TASK-078: resolve commented-out CONNECT bodies and dead validator integ test

Two HIGH audit findings in test/integ/basic.cpp:

(a) Two `/* ... */`-commented CONNECT-method test bodies in
    basic_suite::complete and basic_suite::only_render, dating to
    commit bd39cb4 (Nov 2017, "Avoid tests getting stack on CONNECT
    requests"). The hang was a libcurl client-side artifact -
    curl_easy_perform with CURLOPT_CUSTOMREQUEST "CONNECT" waits for
    a tunnel that never comes from a plain HTTP server. Server-side
    CONNECT dispatch IS exercised: webserver_request.cpp's methods[]
    table maps the CONNECT wire token to render_connect, and the
    render_connect signature is pinned by
    test/unit/http_resource_test.cpp. Delete the dead bodies and
    record the rationale as REGRESSION.md divergence #6.

(b) basic_suite::validator_builder only asserted "server boots with a
    validator callback set" - the validator hook has been unwired
    from the dispatch path since commit 9163a4f (Jan 2013,
    "Eliminated unescaper and validator delegates"). The equivalent
    compile-time pin already lives in
    test/unit/create_webserver_test.cpp::builder_validator
    (LT_CHECK_NOTHROW on the builder call). Delete the integ test
    and note in RELEASE_NOTES.md that v2's request_received /
    accept_decision hooks are the documented replacement for the
    URL-veto use case the original validator was intended for.

No public surface change. The validator() builder method,
validator_ptr typedef, and get_request_validator() accessor remain
as inert v1 surface (separate task if anyone wants to actually
remove them). The basic test count drops by 1 (validator_builder
removed, 97 -> 96); the complete and only_render tests pass
unchanged. Full make check: 103/103 PASS.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: etr

RELEASE_NOTES.md

@@ -80,6 +80,22 @@ v1.x is end-of-life on the day v2.0 ships.
   the legacy callable is no longer implicitly convertible to
   `auth_handler_ptr`. There is no runtime ABI surface to break — the
   overload was a header-only inline forwarder.
+- **`create_webserver::validator(...)` dispatch semantics — confirmed
+  never wired (TASK-078).** The `validator` builder method and the
+  `validator_ptr` callback typedef on `create_webserver` are retained
+  as inert v1 surface — the callback has not been invoked from the
+  dispatch path since commit `9163a4f` (Jan 2013, "Eliminated unescaper
+  and validator delegates"). v2 ships the surface unchanged for source
+  compatibility, but a configured validator callback is dead code. The
+  v2 replacement is `webserver::add_hook(hook_phase::request_received,
+  ...)` returning `hook_action::respond_with(http_response)` to reject
+  a request, or `hook_phase::accept_decision` for a connection-scoped
+  veto (see `specs/architecture/04-components/hooks.md`). The legacy
+  `validator_builder` integ test in `test/integ/basic.cpp` exercised
+  no validation behaviour (it only asserted the server booted with a
+  validator set) and has been removed; the equivalent compile-time
+  builder pin survives at
+  `test/unit/create_webserver_test.cpp::builder_validator`.
 - **v1 `registered_resources*` registration maps (internal).** No
   public-API change. Dispatch already routed through the v2 3-tier
   route table (`lookup_v2()`) after TASK-053; the residual

specs/tasks/M7-v2-cleanup/TASK-078.md

@@ -8,9 +8,9 @@
 `test/integ/basic.cpp:821-830, 885-896` carry `/* … */`-commented-out CONNECT-method test bodies with no tracking issue. `basic.cpp:2895` (`validator_builder` test) only asserts the server boots; the validator hook is "stored but not currently called in webserver". Either restore the bodies or remove them with a tracking link.
 
 **Action Items:**
-- [ ] Investigate why the CONNECT-method blocks at `basic.cpp:821-830` and `885-896` were commented out (git log of the lines). If the commented behaviour is no longer achievable under v2 dispatch, delete the blocks and add a one-line note to `test/REGRESSION.md` recording the v1-only feature.
-- [ ] If the blocks should still pass under v2, uncomment them and fix any breakage.
-- [ ] For the `validator_builder` test at `basic.cpp:2895`: either wire the validator hook into the dispatch path so the test exercises real behaviour, or delete the test and note in `RELEASE_NOTES.md` that `validator_builder` is a v1 surface with no v2 semantics.
+- [x] Investigate why the CONNECT-method blocks at `basic.cpp:821-830` and `885-896` were commented out (git log of the lines). If the commented behaviour is no longer achievable under v2 dispatch, delete the blocks and add a one-line note to `test/REGRESSION.md` recording the v1-only feature.
+- [x] If the blocks should still pass under v2, uncomment them and fix any breakage.
+- [x] For the `validator_builder` test at `basic.cpp:2895`: either wire the validator hook into the dispatch path so the test exercises real behaviour, or delete the test and note in `RELEASE_NOTES.md` that `validator_builder` is a v1 surface with no v2 semantics.
 
 **Dependencies:**
 - Blocked by: None
@@ -25,4 +25,4 @@
 **Related Requirements:** PRD §2 test reliability NFR
 **Related Decisions:** None new
 
-**Status:** Backlog
+**Status:** Done

specs/tasks/M7-v2-cleanup/_index.md

@@ -42,7 +42,7 @@ TASK-093).
 | TASK-075 | Propagate `wait_for_server_ready` to sibling hooks integ tests | HIGH | M | Done |
 | TASK-076 | Replace tautological-pass blocks in TLS test lanes | HIGH | M | Done |
 | TASK-077 | Restore Windows / Darwin coverage in skipped test suites | HIGH | L | Done |
-| TASK-078 | Resolve commented-out CONNECT-method test bodies | HIGH | S | Backlog |
+| TASK-078 | Resolve commented-out CONNECT-method test bodies | HIGH | S | Done |
 | TASK-079 | Drive nonce/opaque state machine in v2 digest-auth integ tests | MED | M | Backlog |
 | TASK-080 | Tighten threadsafety_stress latency gate back from 100× to 10× | MED | M | Backlog |
 | TASK-081 | Fill empty-on-correct-build unit suites and re-enable pthread leak detector | MED | M | Backlog |

test/REGRESSION.md

@@ -164,6 +164,28 @@ it at the head of `lookup_v2`, including cache keying. This brings v2
 in line with v1 semantics; the test
 `exact_path_normalization_aliases` pins it.
 
+### 6. CONNECT-method client-roundtrip integ test (TASK-078)
+
+`test/integ/basic.cpp` previously contained two `/* ... */`-commented
+CONNECT bodies inside `basic_suite::complete` and `basic_suite::only_render`
+that issued `curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "CONNECT")`
+through the high-level libcurl easy API. They were commented out in
+2017 (commit bd39cb4) because libcurl treats CONNECT as a tunnel-establishing
+verb and waits for the socket to be upgraded; `curl_easy_perform` then
+hangs against a plain HTTP server. The bodies have been deleted; there is
+no way to drive a CONNECT round-trip through `curl_easy_perform` and the
+high-level easy API has no other shape that produces a useful integ
+assertion against an HTTP server that is not also a proxy.
+
+Server-side CONNECT dispatch IS exercised: the method-to-render-fn table
+in `src/detail/webserver_request.cpp` (the `methods[]` array around line
+608) maps the `CONNECT` wire token to `http_resource::render_connect`,
+and `test/unit/http_resource_test.cpp::render_connect_returns_by_value`
+pins the public signature. The deleted integ blocks added no coverage
+beyond that.
+
+No port required; not a v1-only feature, but a v1-era libcurl misuse.
+
 ## How to extend
 
 When adding a new routing pattern to the public API:

test/integ/basic.cpp

@@ -833,16 +833,6 @@ LT_BEGIN_AUTO_TEST(basic_suite, complete)
     LT_ASSERT_EQ(res, 0);
     curl_easy_cleanup(curl);
     }
-/*
-    {
-    CURL* curl = curl_easy_init();
-    curl_easy_setopt(curl, CURLOPT_URL, "localhost:" PORT_STRING "/base");
-    curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "CONNECT");
-    CURLcode res = curl_easy_perform(curl);
-    LT_ASSERT_EQ(res, 0);
-    curl_easy_cleanup(curl);
-    }
-*/
 
     {
     CURL* curl = curl_easy_init();
@@ -897,19 +887,6 @@ LT_BEGIN_AUTO_TEST(basic_suite, only_render)
     LT_CHECK_EQ(s, "OK");
     curl_easy_cleanup(curl);
 
-/*
-    s = "";
-    curl = curl_easy_init();
-    curl_easy_setopt(curl, CURLOPT_URL, "localhost:" PORT_STRING "/base");
-    curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "CONNECT");
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writefunc);
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &s);
-    res = curl_easy_perform(curl);
-    LT_ASSERT_EQ(res, 0);
-    LT_CHECK_EQ(s, "OK");
-    curl_easy_cleanup(curl);
-*/
-
     s = "";
     curl = curl_easy_init();
     curl_easy_setopt(curl, CURLOPT_URL, "localhost:" PORT_STRING "/base");
@@ -2907,39 +2884,6 @@ LT_BEGIN_AUTO_TEST(basic_suite, single_resource_mode)
     ws2.stop();
 LT_END_AUTO_TEST(single_resource_mode)
 
-// Test validator builder method (validator is stored but not currently called in webserver)
-bool test_validator_func(const std::string& url) {
-    return url.find("valid") != std::string::npos;
-}
-
-LT_BEGIN_AUTO_TEST(basic_suite, validator_builder)
-    // Test that the validator builder method works (for coverage of create_webserver.hpp)
-    webserver ws2{create_webserver(PORT + 72)
-        .validator(test_validator_func)};
-    auto resource = std::make_shared<ok_resource>();
-    ws2.register_path("test", resource);
-    ws2.start(false);
-
-    // Just verify the server works with a validator set
-    {
-        curl_global_init(CURL_GLOBAL_ALL);
-        string s;
-        CURL *curl = curl_easy_init();
-        CURLcode res;
-        std::string url = "http://localhost:" + std::to_string(PORT + 72) + "/test";
-        curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
-        curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
-        curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writefunc);
-        curl_easy_setopt(curl, CURLOPT_WRITEDATA, &s);
-        res = curl_easy_perform(curl);
-        LT_ASSERT_EQ(res, 0);
-        LT_CHECK_EQ(s, "OK");
-        curl_easy_cleanup(curl);
-    }
-
-    ws2.stop();
-LT_END_AUTO_TEST(validator_builder)
-
 // Test resource with no render methods overridden (exercises empty_render path)
 // Note: empty_render returns string_response with code -1, which triggers internal error
 class empty_render_resource : public http_resource {