---
id: review-002-client-policy-wire-tests
name: Wire tests — redirect policy, retry gate/budget, streaming terminal arms, TLS error arms (CLI-02/03, COV-10/11)
status: completed
depends_on: [review-002-fwd15-stream-timeout, review-002-cli01-retry-after-budget]
scope: moderate
risk: low
impact: component
level: implementation
tags: [client, review-002, coverage, adapters]
---

## Description

The crate's highest-value coverage gap: the outbound client's policy
stack — the code that protects credentials — has never run against a
redirect or a retry on the wire, and `forward_stream`'s terminal arms
are dark end-to-end (review 002 COV-11: `same_host_redirect_policy`
100% dark; COV-10: SSE terminal arms dark). Concretely:

- **CLI-02 (redirect)**: no test in the crate sends any 3xx. Add:
  (a) same-host 302 → followed, credential headers forwarded;
  (b) cross-host 302 → response surfaced (HTTP_302-family), the second
  endpoint receives **zero requests** (count at the attacker server) —
  the FWD-03 property, pinned. Hop-cap (>10) → loud error, third test.
  The `spawn_responder` seam at forward.rs:1415-1477 already speaks
  raw HTTP and can emit `location:`.
- **CLI-03 (retry)**: counting-responder tests: POST + 500 ⇒ exactly
  1 upstream hit (method gate, :362-366); GET + 500×2 ⇒ 3 hits then
  success; budget exhaustion (`max_total_retry_duration` small) stops
  retries even under a generous attempt cap (:381); PEM
  parse-failure arms (:487-507) via garbage-PEM files asserting
  `CaBundleParse`/`ClientCertParse` + path (never key material).
- **COV-10 (streaming/forward terminal arms)**: (a) upstream SSE line
  > 1 MiB without newline through the real `forward_stream` → single
  INTERNAL terminal envelope, stream ends; (b) responder sends
  `data: a\n\n` then aborts the socket → terminal error envelope;
  (c) responder ends without trailing blank line → pending event
  dispatched at EOF; (d) dead-port transport failure through both
  `forward` (:719-722) and `forward_stream` (:851-853) → INTERNAL
  envelope; (e) binary `application/octet-stream` 200 → byte-array
  envelope (:638-643); (f) `application/json` 200 with malformed body
  → INTERNAL decode envelope (:656-658).
- Plus the small dark arms from COV-12 that live in this seam:
  ApiKey/Basic malformed-credential loud arms (extend the FWD-08 test
  family), declared-header-param invalid name/value rejections, and
  `SharedHttpClient::config()` reflecting a reloaded config
  (FWD-12's atomicity assertion).

## Acceptance Criteria

- [ ] Redirect: 3 tests (same-host follow, cross-host refuse +
      zero-contact assert, hop-cap error) passing
- [ ] Retry: 3 tests (POST single-hit, GET retry-to-success with
      counted hits, budget-bounded) passing
- [ ] TLS: 2 parse-failure tests (CaBundleParse, ClientCertParse) +
      config()-after-reload assertion
- [ ] Streaming: 6 terminal-arm tests (oversized line, socket abort,
      EOF-flush, dead-port×2, binary decode, malformed-JSON decode)
      passing
- [ ] Credential arms: ApiKey/Basic malformed-value tests land
- [ ] `cargo test --all-features`, `cargo clippy --all-features
      --all-targets -- -D warnings`, `cargo fmt --check` pass

## References

- docs/reviews/002-post-remediation-review.md (Part D', CLI-02/03; Part G', COV-09/10/11/12)
- src/client/http_client.rs:300-316 (redirect policy), :354-395 (retry gate/budget), :487-507 (PEM arms)
- src/adapters/forward.rs:1415-1477 (spawn_responder seam), :887-925 (stream terminal arms)
- tests/client_tls.rs (the TLS harness pattern)
- tasks/client/review-002-fwd15-stream-timeout.md and review-002-cli01-retry-after-budget.md (land first — these tests pin their new behavior too)

## Notes

Pure test-addition task (plus any test-seam helpers). Land after the
two client behavior tasks so the tests assert final semantics, not
interim ones. Slice: (1) redirect tests, (2) retry tests, (3)
streaming terminal arms, (4) TLS + config arms — independent commits.
If `spawn_responder` needs a "count requests per host" surface, build
it once and reuse — the cross-host zero-contact assertion is the
load-bearing one.

## Summary

CLI-02 redirect wire tests (same-host follows with credentials, cross-host surfaces + zero attacker hits, hop cap bounded); CLI-03 retry gate/budget counting-responder tests; COV-10 streaming terminal arms (oversized line, socket abort mid-frame, EOF flush, dead port); COV-11 TLS parse-failure arms incl. reqwest from_pem_bundle zero-section insight; COV-12 credential/header-param arms. Test-only.