feat(api): create and reload in-process sessions over HTTP

[cursor]

Why

A purchaser still cannot start an assessment over HTTP. Domain session creation exists on protected main, but TRD POST /v1/sessions / GET /v1/sessions/{session_ref} were Target. Session persist stays on the #125/#129 lineage; this slice does not add assessment_session.

Scope

• src/session_http.rs mints a Created session bound to one cataloged published locale-specific release.
• Exact Idempotency-Key replay returns the original session without minting a second identity.
• Unpublished releases, locale mismatch, missing/conflicting idempotency, and unknown JSON fail closed with RFC 9457 problem details.
• openapi/sessions.yaml (OpenAPI 3.2.0) lists only these two operations.
• In-process store only. Process-restart durability remains a later persist slice.

Out of scope

• PostgreSQL session persist/load/command history (land fix(session): reject stale shorter command history on persist #129)
• Anonymous credential issuance
• Response, scoring, result, consent, or health HTTP families
• feat(api): add safe RFC 9457 problem-details primitive #87 reusable ApiProblem primitive (this slice uses the same RFC 9457 wire shape as operator health HTTP)

Test plan

• cargo test --test session_http_contract --test session_http_listener_contract --test documentation_architecture_contract
• cargo test --lib session_http
• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings

Do not merge until exact-head checks and independent last-push approval are satisfied. Never self-approve.

  

[cursor]

First public session HTTP family

Head c590b5e adds in-process POST /v1/sessions and GET /v1/sessions/{session_ref} with server-minted opaque refs, exact Idempotency-Key replay, RFC 9457 problems, and OpenAPI 3.2 limited to those two operations.

Create pins one cataloged published locale-specific release through AssessmentSession::new. Unpublished, locale mismatch, missing/conflicting idempotency, and unknown JSON fail closed. This slice does not add assessment_session persistence.

Residuals (documented, not a reason to open a second HTTP PR):

• In-process store only; restart durability stays on the persist landing (#146, not #129).
• No anonymous credential / resource authorization yet (#84/#86/#144).
• GET is capability-URL by opaque session_ref; do not mint guessable refs in a hosted bind.
• Does not import #87 ApiProblem; wire shape matches operator health HTTP.

Do not mix persist or auth stacks onto this branch. Independent last-push approval and exact-head required checks remain required. This review does not approve.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Closing as superseded, not merged. #232 is the current public-session HTTP landing: it implements the same POST /v1/sessions / GET /v1/sessions/{session_ref} family and OpenAPI contract on top of the durable sealed persistence/start path rather than this in-process-only store. Fresh comparison confirms #232 carries the HTTP files plus the required persistence/session-start stack. Keeping #149 open would preserve a weaker competing transport line.