[lex00]

Closes #26.

POST /v1/sprites/{id}/policy/network now answers 204 with no body. It answered 200 with the stored rules.

Which side was off

spritzer. The real API answers the policy update with 204, and every official SDK rejects any other status:

• Go, superfly/sprites-go policy.go:75: if resp.StatusCode != http.StatusNoContent is an error
• JS, @fly/sprites 0.2.3 dist/policy.js:34: if (response.status !== 204) throw
• Python, sprites-py 0.7.1 sprites/policy.py:100: if response.status_code != 204 raises
• Elixir, sprites 0.2.2 (superfly/sprites-ex) lib/sprites/policy.ex, update_by_name: only {:ok, %{status: 204}} is :ok, a 200 becomes {:error, {:api_error, 200, body}}

fountain v0.21.0 uses managoat_sandbox 0.5.0, whose Sprites adapter (lib/managoat/sandbox/sprites.ex, apply_network_policy) calls Sprites.update_network_policy from that Elixir SDK, so its {:invalid, {:http, 200, ...}} is the SDK's rejection, normalised. wisp answers 204 (internal/server/egress_test.go:104). The docs page at sprites.dev/api/sprites/policies lists a generic "200 Success" for the POST with no response fields; the SDKs are what the service is tested against, and they agree on 204.

GET on the same path is unchanged: 200 {"rules": [...]}, as documented.

Enforcement

Not enforced, in either mode, and not changed here. The README's container-mode section now says so explicitly for network policy, and docs/container-mode.md already did.

Verified

fountain-ops main on k3d (fountain v0.21.0, dataPlane=spritzer, container mode, acpFixtureUserId), with this branch's image imported as spritzerImage:

• at 0.6.0, networking_type: limited with allowed_hosts: ["registry.npmjs.org"]: stage network failed {:invalid, {:http, 200, %{"rules" => [...]}}}, conversation failed
• with this change, the same Environment: network done, the fixture turn ends end_turn, and the artifact reads back from the sprite pod; spritzer's GET returns the allow rule
• with allowed_hosts: []: network done, turn end_turn, GET returns [{"domain":"*","action":"deny"}]

chant's wire-compatible fake has the same 200 reply: INTENTIUS/chant#2719.