alkhttp/tasks/server/review-001-hyper-server-knobs.md at 12b35e2c5f8bb16217d937296ca6df9135318843

Files

T

glm-5.3-flash 12b35e2c5f docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

2026-08-29 07:10:15 +00:00

3.0 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Review 001 server-core minors, grouped because they are small, disjoint, and all land in src/server/:

SRV-04: HyperBuilder (src/server/adapter.rs:217-224) sets no timer — hyper 1.11 silently ignores header_read_timeout without one (verified against hyper source), so the slow-loris surface is open and every keep-alive knob is off. Set a timer (tokio) + header_read_timeout
- h1/h2 keep-alive knobs. No concurrency cap exists in this crate (the accept loop is the consumer's) — document that boundary in the module doc.
SRV-05: with_decoy consumes extra_routes via .take() (adapter.rs:104); a second builder call silently rebuilds without the custom routes. Clone (or error on double-build).
SRV-07: the decoy is only the router fallback — method-mismatch requests return axum's bare 405 with no Server: nginx header, which single-handedly distinguishes alkhttp from nginx in decoy deployments (empirically verified). Wrap 405s with the decoy response.
SRV-08: percent_decode maps +→space (wrong in a URI path) and per-byte→char (mojibake for non-ASCII filenames) — decoy.rs:106-127. Fix with proper UTF-8 percent-decoding; also move the blocking is_dir()/is_file() syscalls off the async path.
SRV-09: /openapi.json error path echoes raw serde internals to unauthenticated callers and re-serializes the whole projection per request (adapter.rs:250-254); companion unguarded .expect("to_openapi always emits…") in to_openapi.rs:67. Cache the serialized doc, return a generic 500 body, remove the expect.
SRV-10: WS upgrade hardcodes NoCap while the doc claims a stricter policy is passable — add the injection point or fix the doc; drop the double token resolution (router middleware + ws_bearer_auth).

Acceptance Criteria

Hyper configured with timer + header read timeout; knob values documented
405 responses carry the decoy Server header (test with OPTIONS /search)
%C3%A9 and a+b.html resolve correctly in the decoy static server (tests); async-path syscalls gone
/openapi.json 500 body is generic; doc cached; expect removed
Second .with_decoy no longer silently drops extra routes (test)
SRV-10: policy injection point exists or doc corrected; single token resolution
cargo test, cargo test --all-features, cargo clippy --all-targets -- -D warnings pass

References

docs/reviews/001-initial-implementation-review.md (Part A, SRV-04..SRV-10)
docs/architecture/decisions/010-alpn-router-and-endpoint.md

Notes

Agent fills during implementation. Independent of the other review-001 tasks; can proceed in parallel.

Summary

Filled on completion.

3.0 KiB Raw Blame History