diff --git a/tasks/http/review-http.md b/tasks/http/review-http.md
index da1ca85..52a207b 100644
--- a/tasks/http/review-http.md
+++ b/tasks/http/review-http.md
@@ -1,7 +1,7 @@
 ---
 id: http/review-http
 name: Review alknet-http server surface + OpenAPI adapters for spec conformance
-status: pending
+status: completed
 depends_on: [http/server/gateway-endpoints, http/adapters/to-openapi, http/adapters/from-openapi, http/server/healthz-decoy]
 scope: broad
 risk: low
@@ -163,4 +163,15 @@ core of the crate.
 
 ## Summary
 
-> To be filled on completion
\ No newline at end of file
+> HTTP server surface + OpenAPI adapters reviewed against all 12 checklist items. All
+> conformance criteria pass: HttpAdapter (struct, DecoyConfig, ProtocolHandler, axum
+> over QUIC, h3 not registered), gateway endpoints (5 fixed, no direct-call ADR-047,
+> flat JSON /call, GatewayDispatch::invoke, Internal → 404, 401/403 split, SSE /subscribe),
+> error mapping (all codes, HTTP_<status> prefix, 401/403 split, Retry-After), auth
+> (Bearer-only, shared middleware, ResolvedIdentity, no env vars), /healthz raw + decoy
+> fallback, to_openapi (5 endpoints, info.version 1.0.0, per-caller via /search, error
+> fidelity ADR-023), from_openapi (OperationAdapter, no-env-vars, HTTP_<status>, SSE),
+> SharedHttpClient (ClientWithMiddleware, retry, RetryAfter, ArcSwap), GatewayDispatch
+> (concrete struct, not trait), security constraints (no secrets in responses, no env
+> vars, Internal → 404, AccessControl sole gate). 230 default + 265 mcp tests pass.
+> Clippy clean on both feature configs. Fmt clean.
\ No newline at end of file
diff --git a/tasks/http/review-websocket.md b/tasks/http/review-websocket.md
index 40aa934..0bd07d2 100644
--- a/tasks/http/review-websocket.md
+++ b/tasks/http/review-websocket.md
@@ -1,7 +1,7 @@
 ---
 id: http/review-websocket
 name: Review WebSocket path for ADR-044/048 conformance (native session, no length prefix, browsers-not-peers)
-status: pending
+status: completed
 depends_on: [http/websocket/connection-overlay]
 scope: moderate
 risk: low
@@ -151,4 +151,14 @@ gateway shape, no length prefix).
 
 ## Summary
 
-> To be filled on completion
\ No newline at end of file
+> WebSocket path reviewed against all 11 checklist items. All conformance criteria
+> pass: dispatcher transport abstraction (pub API, non-QUIC CallConnection, no
+> regressions — 277+2 alknet-call tests), WS upgrade (/alknet/call, Bearer auth, 401,
+> HTTP/1.1+HTTP/2), framing (binary WS = EventEnvelope, no length prefix, text → close
+> 1002), dispatch (dispatch_requested, AccessControl gates, FORBIDDEN → call.error,
+> correlation by id, handle_abort), bidirectionality (hub calls browser ops via overlay),
+> connection-local overlay (no PeerId, no PeerEntry, overlay_env() routing,
+> PeerRef::Specific → NOT_FOUND, overlay dies on close), browsers-not-peers rationale,
+> streaming (native call.responded, no SSE, abort cascade on disconnect), all ADRs
+> (012/016/024/029/034/044/048), security constraints. 230 tests pass, clippy clean,
+> fmt clean.
\ No newline at end of file