more ucp

cmd/cart/main.go

@@ -305,8 +305,17 @@ func main() {
 		cartUCP = ucp.WithSigning(cartUCP, signer)
 		log.Print("ucp signing enabled")
 	}
-	mux.Handle("/ucp/v1/carts", cartUCP)
-	mux.Handle("/ucp/v1/carts/", cartUCP)
+	// StripPrefix is required because the sub-mux (CartHandler) registers
+	// routes like "GET /{id}" which expect a relative path; Go's ServeMux
+	// passes the full request path (e.g. /ucp/v1/carts/123) without stripping
+	// the prefix, so the sub-mux would never match.
+	//
+	// Only the subtree pattern (/ucp/v1/carts/) is registered, NOT the exact
+	// pattern (/ucp/v1/carts), because registering both causes Go's ServeMux
+	// to redirect the exact match to the subtree root, and StripPrefix
+	// interferes with the redirect target (producing a 307 to "/" instead
+	// of "/ucp/v1/carts/"). Consumers should use the trailing-slash variant.
+	mux.Handle("/ucp/v1/carts/", http.StripPrefix("/ucp/v1/carts", cartUCP))
 
 	// Stateless promotion evaluation: POST a (possibly partial) eval context and
 	// get back the resulting totals plus the applied/pending effect breakdown,

cmd/checkout/main.go

@@ -194,8 +194,12 @@ func main() {
 		checkoutUCP = ucp.WithSigning(checkoutUCP, signer)
 		log.Print("ucp signing enabled")
 	}
-	mux.Handle("/ucp/v1/checkout-sessions", checkoutUCP)
-	mux.Handle("/ucp/v1/checkout-sessions/", checkoutUCP)
+	// StripPrefix is required because the sub-mux (CheckoutHandler) registers
+	// routes like "GET /{id}" which expect a relative path; Go's ServeMux
+	// passes the full request path without stripping the prefix.
+	// Only the subtree pattern is registered (see comment in cmd/cart/main.go
+	// for why the exact-match pattern is omitted).
+	mux.Handle("/ucp/v1/checkout-sessions/", http.StripPrefix("/ucp/v1/checkout-sessions", checkoutUCP))
 
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		grainCount, capacity := pool.LocalUsage()

cmd/order/main.go

@@ -162,8 +162,12 @@ func main() {
 		orderUCP = ucp.WithSigning(orderUCP, signer)
 		logger.Info("ucp signing enabled")
 	}
-	mux.Handle("/ucp/v1/orders", orderUCP)
-	mux.Handle("/ucp/v1/orders/", orderUCP)
+	// StripPrefix is required because the sub-mux (OrderHandler) registers
+	// routes like "GET /{id}" which expect a relative path; Go's ServeMux
+	// passes the full request path without stripping the prefix.
+	// Only the subtree pattern is registered (see comment in cmd/cart/main.go
+	// for why the exact-match pattern is omitted).
+	mux.Handle("/ucp/v1/orders/", http.StripPrefix("/ucp/v1/orders", orderUCP))
 
 	// Saga / flow admin (backoffice editor).
 	mux.HandleFunc("GET /sagas/capabilities", s.handleCapabilities)