Fix malformed HTTP responses from /capabilities and /availability

[bjfultn]

Problem

/capabilities and /availability emit their XML document with no HTTP status line and no headers at all — the first bytes on the wire are <?xml version="1.0"....

These are nph- (non-parsed-headers) CGI endpoints, so the script owns the entire response. nginx and Cloudflare reject the result as a bad upstream response, which is what's breaking these two endpoints in the RedHat/NGINX deployment. Both are IVOA requirements.

This is not a CRLF-variant problem. Every other hand-rolled response in the codebase is already correct — tap.py (×11) and vositables.py (×1) all use print("...\r"), which yields a proper \r\n. These two endpoints were simply missing their headers entirely, which is why standard TAP requests were unaffected.

Second defect

Both endpoints fell through to the "retrieve workspace from jobid" branch with an empty jobid. That resolved to <workdir>/TAP and returned a 500 whenever that directory did not already exist.

So on an established server the directory exists, the request reaches the emitter, and you get the header-less response above. On a fresh deployment these endpoints fail outright. They're static documents that need no workspace at all.

Changes

2565a6d — the fix

• Emit HTTP/1.1 200 OK, Content-type: text/xml, and the blank header-terminating line — all CRLF-terminated, matching the existing convention in this file (print supplies the LF after the literal \r).
• Dispatch both endpoints before workspace resolution.
• Add tests/test_vosi_http_response.py.

ca7a755 — deterministic coverage for the workspace defect

The tests above go through the session-scoped tap_server fixture, which shares one TAP_WORKDIR across the suite. By the time they run, earlier sync requests have already created <workdir>/TAP — so a full-suite run only exercised the established-server path. The fresh-deployment case, where the workspace bug actually returned a 500, was covered only by accident when the file happened to run in isolation.

test_vosi_works_without_existing_workspace drives the CGI against a pristine per-test workdir and asserts both a CRLF-terminated 200 and that the endpoints create no workspace at all. Confirmed it pins the second defect specifically: reverting only the dispatch move, keeping the header fix, fails exactly these two tests.

4a12ff9 — unblocking CI (pre-existing, unrelated to the VOSI bug)

ruff check . has been failing on develop since PR #23 merged on 2026-06-02 — a W291 trailing-whitespace hit at TAP/vositables.py:214 introduced by 9024259. The lint step runs before pytest, so the entire test matrix aborted before a single test executed, and the new tests below got no CI signal at all.

requirements-test.txt asked for ruff>=0.1, so CI silently tracked whatever ruff shipped most recently and a newer release began flagging code nobody had touched. Pinned to ruff==0.15.2 so rule changes arrive as a deliberate bump. The vositables.py change is whitespace-only — git diff -w is empty.

Folded in here rather than split out, by request. Happy to break it into its own PR if you'd rather keep this diff to the VOSI files.

Tests

The new tests assert on raw socket bytes rather than going through a forgiving client library — requests would happily paper over exactly the malformation nginx rejects. They check:

• the response opens with a CRLF-terminated HTTP/1.1 200 OK
• no bare LF or CR appears within any header line
• CRLFCRLF terminates the header block
• an XML Content-type is present
• the XML body is intact

Verified red/green in both directions: they fail against the unpatched code, and they also catch the HTTP/1.1 200 OK\n bare-LF variant described in the original report, so they'd guard against that regression too.

Full suite: 63 passed, 2 skipped (both skips pre-existing and unrelated). ruff check . clean.

Branching note

develop is a strict superset of main (9 ahead, 0 behind), so this lands on develop. Companion PR #26 carries the same code fix to hotfix/table-validation, which NEA runs in production — that branch is 81 commits behind and predates the HTTP test fixture, so it gets the code fix only.

🤖 Generated with Claude Code