chore: initialize from backend template 0a6dd0e

infra/httpclient/README.md

@@ -0,0 +1,12 @@
+# HTTP Client Platform — local test topology
+
+The suites drive these dependencies through Testcontainers and in-process fixtures, so nothing here
+is required to run `./gradlew :adapter:outbound:httpclient:test`. These files exist for the nightly
+lane and for reproducing a failure locally with the same images and ports CI uses.
+
+| Directory | Purpose | Used by |
+|---|---|---|
+| `toxiproxy/` | TCP fault injection (latency, reset, bandwidth) | `httpClientFailureInjectionTest` |
+| `tls/` | how the TLS and mTLS material is produced | TLS and mTLS suites |
+| `proxy/` | forward proxy with CONNECT and proxy authentication | proxy contract suite |
+| `oauth2/` | token endpoint behaviour under contention | OAuth2 suites |

infra/httpclient/oauth2/README.md

@@ -0,0 +1,12 @@
+# OAuth2 fixture
+
+`OAuth2Fixture` exposes a token endpoint backed by the same deterministic fixture server as the rest
+of the suite.
+
+It counts token requests, which is what makes design §20.3's single-flight guarantee provable rather
+than assumed: a hundred genuinely concurrent callers must produce exactly one token request. It can
+also issue rotating token values, so a stale cached token is detectable, and queue a failure status
+to exercise the refresh-failure path.
+
+The token endpoint is configured as its own Named Client Profile, separate from the upstream it
+issues tokens for.

infra/httpclient/proxy/README.md

@@ -0,0 +1,12 @@
+# Forward proxy fixture
+
+`ProxyFixture` runs an in-process forward proxy so the proxy lane needs no external service.
+
+| Factory | Behaviour |
+|---|---|
+| `ProxyFixture.openProxy()` | accepts CONNECT and tunnels to the target |
+| `ProxyFixture.authenticatingProxy(user, password)` | answers `407` until `Proxy-Authorization` matches |
+
+The fixture records every request line and every `Proxy-Authorization` value it saw, which is what
+lets the suite prove design §24.3: proxy credentials never appear on the target request, and a proxy
+CONNECT failure is reported as `HttpProxyException` rather than as a target TLS failure.

infra/httpclient/tls/README.md

@@ -0,0 +1,16 @@
+# TLS fixtures
+
+Certificates are generated **in process** by `TlsFixture`, not checked in. A committed private key
+is a private key that leaks, and design §21.2 forbids key material in the repository.
+
+`TlsFixture` produces, from a throwaway CA created per test run:
+
+| Fixture | Purpose |
+|---|---|
+| `TlsFixture.trusted()` | a server certificate valid for the loopback host |
+| `TlsFixture.hostnameMismatch()` | a certificate whose SAN does not match the connection host |
+| `TlsFixture.expired()` | an already-expired certificate |
+| `clientHandshake(true)` | client key material for the mTLS lane |
+
+All three failure cases must classify as permanent (design §21.3) — never retried, never downgraded
+to plaintext.

infra/httpclient/toxiproxy/compose.yaml

@@ -0,0 +1,17 @@
+# Fault-injection topology for the HTTP Client Platform failure suite (design §28.1, §28.3).
+#
+# The suite normally drives Toxiproxy through Testcontainers. This compose file exists for the
+# nightly lane and for reproducing a failure locally with the exact same image and ports.
+services:
+  toxiproxy:
+    image: ghcr.io/shopify/toxiproxy:2.9.0
+    container_name: httpclient-toxiproxy
+    ports:
+      - "8474:8474"   # control API
+      - "18080:18080" # proxied upstream: plaintext
+      - "18443:18443" # proxied upstream: TLS
+    healthcheck:
+      test: ["CMD", "/toxiproxy-cli", "list"]
+      interval: 5s
+      timeout: 3s
+      retries: 10