[github-actions]

Scope 1.3.0: endpoint manual editing review

Automatic rewrite rules require replacement values before traffic arrives.
This proposal adds a matching pause rule so a developer can inspect the real
request or response, edit it, and explicitly forward or abort that message.
Request, response and both-stage modes reuse the existing bounded breakpoint
lifecycle. Other endpoints continue normally.

Behavior and review boundaries

• Matchers are evaluated against the original request and remain frozen through
  both stages. Automatic actions precede the manual pause for that stage.
• Matching selectors also cover mock/blocked responses and coalesce with other
  selectors/global breakpoints into one editor per message/stage. Applied-rule
  evidence is saved only when the stage is actually reached.
• The pending banner is available in every workspace. Resolve/abort do not wait
  for an unrelated UI operation. Continue unchanged sends no replacement fields.
• The editor validates changes, preserves repeated headers and binary encoding,
  and resets between pending IDs/stages. Invalid backend stage edits retain the
  waiting message for correction. A manual response must use final status 200–599;
  request edits cannot turn a request into a CONNECT tunnel.
• Replay skips manual pauses and their rule evidence. Global-rule MCP mutations
  retain their existing independent rule/write permission gates; pending editing
  is still a desktop action.
• Pauses abort on stop or expiry after 60 seconds. Closing the editor leaves its
  message waiting. The demo service rejects matching pause rules before sending
  its automatic batch or starting its own server/capture. The desktop may already
  have started the selected listener; rejection does not stop that listener.

The change does not redesign archive writes, stream large bodies, bypass new
Android stacks or change SQLite durability. The 16 MiB body limit, 120-second
body collection timeout and current protocol limits remain. Optional native
Frida binaries remain excluded. Unrelated dependency versions and the verified
GLib backport are unchanged.

Validation and publication gates

Focused real HTTP/TLS and UI regressions cover stage matching, post-edit wire
values, immutable snapshots, mock/block ordering, deduplication, unchanged/abort,
replay exclusion, invalid edit retention, expiry and stop cleanup. Native service
coverage rejects demo/selector conflicts before that service's own network/capture
side effects.
Record the final combined tests and independent review in docs/VERIFICATION.md.
Earlier intermediate results do not replace the final candidate checks.

Application/npm/Cargo/Tauri metadata agrees on 1.3.0; regenerate notices from its
locks. Use one canonical bot-authored release/1.3.0 proposal and the normal owner
approval, CodeQL and three-platform check gates. Never bypass main protection.
After merge, tag the reviewed main commit as v1.3.0, build that exact tag into a
draft, and verify all downloaded assets/manifests/checksums/source bytes before
publishing with the 1.3.0 notes. Preserve all historical tags/assets.

Back up data before upgrading. Older versions cannot deserialize persisted pause
actions, even if disabled: remove/convert them before downgrade or restore the
pre-upgrade backup. Interactive Windows/Linux and device compatibility remain
separate acceptance gates. macOS is ad-hoc signed, without Apple notarization;
Intel macOS is unverified. This proposal alone is not a public release.

[dalkedev]

Reviewed e7e3b20. Endpoint pause semantics, immutable match snapshots, automatic-action ordering, terminal responses, per-stage evidence, replay exclusion and retained invalid edits have focused HTTP/TLS coverage. The editor preserves unchanged payloads, concurrent edits and method case; configured proxy ports survive polling across capture/demo/Android starts.

Local validation: 78 locked Rust workspace tests, 55 UI tests, 17 integrity tests and 11 attribution/resource tests pass. The packaged macOS app and embedded MCP pass the real smoke workflow. A native both-stage loopback check verified the edited request at an independent upstream and the edited HTTP 202 response at curl, with originals retained in SQLite. Independent code and release-boundary reviews have no remaining actionable findings. Hosted checks remain separate merge gates; Windows/Linux interactive and large-body streaming support are not claimed.