docs(v4): verify GetCreditLimits wire-shape against official docs (closes #430)

[axisrow]

Summary

• Fetched https://yandex.ru/dev/direct/doc/dg-v4/reference/GetCreditLimits and confirmed CLI dry-run output matches the docs exactly: request body is {method, finance_token, operation_num} with no param.
• Stamps direct_cli/v4_contracts.py:GetCreditLimits.notes with a Docs-verified 2026-05-28 line.
• No code changes — implementation in commands/v4finance.py:200-278 was already correct.

Verification

Docs-verified against dg-v4/reference/GetCreditLimits (response shape too: {data: {Currency, Limits: [{ContractID, Limit, LimitSpent}]}}).

Live API behaviour was not re-verified due to absence of finance credentials in this session. If actual API drifts from docs, file a follow-up issue tagged api-status:docs-drift + needs:live-verification.

Test plan

• pytest tests/test_v4finance_read.py -k get_credit_limits — 8 passing.

Closes #430. Part of milestone 22.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[axisrow]

@claude review. Focus on critical issues: bugs, security vulnerabilities, logical errors, data loss risks, performance problems. Do NOT nitpick style, naming conventions, minor formatting, or subjective preferences — only flag issues that could break functionality or cause real harm in production.

[claude]

Claude finished @axisrow's task in 58s —— View job

---

Review — no critical issues

• Read the diff against origin/main
• Inspect direct_cli/v4_contracts.py in context
• Cross-check commands/v4finance.py GetCreditLimits implementation
• Verify the test claim (tests/test_v4finance_read.py::test_get_credit_limits_dry_run_omits_param_and_masks_finance_token)
• Post review focused on critical issues only

---

Verdict: ship it. The diff is a 4-line append to the notes string on V4_METHOD_CONTRACTS["GetCreditLimits"] in direct_cli/v4_contracts.py:71-79. Pure metadata, zero runtime impact.

Critical-issue scan (all clear):

• Bugs / logic errors — none. validate_v4_body_shape (v4_contracts.py:547) reads param_shape, method, group, etc.; it never inspects notes. The string is consumed by humans only.
• Wire-shape claim is accurate. The new note asserts the dry-run body is {method, finance_token, operation_num} with no param. Confirmed at two layers:
  • commands/v4finance.py:255-261 calls _masked_finance_body("GetCreditLimits", None, operation_num) (param=None) and commands/v4finance.py:272 calls call_v4(client, "GetCreditLimits", None).
  • tests/test_v4finance_read.py:39-43 asserts exactly {"method": "GetCreditLimits", "finance_token": "<redacted>", "operation_num": 42}.
• Security — no token, no URL, no secret. finance_token masking continues to be handled by _masked_finance_body, untouched here.
• CLAUDE.md "no URL literals" rule — not violated. The note references the docs path dg-v4/reference/GetCreditLimits as a non-URL identifier; no https://… literal is introduced. (The URL itself lives once in resource_mapping.py's registry, per the rule.)
• Data loss / performance — n/a, no behavior change.

Minor observation (non-blocking, mentioning only because the PR title says "verify against official docs"): the new note duplicates the existing first sentence in the same notes field — both now say "request body is method + finance_token + operation_num, no param." Not a bug, just slight redundancy in a metadata string. Safe to leave as-is given the PR's intent is to add a dated verification stamp.

No action required from me. The "Live API behaviour was not re-verified" caveat in the PR body is appropriately scoped — live_probe_allowed=False already prevents tests/test_v4_live_contracts.py from probing this method, so the docs-stamp doesn't risk a stale assertion downstream.
· branch feat/milestone-22-close-430-get-credit-limits