nil {
+		err = module.RecvMsg(out)
+		firstAnswer.Stop()
+		if err != nil || late.Load() {
 			break
 		}
 		if sendErr := stream.Send(route.answer(out)); sendErr != nil {
@@ -105,6 +119,8 @@ func (s *Server) relayStream(ctx context.Context, route passthroughRoute, req *c
 		}
 	}
 	switch {
+	case late.Load():
+		return connect.NewError(connect.CodeDeadlineExceeded, fmt.Errorf("the module did not start its stream within %s", route.timeout()))
 	case errors.Is(err, io.EOF):
 		return nil
 	case errors.Is(ctx.Err(), context.DeadlineExceeded):
diff --git a/typed_boundary_test.go b/typed_boundary_test.go
index da11142..6f45c21 100644
--- a/typed_boundary_test.go
+++ b/typed_boundary_test.go
@@ -1282,7 +1282,7 @@ func TestTheTypedGatesFollowValuesNotShapes(t *testing.T) {
 import "net/http"
 
 func (s *Server) FixtureOpaqueField() struct{ H any } {
-	return struct{ H any }{H: s.wrapRequest(func(*http.Request, *Gateway) (any, error) { return nil, nil })}
+	return struct{ H any }{H: s.wrapRequest("GET /x", func(*http.Request, *Gateway) (any, error) { return nil, nil })}
 }
 
 func (s *Server) FixtureCallableResult() struct{ H func() http.Handler } {
@@ -1407,7 +1407,7 @@ import "net/http"
 
 func (s *Server) FixtureCallableOpaque() func() any {
 	return func() any {
-		return s.wrapRequest(func(*http.Request, *Gateway) (any, error) { return nil, nil })
+		return s.wrapRequest("GET /x", func(*http.Request, *Gateway) (any, error) { return nil, nil })
 	}
 }