---
id: review-001-client-config-and-cert-coverage
name: Client config API cleanup (HY-06) + mTLS/CA-bundle test coverage (COV-02)
status: pending
depends_on: []
scope: narrow
risk: low
impact: component
level: implementation
tags: [client, review-001, follow-up, coverage]
---

## Description

Two deferred client-host items, grouped (same file, `src/client/http_client.rs`):

- **HY-06**: `HttpClientConfig.retry_policy` exposes
  `reqwest_retry::ExponentialBackoff` in the public API (`:116`) — a
  semver anchor to an upstream concrete type and an awkward construction
  surface. The post-remediation config (RetryGate, TotalRetryBudget,
  attempt counts, backoff bounds, budget deadline) is exactly why this
  should now be an owned config struct (e.g. `max_retries`,
  `max_retry_interval`, `initial_backoff`, `max_total_retry_duration`)
  from which the middleware stack builds the internal backoff. Breaks
  the public type — fine pre-publish; do it once, now, while the
  surface is small.
- **COV-02 residue**: no test constructs a client with a working CA
  bundle or client cert — only the missing-file error paths are tested
  (`new_with_missing_ca_bundle_errors`). Post-remediation the
  redirect/retry gates hang off this client, so the TLS-config paths
  should be exercised: a test server with a self-signed cert + client
  presenting its own cert, happy path through the full middleware stack.

## Acceptance Criteria

- [ ] `HttpClientConfig` no longer exposes `ExponentialBackoff`; owned field set covers what the remediation made configurable; module docs updated
- [ ] Existing config-construction call sites migrated (adapters' test fixtures included)
- [ ] TLS test: client built with a CA bundle connects to a private-roots server; client-cert path exercised end-to-end (COV-02's uncovered build paths)
- [ ] Feature matrix green (default, `--all-features`, `--no-default-features`)
- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass

## References

- docs/reviews/001-initial-implementation-review.md (Part H, HY-06; Part I, COV-02)
- tasks/client/review-001-client-timeout-retry.md (the retry policy work this builds on)

## Notes

> Agent fills during implementation. Public-API shape change —
> coordinate with review-001-missing-docs-sweep if running concurrently
> (same module's docs).

## Summary

> Filled on completion.