HTTP/2 Reverse Proxy — Complete Task Breakdown

Project 07 · Rust · Tokio · Hyper 1.x · Tower · rustls

240 tasks across 19 phases

Phase Summary
Phase Tasks Focus Area
Project Setup & Scaffolding 22 Setup, Dependencies, CI/CD
Configuration System 13 Config
Async Runtime (Tokio) 7 Runtime
TLS Termination (rustls) 15 TLS
HTTP/2 Layer (Hyper 1.x) 16 HTTP/2
Tower Middleware Stack 21 Middleware
Load Balancing 15 Load Balancer
Connection Pool 15 Pool
Health Checking 10 Health
Zero-Copy Body Streaming 8 Streaming
Prometheus Metrics 12 Metrics
Observability & Tracing 9 Observability
Benchmarking 11 Benchmarking
Integration Testing 15 Integration Tests
Error Handling & Edge Cases 11 Error Handling
Security Hardening 10 Security
Deployment & Operations 10 Deployment
Documentation 9 Docs
Final Validation 11 Validation
Phase 1: Project Setup & Scaffolding
# Task Description Area
1 Create a new Rust project with `cargo new http2-proxy --bin` Setup
2 Initialise a Git repository and create a `.gitignore` for Rust projects Setup
3 Set up a Cargo workspace with separate crates: `proxy-core`, `proxy-config`, `proxy- Setup
metrics`, `proxy-cli`
4 Pin Rust toolchain to stable in `[Link]` Setup
5 Add Tokio as a dependency with features: `full` (macros, rt-multi-thread, net, time, sync, io- Dependenc
util) ies
6 Add Hyper 1.x as a dependency with features: `server`, `client`, `http1`, `http2` Dependenc
ies
7 Add Tower as a dependency with features: `util`, `timeout`, `retry`, `limit`, `buffer` Dependenc
ies
8 Add rustls as a dependency with features: `tls12`, `tls13`, `dangerous_configuration` Dependenc
ies
9 Add `tokio-rustls` for async TLS over Tokio streams Dependenc
ies
10 Add `rustls-pemfile` for parsing PEM-formatted certificates and keys Dependenc
ies
11 Add `hyper-util` for utility helpers (TokioExecutor, client connectors) Dependenc
ies
12 Add `http` crate for shared HTTP types (Request, Response, Extensions, Uri, Method) Dependenc
ies
13 Add `bytes` crate for zero-copy byte buffer management (Bytes, BytesMut, Buf, BufMut) Dependenc
ies
14 Add `dashmap` for concurrent hash map used in rate limiting state Dependenc
ies
15 Add `prometheus` (or `metrics` + `metrics-exporter-prometheus`) for metrics collection Dependenc
ies
16 Add `serde` and `serde_json` / `toml` for configuration parsing Dependenc
ies
17 Add `tracing` and `tracing-subscriber` for structured logging Dependenc
ies
18 Add `criterion` as a dev-dependency for benchmarking Dependenc
ies
19 Add `tokio-test` as a dev-dependency for async unit testing Dependenc
ies
20 Configure CI pipeline (GitHub Actions): check, clippy, test, fmt on every push CI/CD
21 Configure `[Link]` with `cargo-deny` to enforce no-unsafe and audit dependencies Setup
22 Set up a `justfile` (or Makefile) with targets: `build`, `test`, `bench`, `lint`, `run` Setup

Phase 2: Configuration System

# Task Description Area
23 Define a top-level `ProxyConfig` struct with fields: bind_address, tls, upstreams, Config
 # Task Description Area
load_balancer, middleware, metrics
24 Define `TlsConfig` struct with fields: cert_path, key_path, alpn_protocols, min_tls_version Config
25 Define `UpstreamConfig` struct with fields: name, address, max_connections, Config
connect_timeout, health_check
26 Define `HealthCheckConfig` struct with fields: interval_secs, path, strategy (active/passive), Config
failure_threshold
27 Define `LoadBalancerConfig` enum: RoundRobin, LeastConnections, ConsistentHash { key Config
}
28 Define `MiddlewareConfig` struct with fields: timeout_ms, rate_limit (per-IP), retry (max Config
attempts, backoff)
29 Define `RateLimitConfig` struct with fields: requests_per_second, burst_size, key_type Config
(ip/api_key)
30 Define `RetryConfig` struct with fields: max_attempts, initial_backoff_ms, max_backoff_ms, Config
retryable_status_codes
31 Implement TOML parsing for `ProxyConfig` using `serde::Deserialize` Config
32 Implement config validation: check cert/key files exist, upstreams list non-empty, timeout > Config
0
33 Write unit tests for config parsing: valid config, missing fields, invalid values Config
34 Implement environment variable overrides for sensitive fields (TLS cert paths, bind address) Config
35 Create a sample `[Link]` with two example upstreams and all fields documented Config

Phase 3: Async Runtime (Tokio)

# Task Description Area
36 Initialise the Tokio multi-thread runtime with `#[tokio::main]` and configure worker thread Runtime
count to num_cpus
37 Implement graceful shutdown: listen for SIGTERM and SIGINT using `tokio::signal` Runtime
38 Create a `ShutdownToken` type (wraps `CancellationToken` from `tokio-util`) passed to all Runtime
long-lived tasks
39 Implement a task registry: spawn all background tasks (health check, metrics, cert watcher) Runtime
with `JoinSet`
40 Write a test that shuts down the runtime cleanly and verifies all tasks terminate Runtime
41 Evaluate and document whether to enable `io_uring` via `tokio-uring` for Linux deployments Runtime
42 Configure Tokio's `LocalSet` for any single-threaded workloads (none expected, but Runtime
document the decision)

Phase 4: TLS Termination (rustls)

# Task Description Area
43 Implement `load_tls_config(TlsConfig) -> Result<Arc<ServerConfig>>` that builds a rustls TLS
`ServerConfig`
44 Load certificate chain from PEM file using `rustls_pemfile::certs()` TLS
45 Load private key from PEM file using `rustls_pemfile::private_key()` TLS
 # Task Description Area
46 Configure ALPN: set `alpn_protocols` to `[b"h2", b"http/1.1"]` in order of preference TLS
47 Enforce minimum TLS version 1.2 via `ServerConfig::builder().with_protocol_versions()` TLS
48 Implement `TlsAcceptor` wrapper that wraps a `TcpListener` and yields TLS
`TlsStream<TcpStream>`
49 Implement SNI extraction from the TLS handshake for virtual-host routing decisions TLS
50 Implement `CertifiedKeyStore`: an `Arc<RwLock<Arc<CertifiedKey>>>` holding the current TLS
cert
51 Implement `CertWatcher` background task: use `inotify` (via `notify` crate) to watch TLS
certificate file path
52 On cert file change: parse new cert, validate it, and atomically swap the `Arc<CertifiedKey>` TLS
pointer
53 Implement a custom `ResolvesServerCert` trait that reads from `CertifiedKeyStore` on each TLS
handshake
54 Write unit tests: load valid cert, load invalid cert (expect error), SNI extraction TLS
55 Write integration test: establish a TLS connection, verify ALPN negotiation returns `h2` TLS
56 Write test: reload cert without dropping existing connections (verify connections survive) TLS
57 Generate a self-signed test certificate using `rcgen` crate for use in tests TLS

Phase 5: HTTP/2 Layer (Hyper 1.x)

# Task Description Area
58 Implement the main connection accept loop: `TcpListener::accept()` -> TLS handshake -> HTTP/2
HTTP dispatch
59 Branch on ALPN result: if `h2` -> use `hyper::server::conn::http2::Builder`, else -> HTTP/1.1 HTTP/2
builder
60 Implement the `Service<Request<Incoming>>` for the proxy handler (the innermost service) HTTP/2
61 Configure HTTP/2 server SETTINGS: `initial_window_size`, `max_concurrent_streams`, HTTP/2
`header_table_size`
62 Implement stream ID tracking: log the HTTP/2 stream ID for each request for debugging HTTP/2
63 Implement flow control window logging: emit a tracing event when a WINDOW_UPDATE is HTTP/2
sent/received
64 Implement client-side HTTP/2 connection to upstreams using HTTP/2
`hyper::client::conn::http2::Builder`
65 Configure upstream HTTP/2 client SETTINGS to match proxy's negotiated parameters HTTP/2
66 Implement HPACK context isolation: ensure client-to-proxy and proxy-to-upstream have HTTP/2
independent encoder/decoder state
67 Implement header forwarding: decode headers from client connection, re-encode for HTTP/2
upstream connection
68 Strip and re-add hop-by-hop headers: `Connection`, `Transfer-Encoding`, `TE`, `Upgrade`, HTTP/2
`Proxy-Connection`
69 Add `Via` header: append `2.0 <proxy_hostname>` to the forwarded request HTTP/2
70 Add `X-Forwarded-For` header: append the client IP address HTTP/2
71 Write integration test: send an HTTP/2 request through the proxy, verify headers forwarded HTTP/2
correctly
 # Task Description Area
72 Write test: concurrent HTTP/2 streams — verify stream 5 slow response does not block HTTP/2
stream 7
73 Write test: HTTP/1.1 client connected to HTTP/2 upstream — verify transparent bridging HTTP/2

Phase 6: Tower Middleware Stack

# Task Description Area
74 Define the full middleware stack type alias: `type ProxyService = Middleware
Timeout<RateLimit<Retry<Trace<InnerProxy>>>>`
75 Implement `InnerProxy` as the base `Service<Request>` that checks out a connection and Middleware
proxies the request
76 Implement `TraceLayer`: wrap each request in a `tracing::Span` with method, URI, Middleware
upstream fields
77 Implement `TimeoutLayer`: use `tower::timeout::Timeout` with duration from config, return Middleware
504 on expiry
78 Write test for `TimeoutLayer`: mock inner service that sleeps longer than timeout, expect Middleware
504 response
79 Implement `RateLimitLayer`: token bucket per client IP using `DashMap<IpAddr, Middleware
TokenBucket>`
80 Implement `TokenBucket` struct: fields `tokens: f64`, `last_refill: Instant`, `capacity: f64`, Middleware
`refill_rate: f64`
81 Implement `TokenBucket::try_consume()`: calculate elapsed time, refill tokens, attempt Middleware
consumption
82 Implement stale bucket eviction: periodically remove entries from `DashMap` where bucket Middleware
is full and old
83 Return 429 with `Retry-After` header when rate limit is exceeded Middleware
84 Write tests for `TokenBucket`: consume all tokens, verify rejection, verify refill over time Middleware
85 Write concurrent test for rate limiter: 100 goroutines hammering the same IP, verify Middleware
correctness
86 Implement `RetryLayer`: implement `tower::retry::Policy` trait with retryable status code Middleware
logic
87 Define retryable conditions: 502, 503, connection refused, timeout — non-retryable: 4xx, Middleware
2xx
88 Ensure retries only happen for idempotent methods (GET, HEAD, PUT, DELETE, Middleware
OPTIONS)
89 Implement exponential backoff with jitter between retry attempts Middleware
90 Write tests for retry policy: 503 response triggers retry, 400 does not, POST does not retry Middleware
91 Implement `ObservabilityLayer` (innermost): record start time, call inner, record end time Middleware
and status
92 In `ObservabilityLayer`: increment Prometheus counters and update histogram on every Middleware
request completion
93 Write integration test: verify full middleware stack compiles as a single concrete Middleware
monomorphised type
94 Implement `ServiceBuilder` composition helper: build the stack from config in one place Middleware
Phase 7: Load Balancing
# Task Description Area
95 Define `LoadBalancer` trait: `fn select(&self, req: &Request) -> Option<UpstreamId>` Load
Balancer
96 Define `UpstreamId` newtype wrapping `usize` (index into upstreams slice) Load
Balancer
97 Implement `RoundRobinBalancer`: `AtomicUsize` counter, `fetch_add(1, Relaxed) % Load
upstream_count` Balancer
98 Write test for `RoundRobinBalancer`: 3 upstreams, 9 requests, verify even distribution Load
Balancer
99 Implement `LeastConnectionsBalancer`: each upstream has `AtomicI32` in-flight counter Load
Balancer
100 Implement `ConnectionGuard` Drop impl: decrement the upstream's in-flight counter when Load
dropped Balancer
101 Write test for `LeastConnectionsBalancer`: simulate one slow upstream, verify it receives Load
fewer new connections Balancer
102 Implement `ConsistentHashBalancer`: hash ring using a `BTreeMap<u64, UpstreamId>` Load
with virtual nodes Balancer
103 Implement virtual node insertion: each upstream gets `vnodes_per_upstream` entries Load
hashed as `upstream_name#i` Balancer
104 Implement ring lookup: hash request key, find the nearest clockwise virtual node in the Load
`BTreeMap` Balancer
105 Write test for `ConsistentHashBalancer`: add and remove an upstream, verify <= 1/N Load
requests remapped Balancer
106 Implement health-aware selection: all three balancers must skip upstreams marked as Load
`Down` Balancer
107 Implement fallback: if no upstreams are `Up`, return 503 immediately without attempting Load
connection Balancer
108 Write test: all upstreams down, verify 503 returned without hanging Load
Balancer
109 Implement `upstream_id` injection into `http::Extensions` on the request for pool-checkout Load
layer to read Balancer

Phase 8: Connection Pool

# Task Description Area
110 Define `ConnectionPool` struct: one pool per upstream, keyed by `UpstreamId` Pool
111 Implement `PooledConnection` struct wrapping a Hyper send-request handle + creation Pool
timestamp
112 Implement pool checkout: take from idle queue if available; else open a new connection if Pool
below `max_connections`
113 Implement pool wait queue: if at capacity, queue the request with a bounded channel and Pool
timeout
114 Implement pool checkin: validate connection is not in error state, then push to idle queue Pool
115 Implement `max_idle` enforcement: if idle queue length exceeds limit, close the returned Pool
connection
116 Implement TTL eviction: background task periodically removes connections older than Pool
 # Task Description Area
configured wall-clock age
117 Implement TCP connect to upstream: `TcpStream::connect(addr)` with configurable Pool
connect timeout
118 Implement optional TLS wrapping of upstream connections (if upstream URL scheme is Pool
`https`)
119 Implement HTTP/2 handshake on new upstream connections via Pool
`hyper::client::conn::http2::handshake()`
120 Implement the retry-pool interaction: retry layer writes new upstream ID to extensions; pool- Pool
checkout reads it
121 Write test: pool checkout, use connection, check in, verify it is returned to idle queue Pool
122 Write test: pool at max capacity, verify subsequent checkout blocks then succeeds after Pool
checkin
123 Write test: TTL eviction removes connections older than TTL, new connections opened on Pool
next checkout
124 Write test: error-state connection is discarded on checkin, not returned to idle queue Pool

Phase 9: Health Checking

# Task Description Area
125 Define `UpstreamHealth` enum: `Up`, `Down`, `Unknown` Health
126 Implement `HealthRegistry`: `Arc<DashMap<UpstreamId, UpstreamHealth>>` shared Health
across all components
127 Implement passive health checking: `ObservabilityLayer` records consecutive errors per Health
upstream
128 Mark upstream `Down` after `failure_threshold` consecutive errors; update `HealthRegistry` Health
129 Implement active health checker background task: send `HEAD /health` to each upstream Health
on interval
130 Parse health check response: 200-299 -> `Up`, else -> `Down`; handle connection refused Health
as `Down`
131 Implement recovery probe: after marking `Down`, retry health check on interval; re-add to Health
rotation on success
132 Implement TCP-level health check fallback: if HTTP probe not configured, just attempt TCP Health
connect
133 Write test: upstream returns 503 three times, verify it is marked Down Health
134 Write test: upstream recovers and returns 200, verify it transitions back to Up Health

Phase 10: Zero-Copy Body Streaming

# Task Description Area
135 Implement basic body streaming: pipe `Incoming` body from request to upstream send- Streaming
request body
136 Implement response body streaming: pipe upstream response body back to client without Streaming
buffering
137 Implement `Bytes::clone()` for fan-out: share response body between upstream reader and Streaming
 # Task Description Area
access log
138 Evaluate `splice(2)` availability: implement a `splice_stream` helper for Linux using `nix` Streaming
crate
139 Implement content-length tracking: count bytes as they flow, update Streaming
`proxy_request_body_bytes_total` metric
140 Handle chunked transfer encoding: ensure correct handling when bridging HTTP/1.1 Streaming
chunked to HTTP/2 DATA frames
141 Write test: proxy a 10 MB body, verify no heap allocation > 64 KB at any point using Streaming
memory tracking
142 Write test: upstream disconnects mid-response, verify client receives an error and proxy Streaming
recovers

Phase 11: Prometheus Metrics

# Task Description Area
143 Initialise thread-local metric storage: `thread_local!` for per-thread counters and histograms Metrics
144 Register `proxy_requests_total` counter with labels: upstream, status, method Metrics
145 Register `proxy_request_duration_seconds` histogram with labels: upstream, standard Metrics
bucket boundaries
146 Register `proxy_active_connections` gauge with label: upstream Metrics
147 Register `proxy_upstream_health` gauge with label: upstream (0 = Down, 1 = Up) Metrics
148 Register `proxy_connection_pool_idle` gauge with label: upstream Metrics
149 Register `proxy_retry_total` counter with labels: upstream, reason Metrics
150 Register `proxy_rate_limited_total` counter with label: client_ip Metrics
151 Implement `/metrics` HTTP endpoint: aggregate thread-local counters and serialise in Metrics
Prometheus text format
152 Spin up the metrics HTTP server on a separate bind address (not the TLS proxy port) Metrics
153 Write test: make 10 requests, scrape `/metrics`, verify `proxy_requests_total` equals 10 Metrics
154 Write test: verify histogram buckets cover the expected latency range (1ms to 10s) Metrics

Phase 12: Observability & Tracing

# Task Description Area
155 Configure `tracing-subscriber` with JSON formatter for structured log output Observabilit
y
156 Add `tracing` spans at each middleware layer boundary: trace propagation through the full Observabilit
stack y
157 Log TLS handshake completion: ALPN result, TLS version, cipher suite, SNI hostname Observabilit
y
158 Log every request: method, URI, client IP, upstream selected, response status, latency Observabilit
y
159 Log retry events: upstream, attempt number, reason (status code or error type) Observabilit
y
 # Task Description Area
160 Log pool events: checkout, checkin, new connection opened, connection discarded, TTL Observabilit
eviction y
161 Log health check events: upstream transitions Up->Down and Down->Up Observabilit
y
162 Implement `tracing-opentelemetry` integration for exporting traces to Jaeger or OTLP Observabilit
collector y
163 Write test: verify log output contains expected fields for a proxied request Observabilit
y

Phase 13: Benchmarking

# Task Description Area
164 Set up `[Link]` benchmark harness in `benches/` directory Benchmarki
ng
165 Write benchmark: HPACK encode throughput — 100 header pairs at various header set Benchmarki
sizes (10, 50, 200 headers) ng
166 Write benchmark: HPACK decode throughput — verify dynamic table lookup performance Benchmarki
does not degrade ng
167 Write benchmark: `TokenBucket::try_consume()` under high concurrency (16 threads, Benchmarki
shared bucket) ng
168 Write benchmark: TLS record encryption throughput at 16 KB record size (dominant CPU Benchmarki
cost) ng
169 Write benchmark: connection pool checkout latency under contention (32 workers, pool of Benchmarki
8) ng
170 Write benchmark: end-to-end request latency (loopback, no upstream delay) to establish Benchmarki
baseline ng
171 Write benchmark: end-to-end throughput — requests per second at various concurrency Benchmarki
levels (1, 10, 100, 1000) ng
172 Configure criterion to produce HTML reports and commit baseline results to repo Benchmarki
ng
173 Run `cargo flamegraph` and analyse the output to identify the top 3 CPU hotspots Benchmarki
ng
174 Document benchmark results and performance targets in `[Link]` Benchmarki
ng

Phase 14: Integration Testing

# Task Description Area
175 Set up integration test framework: spawn a real proxy instance in-process for each test Integration
Tests
176 Implement a mock upstream server using Hyper that records received requests and returns Integration
configured responses Tests
177 Integration test: HTTP/2 request proxied correctly — method, path, headers preserved Integration
Tests
178 Integration test: HTTP/1.1 client to HTTP/2 upstream — transparent bridging works Integration
Tests
 # Task Description Area
179 Integration test: TLS handshake with ALPN negotiation resolves to `h2` Integration
Tests
180 Integration test: concurrent HTTP/2 streams — 50 parallel requests, all complete correctly Integration
Tests
181 Integration test: rate limiting — client exceeds limit, receives 429, waits, succeeds Integration
Tests
182 Integration test: timeout — upstream hangs, client receives 504 within timeout window Integration
Tests
183 Integration test: retry — upstream returns 503 twice, third attempt succeeds, client sees 200 Integration
Tests
184 Integration test: load balancing round-robin — 6 requests across 3 upstreams, 2 each Integration
Tests
185 Integration test: health check — upstream fails, is removed, requests route to healthy Integration
upstreams Tests
186 Integration test: cert reload — swap certificate file, verify new connections use new cert, old Integration
connections survive Tests
187 Integration test: large body (100 MB) proxied end-to-end without memory spike Integration
Tests
188 Integration test: graceful shutdown — in-flight requests complete, new connections rejected Integration
Tests
189 Integration test: Prometheus metrics endpoint returns correct counters after 100 requests Integration
Tests

Phase 15: Error Handling & Edge Cases

# Task Description Area
190 Define a unified `ProxyError` enum covering all error categories: Tls, Http, Pool, Upstream, Error
Config Handling
191 Implement `From<rustls::Error>` for `ProxyError` Error
Handling
192 Implement `From<hyper::Error>` for `ProxyError` Error
Handling
193 Implement `From<std::io::Error>` for `ProxyError` Error
Handling
194 Map `ProxyError` variants to appropriate HTTP status codes for client-facing error Error
responses Handling
195 Handle upstream connection reset mid-stream: close client stream with RST_STREAM Error
Handling
196 Handle client disconnection mid-request: cancel upstream request and release pool Error
connection Handling
197 Handle malformed HTTP/2 frames: log and close connection with PROTOCOL_ERROR Error
Handling
198 Handle TLS handshake failure: log SNI and reason, do not propagate to other connections Error
Handling
199 Handle pool exhaustion: return 503 with informative error body after wait timeout Error
Handling
200 Handle config reload failure: keep running with old config, emit error metric Error
 # Task Description Area
Handling

Phase 16: Security Hardening

# Task Description Area
201 Run `cargo audit` and resolve all advisories in the dependency tree Security
202 Run `cargo clippy -- -D warnings` and fix all lints Security
203 Enforce `#![forbid(unsafe_code)]` in the root of every crate Security
204 Implement request size limits: reject requests with bodies > configured max (default 10 MB) Security
205 Implement header count limit: reject requests with > 100 headers (HTTP/2 Security
SETTINGS_MAX_HEADER_LIST_SIZE)
206 Implement slow-loris mitigation: close connections that do not complete the TLS handshake Security
within 10 seconds
207 Implement HTTP/2 RST_STREAM flood detection: track RST frames per connection, close Security
if excessive
208 Restrict cipher suites to TLS 1.3 defaults plus Security
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 for TLS 1.2
209 Implement `X-Content-Type-Options: nosniff` and `X-Frame-Options: DENY` on all proxy Security
responses
210 Document threat model: what the proxy defends against and what it does not Security

Phase 17: Deployment & Operations

# Task Description Area
211 Write a `Dockerfile` using multi-stage build: `rust:stable` builder -> `debian:slim` runner Deploymen
t
212 Create a `[Link]` with proxy + two example upstream services + Prometheus Deploymen
+ Grafana t
213 Write a Kubernetes `Deployment` manifest for the proxy with resource limits and Deploymen
liveness/readiness probes t
214 Write a Kubernetes `Service` manifest (LoadBalancer type) for the proxy Deploymen
t
215 Write a Kubernetes `Secret` manifest (or external-secrets reference) for TLS cert and key Deploymen
t
216 Write a Prometheus `scrape_config` for the proxy metrics endpoint Deploymen
t
217 Create a Grafana dashboard JSON with panels for: RPS, latency p50/p95/p99, error rate, Deploymen
upstream health, pool utilisation t
218 Write Prometheus alerting rules: high error rate (>1%), upstream down, pool exhaustion Deploymen
t
219 Document runbook: how to add an upstream, rotate a certificate, scale the proxy Deploymen
horizontally t
220 Configure structured log output to be parseable by Loki or Elasticsearch Deploymen
t
Phase 18: Documentation
# Task Description Area
221 Write `[Link]`: what the proxy does, architecture overview, quick start, config Docs
reference
222 Write `[Link]`: detailed description of all 7 layers, design decisions, trade- Docs
offs
223 Write `[Link]`: every config field documented with type, default, and Docs
example
224 Write `[Link]`: benchmark results, profiling methodology, known bottlenecks Docs
and mitigations
225 Write `[Link]`: threat model, CVE mitigation rationale (rustls vs OpenSSL), Docs
responsible disclosure policy
226 Write `[Link]`: coding standards, test requirements, PR checklist Docs
227 Add `///` doc comments to every public type, trait, and function Docs
228 Run `cargo doc --no-deps` and verify all public API is documented with no warnings Docs
229 Write a `[Link]` with an initial v0.1.0 entry listing all implemented features Docs

Phase 19: Final Validation

# Task Description Area
230 Run the full test suite (`cargo test --workspace`) and verify 100% pass rate Validation
231 Run `cargo clippy -- -D warnings` with no suppressions and fix all remaining lints Validation
232 Run `cargo fmt --check` to verify consistent formatting across the entire workspace Validation
233 Run `cargo audit` to confirm no unresolved security advisories Validation
234 Run `cargo deny check` to verify no unsafe code, banned crates, or license violations Validation
235 Run `cargo bench` and confirm no performance regressions versus recorded baseline Validation
236 Deploy to Docker Compose environment and run a 60-second load test with `wrk` at 10,000 Validation
RPS
237 Verify Prometheus metrics are scraped correctly and Grafana dashboard displays all panels Validation
238 Perform a manual cert rotation in the running Docker Compose environment and verify zero Validation
dropped connections
239 Kill one upstream container and verify health checking removes it and restores it after Validation
recovery
240 Tag the repository as `v0.1.0` and push to GitHub; verify CI pipeline passes on the tagged Validation
commit