# Redis Session HTTP Boundary Implementation Plan

> **Execution:** Follow test-driven development and request an independent read-only review before
> advancing to the remaining P1 work.

**Goal:** Prove browser-session security persists and fails closed across the real Spring Session ↔
Redis composition, without silent skips.

**Architecture:** The app-bootstrap composition test reuses its existing Redis test source set and
dependencies. It assembles inbound-web and cache-redis without adding a forbidden leaf-to-leaf edge.

**Tech Stack:** Java 21, Spring Boot 4.0.0, Spring Security 7, Spring Session 4, Testcontainers 2,
Redis 7.4 digest-pinned image, MockMvc, Gradle 9.

### Task 1: Explicit Docker No-Skip Gate

**Files:**
- Modify: `src/app-bootstrap/build.gradle`

- [x] Exclude `redis-session-http` from ordinary `redisCompositionTest`.
- [x] Register `redisSessionHttpIntegrationTest` over the same source output/classpath with tag
  inclusion, no-discovery failure, no-skip root-suite guard, UTC, rerun, and image-registry property.
- [x] Keep the Docker task outside ordinary `check`; reuse Spring Session 4.0.0 and lock only the
  added `redisCompositionTestCompileClasspath` configuration.

### Task 2: Real Session HTTP RED Contract

**Files:**
- Create: `src/app-bootstrap/src/redisCompositionTest/java/dev/caskeleton/adapter/outbound/cache/redis/RedisSessionHttpBoundaryIntegrationTest.java`

- [x] Load and validate the approved digest-pinned Redis image; explicitly start the container.
- [x] Generate ephemeral TLS/ACL/password/HMAC material and assemble canonical SESSION-role
  configuration with full hostname verification and explicit trust.
- [x] Cross CSRF, login, Spring Session filter, primitive snapshot, and hardened cookie creation.
- [x] Close context A and prove context B restores the authenticated principal from Redis.
- [x] Prove logout/tombstone rejects the old cookie and a stale repository save.
- [x] Stop Redis during lookup and prove fail-closed controller behavior with fixed diagnostics.
- [x] Record and resolve RED composition mismatches: response-commit session creation and framework
  request-cache serialization.

### Task 3: CI Release Gate

**Files:**
- Modify: `.github/workflows/ci-quality-gates.yml`

- [x] Add `:app-bootstrap:redisSessionHttpIntegrationTest` to the existing `redis-standalone` job.
- [x] Keep the existing required gate identity and matrix dependency unchanged.

### Task 4: Verification and Review

- [x] Run the explicit HTTP task and existing app-bootstrap Redis composition task.
- [x] Run the selected cache-redis session capability lane, dependency locks, env keys, architecture,
  public-path snapshot, static analysis, and `git diff --check`.
- [x] Request an independent read-only review and resolve all Critical/Important findings.

### Verification Evidence

- `:app-bootstrap:redisSessionHttpIntegrationTest`: 1 test, 0 skipped, GREEN.
- `:adapter:outbound:cache-redis:redisSessionCapabilityTest`: GREEN with sanitized evidence.
- `:adapter:inbound:web:check`: unit/contract/static analysis and 13 no-skip JWT/CORS boundary
  tests GREEN.
- `:app-bootstrap:check :app-bootstrap:redisCompositionTest`: 640 bootstrap tests (6 pre-existing
  conditional Docker skips in the ordinary suite, not used as this gate's evidence), TestKit
  contracts, 14 Redis composition tests, Checkstyle, SpotBugs, and Spotless GREEN.
- `verifyDependencyLocks verifyEnvKeys verifyCleanArchitectureDependencies
  verifyPublicPathSnapshot`: GREEN for all 19 registered leaves.
- Review RED: final context reconciliation could retain the authentication saved at response commit;
  host TLS/ACL material permissions were too broad; the CI task lacked a semantic workflow assertion.
- Review fixes: authoritative final empty/replacement context tests went RED then GREEN, async start
  defers commit-hook persistence, host material is `0700`/`0600` and copied selectively into the
  fixture, and the blocking Redis job is now asserted directly.
- Independent re-review: Critical 0, Important 0, Minor 0; batch READY.