Repository navigation
Conversation
…perations (GA-CONTRACT-001) realtimeConnect, realtimePublish, realtimePresence and realtimeHistory carried a per-operation `servers` override to the bare host `https://realtime.wave.online`, which does not resolve (NXDOMAIN, confirmed via dig against 1.1.1.1 and 8.8.8.8, 2026-09-28). The real, live route is served THROUGH the gateway at https://api.wave.online/v1/realtime/* — the gateway authenticates, meters, then forwards internally to the wave-realtime-edge worker (wave-gateway src/realtime-channel.ts) at rt.wave.online, a detail no caller of this contract needs or should see. The override is removed so these four operations resolve to the documents default server like every other /v1 route; the per-operation `description` fields that leaked the internal forward-target path ("the real path is /v1/connect...") are also removed, since that internal shape is not what a caller of this API calls. Local receipts: `npx redocly lint openapi.yaml` — valid, 58 warnings both before and after this change (diffed against origin/main baseline, zero new warnings); `node --test "scripts/ga/**/*.test.mjs"` — 35/35 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (5)
🧰 Additional context used🪛 Checkov (3.3.16)openapi.yaml[high] 1-13825: Ensure that security operations is not empty. (CKV_OPENAPI_5) 🔇 Additional comments (2)
📝 SummarySummary by CodeRabbit
WalkthroughThe OpenAPI document now describes Realtime operations as routes through the WAVE gateway. It removes endpoint-specific server overrides and alternate path instructions, and clarifies that the gateway authenticates and meters requests before forwarding them internally. ChangesRealtime gateway routing documentation
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~4 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The specification directs Realtime clients through the gateway. Gateway routing remains unverified, but no concrete failure has been found that blocks merging. Architecture SummaryArchitecture risk: 🔵 Low · up to The change affects 1 system. Changed systems: Architecture concerns Review detailsSystems and components
Before / after behavior
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_83e34c4a-b532-4df5-87d5-1bdf53718f3b) |
codeant-ai
Bot
added
the
size:S
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 1 file
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Architecture diagram
sequenceDiagram
participant Client as API Client
participant GW as API Gateway (api.wave.online)
participant RT as Realtime Service
participant Auth as Auth/Metering
Note over Client,RT: Realtime Operations via Gateway (Current State)
Client->>GW: WebSocket connect /v1/realtime/*
GW->>Auth: Authenticate & meter request
Auth-->>GW: Authorized
GW->>RT: Forward realtime traffic
RT-->>GW: Realtime events
GW-->>Client: Established connection
Client->>GW: Publish /v1/realtime/publish
GW->>Auth: Authenticate & meter request
Auth-->>GW: Authorized
GW->>RT: Forward publish operation
RT-->>GW: Acknowledgment
GW-->>Client: Success response
Client->>GW: Presence /v1/realtime/presence
GW->>Auth: Authenticate & meter request
Auth-->>GW: Authorized
GW->>RT: Forward presence operation
RT-->>GW: Presence data
GW-->>Client: Presence state
Client->>GW: History /v1/realtime/history
GW->>Auth: Authenticate & meter request
Auth-->>GW: Authorized
GW->>RT: Forward history operation
RT-->>GW: Historical messages
GW-->>Client: Message history
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This is a narrowly scoped OpenAPI contract fix that replaces an unresolvable realtime host with the document’s gateway server and synchronizes generated descriptions. The unresolved changelog and regression-test requirements leave the user-facing change incomplete for automatic approval. Not approved because:
Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more. |
🟢 WAVE BugBot — clearNo confident findings on the changed lines. Local review · $0 inference · wave-dispatch |
…spec Two independent gate failures on this branch: - sdk-types (foundation-gate): the 4 realtime operation descriptions were edited in openapi.yaml (removing "the real path is ..." internal-forward wording) but generated/api-types.d.ts was never regenerated, so the committed artifact drifted from source. `npm run gen:types` regenerates it; `git diff --exit-code -- generated/api-types.d.ts` now passes. - Secrets + content policy (public-repo-guard): the new tag description and operations-block comment named the private wave-gateway repo and an internal file path (wave-gateway/src/realtime-channel.ts) and an internal worker name (wave-realtime-edge) in this PUBLIC repo's spec. Removed; the explanatory comments keep their substance (NXDOMAIN removal rationale, GA-CONTRACT-001 context) without naming private internals. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_2eef675e-c91c-48d6-96d9-393d17f9af6e) |
…cumented GA routes Cross-checked this lane's classification against the adversarial verifier's readiness spot-check for "WAVE Media Engine: live transport, protocol bridges, mesh and delivery" (readiness-partial.json verifs), plus fresh unauthenticated probes of my own: - /dante was mislabeled: its x-price.meter (wave_dante_observe_ingests) is the "dante observe" GA capability's meter, but the path itself 404s ROUTE_NOT_FOUND live (confirmed independently by this PR's probe and the verifier's spot-check). The real live route is POST /v1/dante/observe (402, amount 3000, confirmed by both). Adds /dante/observe as a new GA path carrying that meter and price; resets /dante's meter to null since it no longer owns that capability. This is the literal "dante/observe" GA target this lane's brief names, not an invented capability. - moq/publish, moq/subscribe, braid/publish and engine/capabilities were already hand-documented with real schemas but had no x-price block at all. A direct probe confirms all four ARE gateway-paywalled (402) at exactly the ops-ruled interim amounts this lane's brief lists (moq 4000, braid 1000, engine/capabilities 1000) — matching the verifier's own measured numbers. Adds the missing x-price + x-wave-availability: ga rather than leave a real paywall undocumented. - realtime/connect and siblings are deliberately left untouched: they carry their own `servers:` override to realtime.wave.online (owned by #110), and the 402 the verifier measured was on a different, gateway-proxied /v1/realtime/connect at api.wave.online — attaching that price to the direct-edge operation this repo documents would misattribute it to the wrong host. - av/remux and av/demux are also left untouched. The verifier found a live, priced /v1/av/transform (50000) with no counterpart anywhere in this spec — a real gap, documented in the CHANGELOG for a follow-up lane, not invented here. live-probe.mjs now reports 17/17 (was 16/16) media-engine GA operations live, 0 failures within scope; redocly lint still 58 warnings (pre-existing baseline, unchanged); both test suites green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
User description
What this is
A minimal, isolated alternative consumption path for #109's realtime fix (
fix(realtime): remove NXDOMAIN server override on the 4 /realtime/* operations, commitf2aadf1).This branch (
fix/ga-contract-001-realtime-pin) is a cherry-pick off2aadf1onto the committhis spec was pinned to at the time by a downstream consumer (
963712a), pushed as its ownbranch. It does not touch #109's branch or history — that PR is untouched and still correct
on its own terms (it targets
main, where963712ais an ancestor).Why this exists
A downstream service vendors this repo's
openapi.yamlat a SHA pin rather than reading it live— its served spec endpoint and its generated tool list are both derived from that vendored copy.
A review on the downstream repair PR correctly flagged that pulling #109's realtime fix through
needs a pin bump + resync + regenerate on that side.
Bumping that pin straight to
f2aadf1(this repo'smaintip at the time) was tried first andrejected:
mainhad drifted 3+ weeks past the downstream pin (963712a→f2aadf1is 40 files/ ~7.2k lines —
git diff --stat 963712a...f2aadf1), and all of that would have landed in thedownstream repair PR as an unreviewed side effect of a one-line NXDOMAIN fix:
/compose,/leaderboard,/platformpaths, including a/leaderboard//platformgateway-root
serversoverride the downstream pin gate correctly didn't yet know about./composecolliding with a gateway-native/composedeclaration on the downstream side —caught live by that repo's own collision guard test.
{param}identity routes under/videos/{videoId}/chapters/ detect/{jobId}and/videos/{videoId}/chapters/{chapterId}, which a downstreammetered-before-existence census correctly flagged as needing a real security classification —
existence-gated vs. open, with evidence — that a contract-drift repair PR has no business
guessing at.
None of that belongs riding in on a realtime NXDOMAIN fix's coattails. This branch gives the
downstream consumer a pin target whose diff against its prior pin is exactly the 41-line
realtime fix — verified:
git diff --stat 963712a...1dbac71(this branch's tip) matchesgit diff --stat 963712a...f2aadf1'sopenapi.yamlhunk byte-for-byte; nothing else changed.Disposition
Once #109 merges to
mainand a future pin bump legitimately carries the downstream consumerpast the compose/leaderboard/platform/video-chapters drift (with that drift properly reviewed on
its own terms — collision resolution, override classification, identity-route census entries),
this branch's SHA becomes redundant and can be deleted; #109's fix is already fully contained in
mainat that point. This branch is a stepping stone, not a permanent fork of the realtimefix.
No code review needed here beyond confirming the cherry-pick is exactly what it claims to be —
happy to close this in favor of #109 once the downstream pin naturally advances past the current
drift.
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Note
Low Risk
Documentation and generated types only; corrects client-facing base URLs without changing server implementation in this diff.
Overview
Aligns the Realtime OpenAPI contract with the live gateway by dropping per-operation
serversoverrides that pointed clients athttps://realtime.wave.online(NXDOMAIN) and documenting that all four Realtime operations are called athttps://api.wave.online/v1/realtime/*like other/v1routes.Operation descriptions no longer tell callers to use internal forward paths (e.g. “the real path is
/v1/connect…”); they describe behavior only. The Realtime tag text and inline GA-CONTRACT-001 notes record the fix.generated/api-types.d.tsis regenerated to match the updated JSDoc on those paths.Reviewed by Cursor Bugbot for commit 2a06fc9. Bugbot is set up for automated code reviews on this repo. Configure here.
CodeAnt-AI Description
Route realtime operations through the working gateway endpoint
What Changed
https://api.wave.online/v1/realtime/*gateway route instead of the unresolvedrealtime.wave.onlinehostImpact
✅ Fewer realtime connection failures✅ Correct gateway routing for realtime requests✅ Clearer API integration guidance💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.