Conducting gap analysis between Mediator-Framework and ark.tools.aspnetcore - #818
Merged
AndreaCuneo merged 4 commits intoAug 2, 2026
Merged
Conversation
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
AndreaCuneo
August 2, 2026 07:07
View session
AndreaCuneo
requested changes
Aug 2, 2026
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
AndreaCuneo
requested changes
Aug 2, 2026
| ### HSD-04 — Trusted proxy contract | ||
|
|
||
| - **Status:** ACCEPTED | ||
| - **Recommended:** accept only an explicitly configured path prefix. Normalize |
Contributor
There was a problem hiding this comment.
this is incorrect / misunderstood. accept any prefix that is sane based on previusly commented rules, in the default profile. application can opt-out. @copilot
Contributor
Author
There was a problem hiding this comment.
Addressed in ada505c: the default Ark startup profile now accepts every strictly valid configured prefix, with an explicit application opt-out.
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
AndreaCuneo
approved these changes
Aug 2, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a Minimal API hosting parity workstream for the Mediator Framework by recording a 2026 gap analysis against existing Ark.Tools.AspNetCore defaults and enumerating executable implementation tasks (HST-01…HST-09).
Changes:
- Added a detailed ASP.NET Core hosting gap analysis document with accepted decisions (HSD-01…HSD-10) and a gap register (HSG-01…HSG-11).
- Added nine self-contained task specs (HST-01…HST-09) for implementing Minimal API hosting defaults and sample parity.
- Updated delivery-tracking indexes to link the new analysis and tasks.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/mediator-framework/progress/tasks/README.md | Adds a “Minimal API hosting defaults” section linking to the new HST task set. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-01-composable-minimal-api-startup.md | New task spec for a composable Minimal API startup contract and verification boundary. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-02-security-headers-hsts-profile.md | New task spec for porting Ark security headers + HSTS defaults to Minimal API hosting. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-03-path-base-validation.md | New task spec for strict X-Forwarded-Prefix → PathBase handling and test requirements. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-04-health-endpoint.md | New task spec for preserving /healthCheck contract without UI/history by default. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-05-response-compression.md | New task spec for Ark Brotli/Gzip defaults with streaming constraints and tests. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-06-nlog-process-boundary.md | New task spec for NLog registration + fatal boundary + flush/exit semantics. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-07-classic-application-insights.md | New task spec for completing classic App Insights defaults and in-memory testing. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-08-composition-root-tests.md | New task spec for composition-root tests that execute production wiring. |
| docs/mediator-framework/progress/tasks/aspnetcore/HST-09-startup-error-diagnostics.md | New task spec for CaptureStartupErrors/detailed startup errors and tests. |
| docs/mediator-framework/progress/README.md | Adds the new gap analysis document to the delivery-tracking index. |
| docs/mediator-framework/progress/aspnetcore-hosting-gap-analysis.md | New gap analysis with decisions, evidence, and the execution plan for hosting parity work. |
Suppressed comments (1)
docs/mediator-framework/progress/tasks/aspnetcore/HST-03-path-base-validation.md:37
- Acceptance criteria currently says no proxy/network trust list is required. If that remains the intent, it should still require a documented trust boundary (header injected/stripped by a trusted proxy) to prevent client spoofing in edge deployments.
- [ ] No configured prefix or known proxy/network list is required.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+174
to
+175
| remaining request pipeline executes. The feature does not require configured | ||
| prefixes or known proxy/network lists. |
Comment on lines
+13
to
+14
| 1. Handle `X-Forwarded-Prefix` by default, with an explicit application opt-out | ||
| and no configured-prefix or known-proxy/network requirement. |
AndreaCuneo
deleted the
copilot/gap-analysis-mediator-framework-ark-tools
branch
August 2, 2026 09:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request created by AI Agent