release: v0.9.1 — auth scheme, doc-system router, lint adoption

[kwschulz]

Release scope: v0.9.1

Bundles four streams of work into a single patch release. CHANGELOG entries have the full details — this PR description is a tour for reviewers.

1. Authorization scheme preservation — feat(sanitization):

Authorization header redaction now preserves the RFC 7235 scheme token (Basic, Bearer, Digest, NTLM, Negotiate, OAuth) and only redacts the credential after the first whitespace: Authorization: Bearer AUTH_xxxxx. Unknown schemes fall through to full redaction so non-standard leading tokens can't escape. Implemented as a third header-classification bucket (headers.scheme_redact). Restores the ability of downstream pipelines (e.g. cable_modem_monitor's analyze_har) to classify auth strategy from a single authenticated request.

2. Dialog observability integration tests — test(capture):

Closes the test-coverage gap acknowledged when v0.9.0 shipped: the dialog observability code (PR #52, closes #46) had unit tests but was never verified against a real browser. Adds 8 integration tests that drive the production JS init script + page.expose_function bridge through a real Playwright headless Chromium session and assert the cross-context callback round-trip works. Tests import the production strings directly so any future drift in either side fails the suite.

Test	Verifies
test_alert_records_accept	alert() has only an accept path; bridge records action=accept
test_confirm_accept_records_accept	Accepted confirm() records action=accept
test_confirm_dismiss_records_dismiss	Dismissed confirm() records action=dismiss
test_prompt_accept_with_value_records_accept	prompt() with value records action=accept
test_prompt_dismiss_records_dismiss	Dismissed prompt() records action=dismiss
test_multiple_dialogs_in_sequence_all_recorded	Three dialogs in sequence — all three recorded in order
test_duplicate_messages_each_recorded_separately	Two confirm() calls with identical message produce two distinct resolutions (regression guard)
test_production_dialog_handlers_round_trip_end_to_end	The EXACT production closures wired into a real Playwright session, asserts the match-by-(type, message) update produces the final resolved_by="browser_ui" + action=accept record

Marked @pytest.mark.integration + @skip_no_browser so the tests only run with pytest -m integration against an installed chromium.

3. Doc-system router restructure + lint adoption

CLAUDE.md becomes a thin router with a "Where Things Live" routing table; architecture / code-quality / testing / release principles move to their authoritative homes:

• New docs/CODE_REVIEW.md houses code-quality and test-file standards plus a concrete Quality Gates table.
• docs/ARCHITECTURE.md gains a Code Organization section (SoC, DRY, no-CLI-dep, additive-only).
• docs/RELEASE.md gains a Version Numbering policy (pre-1.0 bump rules + CHANGELOG-section tiebreaker) and a Branching and Merging section (one PR per release, consolidate before pushing, cherry-pick vs rebase).
• ADR-11 in docs/ARCHITECTURE_DECISIONS.md records the rationale.
• 10 numbered-principle cross-refs in code/tests/scripts migrated to authoritative-doc pointers.

Markdownlint adopted alongside the existing mdformat hook:

• New .markdownlint.jsonc / .markdownlint.json / .markdownlint-cli2.jsonc — every customization verified by isolation-testing, only MD013 customized (line-length 120 with table/code exemptions documented in the config).
• markdownlint-cli2 v0.22.1 added to pre-commit.
• mdformat hook now uses --wrap 120 + the mdformat-frontmatter plugin so YAML frontmatter in issue templates stops being collapsed to horizontal rules.
• Full doc tree reflowed to 120-char lines (~2700 mechanical diff lines).
• Surfaced and fixed during the lint adoption: 3 bare-URL violations, 2 trailing-colon headings, 1 missing-H1 in PR template.

Release-flow hardening:

• .github/workflows/release.yml awk regex was extracting empty release notes for every prior release. Replaced with flag-toggle pattern; verified against the 0.9.1 CHANGELOG content.
• .github/ISSUE_TEMPLATE/bug_report.md and feature_request.md restored to functioning YAML frontmatter.
• scripts/release.py rule-3 reference corrected.

4. custom_patterns cross-cutting coverage audit — test(sanitization):

New 387-line parametrized matrix asserting custom_patterns takes effect at every public sanitization entry point × every reachable detection site. Executable form of the coverage claim around custom_patterns.

Verification

• Default suite (-m "not integration"): 2064 passed, coverage 94.34% (gate 90%)
• All pre-commit hooks green (incl. new markdownlint-cli2, mdformat with --wrap 120, mdformat-frontmatter, detect-secrets)
• Fresh-context subagent smoke test on three trick questions (version bump, PR consolidation, coverage threshold) — all answered correctly from docs alone
• scripts/release.py 0.9.1 --dry-run pre-flight validates (the on-main part of the gate runs post-merge)

Version bump

pyproject.toml and src/har_capture/__init__.py bumped 0.9.0 → 0.9.1. CHANGELOG.md dated 2026-05-13 with comparison link.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 98.47328% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/har_capture/capture/browser.py	92.59%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!