tech-log-backend/docs/superpowers/plans/2026-08-02-redis-session-http-boundary.md

Redis Session HTTP Boundary Implementation Plan

Execution: Follow test-driven development and request an independent read-only review before advancing to the remaining P1 work.

Goal: Prove browser-session security persists and fails closed across the real Spring Session ↔ Redis composition, without silent skips.

Architecture: The app-bootstrap composition test reuses its existing Redis test source set and dependencies. It assembles inbound-web and cache-redis without adding a forbidden leaf-to-leaf edge.

Tech Stack: Java 21, Spring Boot 4.0.0, Spring Security 7, Spring Session 4, Testcontainers 2, Redis 7.4 digest-pinned image, MockMvc, Gradle 9.

Task 1: Explicit Docker No-Skip Gate

Files:

• Modify: src/app-bootstrap/build.gradle

• Exclude redis-session-http from ordinary redisCompositionTest.

• Register redisSessionHttpIntegrationTest over the same source output/classpath with tag inclusion, no-discovery failure, no-skip root-suite guard, UTC, rerun, and image-registry property.

• Keep the Docker task outside ordinary check; reuse Spring Session 4.0.0 and lock only the added redisCompositionTestCompileClasspath configuration.

Task 2: Real Session HTTP RED Contract

Files:

• Create: src/app-bootstrap/src/redisCompositionTest/java/dev/caskeleton/adapter/outbound/cache/redis/RedisSessionHttpBoundaryIntegrationTest.java

• Load and validate the approved digest-pinned Redis image; explicitly start the container.

• Generate ephemeral TLS/ACL/password/HMAC material and assemble canonical SESSION-role configuration with full hostname verification and explicit trust.

• Cross CSRF, login, Spring Session filter, primitive snapshot, and hardened cookie creation.

• Close context A and prove context B restores the authenticated principal from Redis.

• Prove logout/tombstone rejects the old cookie and a stale repository save.

• Stop Redis during lookup and prove fail-closed controller behavior with fixed diagnostics.

• Record and resolve RED composition mismatches: response-commit session creation and framework request-cache serialization.

Task 3: CI Release Gate

Files:

• Modify: .github/workflows/ci-quality-gates.yml

• Add :app-bootstrap:redisSessionHttpIntegrationTest to the existing redis-standalone job.

• Keep the existing required gate identity and matrix dependency unchanged.

Task 4: Verification and Review

• Run the explicit HTTP task and existing app-bootstrap Redis composition task.
• Run the selected cache-redis session capability lane, dependency locks, env keys, architecture, public-path snapshot, static analysis, and git diff --check.
• Request an independent read-only review and resolve all Critical/Important findings.

Verification Evidence

• :app-bootstrap:redisSessionHttpIntegrationTest: 1 test, 0 skipped, GREEN.
• :adapter:outbound:cache-redis:redisSessionCapabilityTest: GREEN with sanitized evidence.
• :adapter:inbound:web:check: unit/contract/static analysis and 13 no-skip JWT/CORS boundary tests GREEN.
• :app-bootstrap:check :app-bootstrap:redisCompositionTest: 640 bootstrap tests (6 pre-existing conditional Docker skips in the ordinary suite, not used as this gate's evidence), TestKit contracts, 14 Redis composition tests, Checkstyle, SpotBugs, and Spotless GREEN.
• verifyDependencyLocks verifyEnvKeys verifyCleanArchitectureDependencies verifyPublicPathSnapshot: GREEN for all 19 registered leaves.
• Review RED: final context reconciliation could retain the authentication saved at response commit; host TLS/ACL material permissions were too broad; the CI task lacked a semantic workflow assertion.
• Review fixes: authoritative final empty/replacement context tests went RED then GREEN, async start defers commit-hook persistence, host material is 0700/0600 and copied selectively into the fixture, and the blocking Redis job is now asserted directly.
• Independent re-review: Critical 0, Important 0, Minor 0; batch READY.