DongHyeonkaandClaude Opus 5
5f10b791d3
Snapshot of the in-flight state that already existed, identically, in both this worktree and the main checkout before this session began: the initial HTTP Client platform implementation (previously untracked), the redis-lab removal, and the JPA / object-storage / notification integration work. Kept separate from this session's HTTP Client review response, which lands in the following commit, so the two bodies of work stay reviewable apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
TLS fixtures
Certificates are generated in process by TlsFixture, not checked in. A committed private key
is a private key that leaks, and design §21.2 forbids key material in the repository.
TlsFixture produces, from a throwaway CA created per test run:
| Fixture | Purpose |
|---|---|
TlsFixture.trusted() |
a server certificate valid for the loopback host |
TlsFixture.hostnameMismatch() |
a certificate whose SAN does not match the connection host |
TlsFixture.expired() |
an already-expired certificate |
clientHandshake(true) |
client key material for the mTLS lane |
All three failure cases must classify as permanent (design §21.3) — never retried, never downgraded to plaintext.