go-authcrunch: Skill for Codex

AuthDB Server

cmd/authdb runs AuthCrunch with Go's net/http, without Caddy. The user-facing cmd/authdb/README.md owns usage instructions, the JSON envelope, bootstrap, listener settings, and operating guidance. Keep its examples synchronized with the executable and the credential-free cmd/authdb/config.json. Use configuration integration for the reusable Go host boundary.

Ownership

• cmd/authdb/main.go owns command flags, strict bounded JSON file loading, version metadata, production logging, TCP binding, and SIGINT/SIGTERM handling.
• pkg/httpserver.Config and PortalRoute own transport defaults and semantic validation. The CLI's http object is this public config; security is the existing root authcrunch.Config, not a new copy of its feature models.
• pkg/httpserver/parser.NewHTTPServerConfigFromDirectives([]string) returns (*httpserver.Config, error). It parses encoded block-body statements and calls Config.Validate; no file access, listeners, or provisioning occur.
• pkg/httpserver.Serve(ctx, listener, config, security, logger) takes ownership of the listener immediately, including on error, and owns its constructed root runtime until all admitted requests have finished. Pass a fresh security graph and do not mutate it while serving.

The host checks serialized object collections before provisioning: optional objects can be absent, but typed collections cannot contain null objects. Use explicit typed traversal and generic pointer-collection checks, without runtime reflection. TestSecurityConfigurationObjectCoverage discovers the declared JSON model in test code and checks concrete/null objects at every collection path. Extend the typed traversal whenever that model adds a new object collection, including external refresh stores, access signers, registries, identity stores/providers and policy access_list_fields. Reject null external entries before runtime provisioning and release the owned listener on failure; TestE2EHTTPServerRejectsNullExternalConfiguration checks the public host API. Keep provider params values owned by their validators. Errors identify field paths and indices, never map keys or configured values. Guard incomplete raw crypto statements before calling the legacy KMS decoder. Initialization errors expose a redacted message; their wrapped causes are available to embedding code for private diagnostics and may contain credentials. Do not print those causes from the executable.