feat: add production capability foundations

docs/superpowers/plans/2026-07-28-httpclient-production-capability-foundation.md

@@ -12,9 +12,10 @@ own feature-specific semantic ports. `adapter:outbound:httpclient` owns destinat
 immutable operation descriptors, relative target construction, status/retry/body semantics, and
 legacy provider fixes. The generic `OutboundHttpClient` remains a migration facade.
 
-**Scope boundary:** This applies Phase 0 and a bounded Phase 1 foundation. Canonical binding
-composition, exact readiness tuple registry, Apache HC5 pool, active cancellation, TLS/DNS/proxy,
-auth, codec, and real-network qualification remain unimplemented.
+**Scope boundary:** This applies Phase 0 and a bounded Phase 1 foundation. Canonical zero-binding
+composition and active logical cancellation were implemented by later tracked plans. Exact
+readiness tuple registry, Apache HC5 pool, TLS/DNS/proxy, auth, codec, and real-network
+qualification remain unimplemented.
 
 ---
 
@@ -24,9 +25,9 @@ auth, codec, and real-network qualification remain unimplemented.
 - Create: `src/application-core/src/main/java/dev/caskeleton/application/outbound/CallBudget.java`
 - Test: `src/application-core/src/test/java/dev/caskeleton/application/outbound/CallBudgetTest.java`
 
-- [ ] Write RED tests for expiry, remaining time, finite bounds, and parent/child intersection.
-- [ ] Implement without Spring, wall-clock timestamps, scheduler, or HTTP types.
-- [ ] Verify GREEN.
+- [x] Write RED tests for expiry, remaining time, finite bounds, and parent/child intersection.
+- [x] Implement without Spring, wall-clock timestamps, scheduler, or HTTP types.
+- [x] Verify GREEN.
 
 ### Task 2: Add typed operation catalog and safe target construction
 
@@ -41,11 +42,11 @@ auth, codec, and real-network qualification remain unimplemented.
 - Test: `src/adapter/outbound/httpclient/src/test/java/dev/caskeleton/adapter/outbound/httpclient/operation/HttpOperationCatalogTest.java`
 - Test: `src/adapter/outbound/httpclient/src/test/java/dev/caskeleton/adapter/outbound/httpclient/target/HttpTargetBuilderTest.java`
 
-- [ ] Write RED tests for ID/uniqueness/cross-field operation invariants.
-- [ ] Write RED tests rejecting absolute, scheme-relative, traversal, user-info, query/fragment, and
+- [x] Write RED tests for ID/uniqueness/cross-field operation invariants.
+- [x] Write RED tests rejecting absolute, scheme-relative, traversal, user-info, query/fragment, and
   multi-segment variables.
-- [ ] Implement closed immutable descriptors and one-pass path-segment encoding.
-- [ ] Verify GREEN.
+- [x] Implement closed immutable descriptors and one-pass path-segment encoding.
+- [x] Verify GREEN.
 
 ### Task 3: Correct characterized legacy provider safety defects
 
@@ -54,11 +55,11 @@ auth, codec, and real-network qualification remain unimplemented.
 - Modify: `src/adapter/outbound/httpclient/src/main/java/dev/caskeleton/adapter/outbound/httpclient/OutboundHttpRestClientFactory.java`
 - Test: `src/adapter/outbound/httpclient/src/test/java/dev/caskeleton/adapter/outbound/httpclient/OutboundHttpClientSafetyRegressionTest.java`
 
-- [ ] Reproduce streaming 5xx body delivery and logical-call-only circuit-breaker counting.
-- [ ] Make streaming validate status before exposing the body and discard error bodies.
-- [ ] Put circuit breaker around each physical attempt and retry around the attempt loop.
-- [ ] Set JDK redirects to `NEVER` explicitly and validate legacy base URI/relative request targets.
-- [ ] Verify focused regressions and the full legacy test suite.
+- [x] Reproduce streaming 5xx body delivery and logical-call-only circuit-breaker counting.
+- [x] Make streaming validate status before exposing the body and discard error bodies.
+- [x] Put circuit breaker around each physical attempt and retry around the attempt loop.
+- [x] Set JDK redirects to `NEVER` explicitly and validate legacy base URI/relative request targets.
+- [x] Verify focused regressions and the full legacy test suite.
 
 ### Task 4: Record exact readiness and verify
 
@@ -67,10 +68,10 @@ auth, codec, and real-network qualification remain unimplemented.
 - Modify: `src/adapter/outbound/httpclient/CLAUDE.md`
 - Modify: `docs/superpowers/specs/2026-07-27-httpclient-production-capability-design.md`
 
-- [ ] Mark the implemented foundation and fixed legacy defects.
-- [ ] Keep total deadline/cancellation, canonical zero-binding composition, Apache pool, fixed
-  egress, TLS/auth, bounded decoded streaming, and R2 cards unimplemented.
-- [ ] Run:
+- [x] Mark the implemented foundation and fixed legacy defects.
+- [x] Track later total-deadline and canonical-zero-binding increments separately while keeping
+  Apache pool, fixed egress, TLS/auth, bounded decoded streaming, and R2 cards unimplemented.
+- [x] Run:
 
 ```bash
 cd src