stateset-http is the Rust commerce REST/SSE layer at /api/v1. It is distinct from
MCP HTTP /mcp and the messaging gateway. The OpenAPI version and workspace/package
version are independent; inspect the deployed contract and configuration.
Authentication and public binds
The server defaults to loopback with authentication enabled. If it generates a token, retrieve it throughbearer_auth_token() before serving; logs contain only a redacted
preview. For non-loopback operation provide an explicit operator-owned token and
configured authorization/rate limiting, or a deliberately trusted gateway deployment.
Do not turn off authentication to make an exposure check pass.
A public health response is not a token verification test. Validate the authenticated
private route you intend to use, plus negative authorization and tenant-isolation cases.
The public host in the reference is a contract address;
obtain the actual provisioned URL and credentials.
Tenant isolation
Without configured tenant isolation,x-tenant-id is rejected rather than silently selecting
shared data. Valid tenant paths are checked for canonical containment; headers do not
magically partition a shared embedded file. Verify intended tenant stores and access rules
on the actual deployment. Do not confuse logical kernel scope with an HTTP tenant router.
Durable retry receipts
ServerBuilder wires retry persistence to the commerce database. Keys are tenant-scoped; fingerprints bind method, path/query and body. The layer reserves identity before executing the handler. Replays return stored status/body withIdempotency-Replayed: true.
Pending reservations never expire automatically. Completed responses have a TTL. Persist
original request identity and inspect the actual business record after response loss;
this layer does not make business commit and response caching one transaction.
Use operator reconciliation, not a fresh key or
raw receipt deletion, when outcome is uncertain.
State and version checks
Shipment transitions, order-linked manifests and expected-version inputs are enforced by the current handlers. Supported metadata/status changes reject stale versions rather than blindly overwriting. Inventory reservation, receipt, shipment and payment transitions have separate domain invariants. Check the complete response and resulting native state.Query and observability boundaries
List methods use their declared filter/pagination contract and configured ceilings. A binding’slist() parameters are not necessarily the REST parameters. Cursor support is
backend/domain-specific; a bounded list is not proof of complete history.
HTTP request/error/latency metrics use route templates. Protect metrics and logs according
to your deployment. Health, successful schema generation or a zero audit-failure metric
does not prove universal mutation audit coverage, capacity, independent security review,
or operational readiness.
See governed execution,
bindings, and
recovery.