[totollygeek]

What & why

#883 moved the AWS SigV4 signer and the RFC 3986 encoder into @zuke/core, and core 1.76.0 now publishes signSigV4, AwsCredentials and uriEncode. This closes the loop that release was blocking on: @zuke/prometheus imports them from core, drops its own copies of the signer, the encoder and the signer's test-suite vectors (which now run in core), and raises its core floor to ^1.76.0, with deno.lock regenerated for the new floor. One signer and one encoder remain in the repository, which is what AGENTS.md guideline 12 asks for.

No behaviour changes: the core signer is the prometheus one with S3's path rule added, and the aps service path it signs here is unchanged. ./zuke coreFloorCheck passes for every package, prometheus included, against the published core.

Tests: the prometheus suite passes unchanged against the core export, and the SigV4 vectors live in packages/core/tests/aws_sigv4_test.ts.

Related issues

Closes #882

Checklist

• This PR closes a tracking issue (Closes #<n> above).
• The PR title is a
  Conventional Commit
  (type(scope): summary).
• deno task ci passes locally (lint, fmt, type-check, tests, spell).
• Tests were added or updated; coverage stays at 95%+ (lines and branches).
• Docs updated in the same PR (README.md, JSDoc, docs/) when behaviour
  changed.
• Public API changes were regenerated with ./zuke apiDocs (llms.txt,
  llms-full.txt, package README ## API).
• No any, no as casts or ! non-null assertions in src/ (narrow with
  type guards instead).
• No dead code: unreachable branches and can't-fire fallbacks are removed,
  with types tightened so the impossible state is unrepresentable.
• No duplicated logic: an existing helper is imported rather than retyped,
  and a near-copy differing by a constant or a message is parameterised into
  one implementation. A guard, escape, or credential resolution has exactly
  one implementation.
• SOLID shapes respected: one domain per file, extension via the settings
  lambda (not a behaviour-switching flag), narrow parameter types, and
  dependencies on the injectable seam (StateHost, an injected fetch,
  EnvReader) rather than Deno.* or a global.
• A new package was wired into all six places (see
  AGENTS.md),
  if applicable.
• The code is written using AI assisted coding.

---

Generated by Claude Code

[zuke-build]

🤖 Zuke AI review

🔎 AI review — review

❌ Failed — at least one reviewer's gate tripped.

	Reviewer	Verdict	Score	Severity	Findings
🛡️	security review	✅ passed	0/10	none	0
🧹	generic review	❌ failed	8/10	high	2

Findings

Reviewer	Severity	Finding	Location	Id
🧹 generic review	high · confirmed	Dropped signer-specific tests remove the only regression coverage for AWS signing behavior	packages/prometheus/tests/aws_sigv4_test.ts:1	30b3khl63zux9
🧹 generic review	medium · uncertain	Core version bump may break the package if the imported symbols are not available in the declared floor	packages/prometheus/deno.json:10	24l6u8ur7znp6

🛡️ security review — ✅ passed · 0/10

Score: 0/10 · Severity: none · 0 finding(s)

Tokens: 28754 in · 46 out · 28800 total

Budget: 28,800 tokens of 500,000 tokens

Commands

Only comments from maintainers the host itself attributes as such are read; anyone else's are ignored before anything sees them.

Say	What happens
@zuke-build review	Runs the review again now, with no push: every rebuttal is adjudicated and answered where it was made.
@zuke-build accept <id> <reason>	Accepts a finding as intended for this pull request: it is recorded with your reason, its thread is closed, and no reviewer raises it again here — reworded, moved to another file or escalated. In the finding's own thread the id may be left out.
Reply in a finding's thread, or quote its id in a comment	Contests it: the next run re-checks the finding against your argument and dismisses it when the argument holds, or says what is missing.

No security issues were introduced by this refactor; it only switches Prometheus to shared core helpers and removes duplicated local implementations.

🧹 generic review — ❌ failed · 8/10

Score: 8/10 · Severity: high · 2 finding(s)

Tokens: 16407 in · 359 out · 16766 total

Budget: 53,747 tokens of 500,000 tokens

Severity	Finding	Location
high · confirmed	Dropped signer-specific tests remove the only regression coverage for AWS signing behavior	packages/prometheus/tests/aws_sigv4_test.ts:1
medium · uncertain	Core version bump may break the package if the imported symbols are not available in the declared floor	packages/prometheus/deno.json:10

Dismiss a false positive

Reply on this PR quoting a finding's ID to contest it — the reviewer reads maintainer replies, re-checks the finding, and dismisses it when the rebuttal holds. The suppress list still works as a hard override:

• 30b3khl63zux9 — Dropped signer-specific tests remove the only regression coverage for AWS signing behavior
• 24l6u8ur7znp6 — Core version bump may break the package if the imported symbols are not available in the declared floor

Commands

Only comments from maintainers the host itself attributes as such are read; anyone else's are ignored before anything sees them.

Say	What happens
@zuke-build review	Runs the review again now, with no push: every rebuttal is adjudicated and answered where it was made.
@zuke-build accept <id> <reason>	Accepts a finding as intended for this pull request: it is recorded with your reason, its thread is closed, and no reviewer raises it again here — reworded, moved to another file or escalated. In the finding's own thread the id may be left out.
Reply in a finding's thread, or quote its id in a comment	Contests it: the next run re-checks the finding against your argument and dismisses it when the argument holds, or says what is missing.

Notes:

• 1 finding(s) could not be anchored to a line in the reviewed diff (30b3khl63zux9) — they are listed in the table above

The change correctly deduplicates SigV4 and URI-encoding logic into @zuke/core, but it also removes package-local coverage for the Prometheus signer and introduces a version-floor bump that can break consumers if the new core API is not actually available across the workspace.

[totollygeek]

@zuke-build review

The gate's reasoning is answered on the 24l6u8ur7znp6 thread: the floor names the release that introduced the exports (core 1.76.0), the Core version floors job on this head verifies it against the published core, and the signer's vectors moved to core with the signer.

---

Generated by Claude Code

[totollygeek]

Contesting 30b3khl63zux9. The signer-specific tests were not dropped; they moved with the signer. packages/prometheus/tests/aws_sigv4_test.ts tested packages/prometheus/src/aws_sigv4.ts, and both are gone because the signer now lives in @zuke/core, where the same AWS SigV4 test-suite vectors run as packages/core/tests/aws_sigv4_test.ts (added in #883, with an extra case for S3's path rule). Keeping a copy here would test a module this package no longer contains. The regression coverage for Prometheus's own use of signing is packages/prometheus/tests/aws_test.ts, which still drives sigv4Credentials end to end through the core signer and passes unchanged.

---

Generated by Claude Code

[zuke-build]

🤖 Zuke AI review

🔎 AI review — review

✅ Passed — no findings.

	Reviewer	Verdict	Score	Severity	Findings
🛡️	security review	✅ passed	0/10	none	0
🧹	generic review	✅ passed	0/10	none	0

🛡️ security review — ✅ passed · 0/10

Score: 0/10 · Severity: none · 0 finding(s)

Tokens: 28754 in · 48 out · 28802 total

Budget: 28,802 tokens of 500,000 tokens

Commands

Only comments from maintainers the host itself attributes as such are read; anyone else's are ignored before anything sees them.

Say	What happens
@zuke-build review	Runs the review again now, with no push: every rebuttal is adjudicated and answered where it was made.
@zuke-build accept <id> <reason>	Accepts a finding as intended for this pull request: it is recorded with your reason, its thread is closed, and no reviewer raises it again here — reworded, moved to another file or escalated. In the finding's own thread the id may be left out.
Reply in a finding's thread, or quote its id in a comment	Contests it: the next run re-checks the finding against your argument and dismisses it when the argument holds, or says what is missing.

No new security issues are evident in the diff; the changes only switch Prometheus to shared core helpers and remove duplicate local implementations/tests.

🧹 generic review — ✅ passed · 0/10

Score: 0/10 · Severity: none · 0 finding(s)

Tokens: 16605 in · 299 out · 16904 total

Budget: 63,261 tokens of 500,000 tokens

Commands

Only comments from maintainers the host itself attributes as such are read; anyone else's are ignored before anything sees them.

Say	What happens
@zuke-build review	Runs the review again now, with no push: every rebuttal is adjudicated and answered where it was made.
@zuke-build accept <id> <reason>	Accepts a finding as intended for this pull request: it is recorded with your reason, its thread is closed, and no reviewer raises it again here — reworded, moved to another file or escalated. In the finding's own thread the id may be left out.
Reply in a finding's thread, or quote its id in a comment	Contests it: the next run re-checks the finding against your argument and dismisses it when the argument holds, or says what is missing.

Refuted by verification (not reported):

Finding	Reason
Removed SigV4 regression tests leave the AWS signer without package-level coverage	The deleted package test file only covered the package's now-removed local signer implementation, and the current code imports signSigV4 from @zuke/core in src/aws.ts and exercises it via tests/aws_test.ts, so package-specific signer coverage was not simply removed without replacement.

Dismissed via discussion (not gating):

Finding	Refuted by	Reason	ID
Core bump may exceed this package’s declared compatibility floor	totollygeek	The diff already updates prometheus to import the moved helpers from @zuke/core and the maintainer shows the package’s compatibility floor is intentionally 1.76.0, with the floor check and published-core verification passing on this head.	24l6u8ur7znp6

Dismissals apply to this pull request only. If one of these keeps coming back on other PRs, add its ID to the suppress list in your build file (.suppress(suppressions((s) => s.add("…")))) to mute it repo-wide.

Reviewer summary, written before verification: The change consolidates SigV4 and URI encoding into core, but it drops the package’s dedicated regression suite and raises a potential floor-compatibility risk for the new core imports.

[zuke-build]

🤖 Zuke AI review

🔎 AI review — review

✅ Passed — no findings.

	Reviewer	Verdict	Score	Severity	Findings
🛡️	security review	✅ passed	0/10	none	0
🧹	generic review	✅ passed	0/10	none	0

🛡️ security review — ✅ passed · 0/10

Score: 0/10 · Severity: none · 0 finding(s)

Tokens: 28931 in · 31 out · 28962 total

Budget: 28,962 tokens of 500,000 tokens

Commands

Only comments from maintainers the host itself attributes as such are read; anyone else's are ignored before anything sees them.

Say	What happens
@zuke-build review	Runs the review again now, with no push: every rebuttal is adjudicated and answered where it was made.
@zuke-build accept <id> <reason>	Accepts a finding as intended for this pull request: it is recorded with your reason, its thread is closed, and no reviewer raises it again here — reworded, moved to another file or escalated. In the finding's own thread the id may be left out.
Reply in a finding's thread, or quote its id in a comment	Contests it: the next run re-checks the finding against your argument and dismisses it when the argument holds, or says what is missing.

No security issues introduced by the diff were found.

🧹 generic review — ✅ passed · 0/10

Score: 0/10 · Severity: none · 0 finding(s)

Tokens: 16813 in · 352 out · 17165 total

Budget: 55,625 tokens of 500,000 tokens

Commands

Only comments from maintainers the host itself attributes as such are read; anyone else's are ignored before anything sees them.

Say	What happens
@zuke-build review	Runs the review again now, with no push: every rebuttal is adjudicated and answered where it was made.
@zuke-build accept <id> <reason>	Accepts a finding as intended for this pull request: it is recorded with your reason, its thread is closed, and no reviewer raises it again here — reworded, moved to another file or escalated. In the finding's own thread the id may be left out.
Reply in a finding's thread, or quote its id in a comment	Contests it: the next run re-checks the finding against your argument and dismisses it when the argument holds, or says what is missing.

Refuted by verification (not reported):

Finding	Reason
Removed Prometheus-specific SigV4 regression tests without a replacement in this package	The deleted file only tested the old local signer implementation, while the refactored package now imports signSigV4 from @zuke/core in src/aws.ts and tests/aws_test.ts already exercises the Prometheus AWS flow through that shared signer, so this change did not remove package-specific coverage without replacement.
Removed URI encoder tests that guarded Prometheus request canonicalization	src/uri.ts was deleted because transport.ts and google.ts now import uriEncode from @zuke/core, and the package no longer contains a local URI encoder to test here, so the alleged missing coverage is for moved shared logic rather than a Prometheus-specific path introduced by this diff.

Notes:

• "Removed Prometheus-specific SigV4 regression tests without a replacement in this package" was refuted in an earlier round and a maintainer replied in its thread — sent back to the verifier

Reviewer summary, written before verification: The refactor removes local Prometheus helpers in favor of core exports, but it leaves the package without its own regression coverage for two path-sensitive behaviors that were previously verified here.