Task: Bring ores.http to the clean standard

ores.http passes the Component Clean Standard at the scope the sprint 26 decomposition left it: a six-part component whose api, core and server parts are hand-written and whose assets, refdata and iam parts hold route units generated from other components' models.

• Every checklist item that applies to this component passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.http is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

Work the Component Clean Standard in its section order and record each item's result in the table below.

1. Baseline and inventory (B01 to B06).
2. Models (M01 to M10).
3. Protocol (P01 to P06).
4. Generation (G01 to G08).
5. Wiring and data (W01 to W04).
6. Shell (S01, S02).
7. Structure and hygiene (H01 to H05).
8. Verification (V01 to V08), ending with the registry entry.

Scope. The decomposition that landed in sprint 26 split the component into six parts. api, core and server are hand-written: the server library, the route engine, the OpenAPI registry, the process entry point and the storage and variability routes. assets, refdata and iam hold route units generated from the assets, refdata and iam models. The pass covers all six parts.

Applicability. The Protocol items apply, because the gateway serves http-server.v1.info.get and sends the subject of every route it proxies. The Entity items do not apply: the component declares no entity, junction or operation model of its own, so it has no table, no repository, no service and no generated shell unit or recipe. Its routes are generated for it by the source components, which own the entity work.

A prior pass on this task was abandoned when the decomposition landed. It worked against the pre-decomposition three-part shape, and 593 commits have reached main since its base. Eleven of the files it touched no longer exist. That work is preserved by the tag archive/clean-http-pre-restructure and is not rebased; this pass redoes the survey against the tree that exists.

The component has no entity of its own, so the Entity items are not applicable and are recorded as such rather than skipped. What remains is G08, the structure section (H01 to H05), and the confirmation that the whole tree builds, which is blocked on two other components.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

ores.http passes the Component Clean Standard, and http-cpp is listed in COMPONENTS_UNDER_TEST.

The component was measured before anything changed: 100 C++ files, 45 generated and 55 hand-written, one protocol header declaring one subject, and four test executables holding 100 cases. It declares no entity, junction or operation model of its own, so the Entity items are recorded as not applicable with their reasons and no item is skipped in silence.

Four pieces of work followed. The component had no model at all, so it gained a group overview over its six parts and codegen regained ownership of its root CMakeLists.txt. Its one wire type was not modelled, so ores.http.http_info now generates the protocol header and the TypeScript twin, the subject follows the naming every other component uses, and its three callers follow the rename. Its code sat in two disjoint outermost namespaces, so those are now ores::http, documented by include/ores.http.api/ores.http.hpp. And its two stale CMake source lists are regenerated from the model.

Two generator defects were fixed at their source, each with a regression test. The clean-standard survey tool built its subject pattern from the project directory name, so it reported zero subjects for a component whose only subject is http-server.v1.info.get — a silent zero in the census whose whole purpose is to find undeclared subjects. The diagram capture read data members and not methods, so a class whose content is member functions arrived as an empty box; it now draws them, and variability-cpp's accepted H01 exception is retired because its stated reason is no longer true.

Verification:

• ORES_USE_BUSCTL=0 ./compass.sh build exits 0 for the whole tree at 100%, including this component's executable, its four test executables and the web component. ctest -R ores.http is 4 of 4.
• pytest projects/ores.codegen/tests is 802 passed.
• The component-drift, model-drift, protocol-twin, handler-permission, populate-reference, route-auth, registry-exception and shell-recipe gates are all green, and validate_docs.sh reports 40 of 40.
• Data members are unchanged by the diagram fix: across all 92 projects and 28,510 (class, field) pairs the emitted set is identical before and after.

Recorded rather than fixed, each with its reason: server/scripts/ is not a folder in the signed-off folder catalogue; the three adapter parts root their headers at include/ores.http/ rather than include/ores.http.<part>/; core and server expose no test target, and thirteen hand-written sources have no same-basename test; and the fail-open that lets a transport with no authenticator serve requests is already captured in the backlog as authentication_is_optional_at_runtime_on_both_transports.