alkhttp/tasks/client/review-001-client-config-and-cert-coverage.md at 5d6945cd4b58937f117f969e9419a6b61f5640ab

Files

T

glm-5.3-flash 5d6945cd4b docs(tasks): post-remediation sweep — 4 follow-up tasks

Found in the sweep of completed review-001 remediation:
- /publish schema validation fails open on compile error + recompiles
  per request (remediation-introduced, routes.rs:254-268)
- OAI-06 loud-degradation unblocked and still open (HTTP_0 marker)
- HY-06 ExponentialBackoff in public API + COV-02 mTLS success path
  both unblocked post client-config rework
- HY-02/04/11 publish-prep docs gate (104 missing-docs warnings
  re-measured)

Also flagged, not tasked here: WS-12 (alkcall demux 4 GiB discard
alloc) was never actually filed in alkcall's consumer-findings-ledger —
only CF-001 is there. File it when next touching alkcall.

taskgraph: validate clean (42), no cycles

2026-08-30 06:03:29 +00:00

2.3 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Two deferred client-host items, grouped (same file, src/client/http_client.rs):

HY-06: HttpClientConfig.retry_policy exposes reqwest_retry::ExponentialBackoff in the public API (:116) — a semver anchor to an upstream concrete type and an awkward construction surface. The post-remediation config (RetryGate, TotalRetryBudget, attempt counts, backoff bounds, budget deadline) is exactly why this should now be an owned config struct (e.g. max_retries, max_retry_interval, initial_backoff, max_total_retry_duration) from which the middleware stack builds the internal backoff. Breaks the public type — fine pre-publish; do it once, now, while the surface is small.
COV-02 residue: no test constructs a client with a working CA bundle or client cert — only the missing-file error paths are tested (new_with_missing_ca_bundle_errors). Post-remediation the redirect/retry gates hang off this client, so the TLS-config paths should be exercised: a test server with a self-signed cert + client presenting its own cert, happy path through the full middleware stack.

Acceptance Criteria

HttpClientConfig no longer exposes ExponentialBackoff; owned field set covers what the remediation made configurable; module docs updated
Existing config-construction call sites migrated (adapters' test fixtures included)
TLS test: client built with a CA bundle connects to a private-roots server; client-cert path exercised end-to-end (COV-02's uncovered build paths)
Feature matrix green (default, --all-features, --no-default-features)
cargo test and cargo clippy --all-targets -- -D warnings pass

References

docs/reviews/001-initial-implementation-review.md (Part H, HY-06; Part I, COV-02)
tasks/client/review-001-client-timeout-retry.md (the retry policy work this builds on)

Notes

Agent fills during implementation. Public-API shape change — coordinate with review-001-missing-docs-sweep if running concurrently (same module's docs).

Summary

Filled on completion.

2.3 KiB Raw Blame History