# Contributor handoff — koajs/koa

> Canonical page: https://codevetter.com/unpack/koa/agent-handoff

# Contributor handoff — koajs/koa

Scanned commit 824c1cf8de9a91a2941973b25dc8a3d3029b9e4f (2026-09-18). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Begin with the lifecycle and paired response implementations, then inspect the API-specific tests. Tests and CI were inspected, not executed, so future validation must establish its own results. Preserve the library's documented extension boundaries and treat this report as a bounded source inventory.
- Read package.json and application.js first to understand module exports, generated ESM output, constructor options, middleware composition, and request completion. — [package.json#L5-25](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/package.json#L5-L25) [lib/application.js#L87-115](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L87-L115) [lib/application.js#L182-219](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L182-L219)
- For body changes, read response.body and application.respond together; metadata assignment and transport output are separate and share explicit-status/null and stream assumptions. — [lib/response.js#L135-232](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/response.js#L135-L232) [lib/application.js#L283-351](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L283-L351)
- Preserve the context delegation contract when adding request or response properties; the FAQ requires generally useful APIs and consistent getter/setter ownership. — [lib/context.js#L195-248](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/context.js#L195-L248) [docs/faq.md#L36-49](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/faq.md#L36-L49)
- Use request-local ctx.state for middleware data; putting mutable data on app.context shares it through the application prototype. — [lib/application.js#L228-242](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L228-L242) [docs/api/context.md#L53-58](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/api/context.md#L53-L58) [docs/api/index.md#L195-201](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/api/index.md#L195-L201)
- The established checks are npm test, npm run lint, and npm run test:coverage; inspected test files use node:test and can support focused file selection when execution is authorized. — [package.json#L17-22](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/package.json#L17-L22) [__tests__/application/compose.test.js#L3-6](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/application/compose.test.js#L3-L6) [.github/workflows/node.js.yml#L24-26](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/.github/workflows/node.js.yml#L24-L26)
- ESM loading depends on generated dist/koa.mjs; npm prepare builds it, and the ESM suite checks parity with the CommonJS constructor and exports. — [package.json#L5-10](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/package.json#L5-L10) [package.json#L24-25](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/package.json#L24-L25) [__tests__/load-with-esm.test.js#L4-35](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/load-with-esm.test.js#L4-L35)
- Follow two-space formatting and Standard linting; distinguish legacy comments/config from current behavior, since use() mentions conversion but only registers functions, v3 docs remove old middleware support, and the test config still labels Jest. — [.editorconfig#L4-10](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/.editorconfig#L4-L10) [package.json#L20-22](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/package.json#L20-L22) [lib/application.js#L157-171](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L157-L171) [Readme.md#L80-86](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/Readme.md#L80-L86) [__tests__/.eslintrc.yml#L1-3](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/.eslintrc.yml#L1-L3)
- Do not infer runtime verification from inspected fixtures: HTTP/2 host tests synthesize fields, snapshot tests simulate callbacks, fetch-named tests construct local Responses, and declared CI steps provide no execution result in this brief. — [__tests__/request/host.test.js#L33-50](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/request/host.test.js#L33-L50) [__tests__/application/currentContext.test.js#L129-145](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/application/currentContext.test.js#L129-L145) [__tests__/application/respond.test.js#L662-675](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/application/respond.test.js#L662-L675) [.github/workflows/node.js.yml#L18-30](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/.github/workflows/node.js.yml#L18-L30)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)