DongHyeonkaandClaude Opus 5
5f10b791d3
Snapshot of the in-flight state that already existed, identically, in both this worktree and the main checkout before this session began: the initial HTTP Client platform implementation (previously untracked), the redis-lab removal, and the JPA / object-storage / notification integration work. Kept separate from this session's HTTP Client review response, which lands in the following commit, so the two bodies of work stay reviewable apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
48 lines
2.7 KiB
Markdown
48 lines
2.7 KiB
Markdown
# HTTP Client Platform — Release Checklist
|
||
|
||
A release is complete when each item below is demonstrated by a command, not by review.
|
||
|
||
## Gates
|
||
|
||
```bash
|
||
cd src
|
||
./gradlew :adapter:outbound:httpclient:test --console=plain
|
||
./gradlew :adapter:outbound:httpclient:httpClientStableContractTest --console=plain
|
||
./gradlew :adapter:outbound:httpclient:httpClientSecurityTest --console=plain
|
||
./gradlew :adapter:outbound:httpclient:httpClientBlockHoundTest --console=plain
|
||
./gradlew :adapter:outbound:httpclient:spring62CompatibilityTest --console=plain
|
||
./gradlew :adapter:outbound:httpclient:spring70CompatibilityTest --console=plain
|
||
./gradlew :adapter:outbound:httpclient:httpClientFailureInjectionTest --console=plain # needs Docker
|
||
./gradlew :adapter:outbound:httpclient:httpClientPerformanceTest \
|
||
-Pperformance.assertions.enabled=true --console=plain
|
||
./gradlew verifyCleanArchitectureDependencies --console=plain
|
||
./gradlew :app-bootstrap:test --tests '*CleanArchitectureTest' --console=plain
|
||
python3 ../scripts/verify-httpclient-docs.py
|
||
```
|
||
|
||
## Completion criteria (design §33)
|
||
|
||
- [ ] Typed clients are the default entry point; H2 and H3 are separately authorised.
|
||
- [ ] H1–H4 cannot bypass timeout, host, TLS, auth, size, or observation policy.
|
||
- [ ] Apache, JDK, and Reactor produce identical result and exception metadata.
|
||
- [ ] Pool, DNS, connect, TLS, and retry backoff all fit inside the effective deadline.
|
||
- [ ] Every extra attempt is explained by idempotency, replayability, evidence, deadline, and budget.
|
||
- [ ] Non-idempotent `SENT_NO_RESPONSE` surfaces as `HttpAmbiguousExecutionException`.
|
||
- [ ] Pool and buffers are reclaimed after unread bodies, decode errors, cancels, and size rejections.
|
||
- [ ] OAuth2 refresh is single-flight and 401 replay happens at most once.
|
||
- [ ] Trust-all and hostname-verification bypass fail at startup.
|
||
- [ ] Canonicalisation, DNS/IP validation, redirect revalidation, and egress control all pass.
|
||
- [ ] No transparent retry occurs after the first delivered byte.
|
||
- [ ] No platform code blocks a Reactor event loop, proven by a BlockHound self-check.
|
||
- [ ] The negotiated wire protocol matches what the support matrix claims per transport.
|
||
- [ ] Logical calls and attempts are separate metrics with no forbidden label.
|
||
- [ ] DNS, pool, TLS, reset, partial response, and HTTP/2 GOAWAY are reproducible.
|
||
- [ ] Thread, heap, direct memory, pool, and retry budget bounds hold.
|
||
- [ ] The support matrix, configuration reference, security guide, runbook, and migration guide match the code.
|
||
|
||
## Experimental
|
||
|
||
Jetty HTTP/3 stays Experimental until `Http3CapabilityReport` reports QUIC and TLS 1.3 and the
|
||
contract subset it declares passes in a dedicated environment. It is never auto-configured by the
|
||
Stable starter.
|