Release Review: OTPValidation r4.2 (rc Sync26)

[camara-release-automation]

Release Review: r4.2 rc

This PR finalizes the reviewable release content for the active snapshot.

Edit and review this PR before merging it into the release snapshot. After Codeowner and Release Management approval, merging this PR creates the draft release.

Release contents

API	Version	Status	Comparison target
one-time-password-sms	2.0.0-rc.2	rc	2.0.0-rc.1

Dependencies: Commonalities r4.4, ICM r4.2

Codeowner Actions

Tick each box once done. Ticking the last box — "The release is ready for Release Management review" — starts the Release Management review.

• Update the CHANGELOG

  What to do:

  • Copy all API-consumer-relevant changes from the provided list into the appropriate Breaking changes / Added / Changed / Fixed / Removed sections for each API. List breaking changes both in Breaking changes and in their normal change category.
  • Do not copy administrative, tooling-only, or internal maintenance changes unless they affect API consumers.
  • For each API, fill the CHANGELOG against the stated comparison target, following the release-type rules at the top of the CHANGELOG.

• Document deferred validation warnings (and hints)

  What to do:

  • Check the CAMARA Validation comment on this PR for warnings and hints.
  • For each warning you do not fix, document it in an issue: include a copy of the validation summary line(s) and the reason the fix is deferred.
  • Document in the same way any validation hint that is applicable to the API and needs to be fixed later.
  • You may group several findings into one issue or split them across issues — either is fine.
  • List the documenting issue(s) in a comment on this PR.
  • Note: documenting deferred warnings is optional but recommended for alpha pre-releases, and mandatory for rc pre-releases and public releases.

• The release is ready for Release Management review

  Check that:

  • All mandatory release assets for the declared status(es) are present (see the table below "Required release assets per API status" by expanding the arrow);
  • API documentation and test cases are adequate for the target status.

  Tick this box to confirm readiness and to start the Release Management review.

Release Management Actions

The following actions and checks are done by a Release Management reviewer before approving the PR:

• Assign the Release Management reviewer(s) as assignee(s) of this PR
• CHANGELOG follows the release documentation rules
• Breaking changes are documented and version updates follow SemVer rules
• Mandatory release assets are present for each API according to its status
• All remaining validation warnings are documented in issues and the reasons for deferral are defensible
• Content findings needing a main PR are collected as sub-issues of one issue titled Release r4.2 review findings (see Recording review findings)

Required release assets per API status

Nr	Asset	alpha	rc	initial public	stable public
1	Release Plan	M	M	M	M
2	API Definition(s)	M	M	M	M
3	Commonalities compliance	O	M	M	M
4	API Documentation	M	M	M	M
5	User Stories	O	O	O	M
6	Test Cases (basic)	O	M	M	M
7	Test Cases (enhanced)	O	O	O	M
8	API Description	O	O	M	M

M = Mandatory, O = Optional — Full documentation

Valid next actions for codeowners

• Merge this PR when all Codeowner Actions and Release Management Actions are complete and the required approvals are present — creates the draft release
• Use /discard-snapshot <reason> in the Release Issue to discard this snapshot, return to planned, and update content on main

---

Snapshot: r4.2-da68f85

[camara-validation]

CAMARA Validation — PASS

0 errors, 0 warnings, 1 hints | Profile: standard

View full results

[hdamker]

Release Management review of r4.2 (one-time-password-sms 2.0.0-rc.2).

Content: no findings.

• No wire-contract change against 2.0.0-rc.1: oasdiff changelog reports nothing. The 400/401/403 responses are now byte-identical to the Commonalities r4.4 catalogue entries, all examples match the shared GENERIC_* examples, and the local OneTimePasswordSMS429 keeps both 429 codes as #165 offered in its alternative solution. "Breaking changes: N/A" is correct.
• CAMARA Validation: 0 errors, 0 warnings, 1 hint. The S-313 hint is on Code, which has no fixed format because the OTP format depends on the implementation, so it needs no deferral issue.
• Mandatory assets for rc are all present. Test definitions are updated to v2rc2, and #152 / #165 under #151 are both closed.

CHANGELOG: one fix before merge (see the inline suggestion)

• The two Changed entries describe internal component renames. A consumer reading them can't tell that the responses stayed the same. Following the r4.1 precedent ("Aligned ... to Commonalities r4.3"), the suggestion combines them into one r4.4 alignment entry that states the wire contract is unchanged.

After the CHANGELOG is updated, this is ready to approve from the Release Management side.

[hdamker]

Suggested change

	* Rename 429 class to avoid 'generic' use from common file by @bigludo7 in https://github.com/camaraproject/OTPValidation/pull/166
	* Refactor error response references in OTP SMS API (comm. r4.4) by @bigludo7 in https://github.com/camaraproject/OTPValidation/pull/159
	* Aligned error responses to Commonalities r4.4 (0.9.0). Response codes, error codes and response schemas are unchanged.
	* 400/401/403 now use the Commonalities r4.4 catalogue responses (`BadRequest400`, `Unauthenticated401`, `PermissionDenied403`) with shared examples, by @bigludo7 in https://github.com/camaraproject/OTPValidation/pull/159
	* 429 is defined locally as `OneTimePasswordSMS429` instead of the deprecated `Generic429`, keeping `QUOTA_EXCEEDED` and `TOO_MANY_REQUESTS`, by @bigludo7 in https://github.com/camaraproject/OTPValidation/pull/166