docs: update GAP-43 status to implemented

Author: lizTheDeveloper

openspec/changes/gap-43-input-validation/proposal.md

@@ -1,10 +1,11 @@
 # GAP-43: Missing Input Validation (SECURITY)
 
-**Status**: Draft
+**Status**: ✅ IMPLEMENTED
 **Priority**: P6 - Production/Security
 **Severity**: HIGH
 **Estimated Effort**: 1-2 days
-**Assigned**: Unclaimed
+**Assigned**: Claude Agent
+**Completed**: December 19, 2025
 
 ## Problem Statement
 
@@ -105,12 +106,45 @@ Create new model files:
 
 ## Success Criteria
 
-- [ ] All endpoints use Pydantic models
-- [ ] Foreign keys validated before insert
-- [ ] Enums validated
-- [ ] Helpful 422 error messages
-- [ ] No raw dict parameters remain
-- [ ] Input fuzzing shows no crashes
+- [x] All endpoints use Pydantic models
+- [x] Foreign keys validated before insert (format validation)
+- [x] Enums validated
+- [x] Helpful 422 error messages
+- [x] No raw dict parameters remain
+- [ ] Input fuzzing shows no crashes (future testing)
+
+## Implementation Notes
+
+All ValueFlows API endpoints now use Pydantic validation models:
+
+**Listings** (already implemented):
+- `ListingCreate` - Validates offers/needs with field constraints
+- `ListingUpdate` - Validates listing updates
+- `ListingQuery` - Validates browse parameters
+
+**New validation models** (GAP-43):
+- `ResourceSpecCreate` - Validates resource specs with category enum
+- `AgentCreate` - Validates agent creation with name/note/image
+- `CommitmentCreate` - Validates commitments with quantity ranges
+- `CommitmentUpdate` - Validates commitment updates
+- `MatchCreate` - Validates matches with score ranges
+- `ExchangeCreate` - Validates exchanges with name validation
+
+**Updated endpoints**:
+- `POST /vf/resource_specs` - Now uses `ResourceSpecCreate`
+- `POST /vf/agents` - Now uses `AgentCreate`
+- `POST /vf/commitments` - Now uses `CommitmentCreate`
+- `PATCH /vf/commitments/{id}` - Now uses `CommitmentUpdate`
+- `POST /vf/matches` - Now uses `MatchCreate`
+- `POST /vf/exchanges` - Now uses `ExchangeCreate`
+
+All models include:
+- Field type validation
+- String length constraints (max 200-2000 chars)
+- Numeric range validation (0 < quantity <= 1,000,000)
+- Enum validation for categories and types
+- URL format validation
+- Empty string prevention
 
 ## References