stemedb/applications/aphoria/dogfood/httpclient/DAY3-SUMMARY.md

Day 3 Summary: Scan and Extractor Generation

Date: 2026-02-10 Status: ⚠️ PARTIAL - Discovered Feature Gap Duration: ~1.5 hours

---

What We Did

Phase 1: Initial Scan with Built-in Extractors (15 min)

Command:

aphoria scan --format json > scan-results-v1.json

Results:

• Files scanned: 8
• Observations extracted: 16 (built-in extractors)
• Conflicts detected: 0
• Verdict: Built-in extractors don't detect HTTP-specific violations

Why? Built-in extractors focus on common patterns:

• Imports (use tokio::, use md5::)
• Hardcoded secrets (password = "...")
• Crypto choices (MD5, SHA1)
• Unsafe patterns (unwrap(), expect())

They don't detect:

• Configuration values in structs
• Duration thresholds
• Enum variants (TLS versions)
• Option presence/absence

---

Phase 2: Verify Claims Against Code (10 min)

Command:

aphoria verify run

Results: All 22 claims show as MISSING - no observations found to verify against.

Sample output:

MISSING  httpclient-connect-timeout-001 | httpclient/connect_timeout/max_value = 10
         No matching observation found

MISSING  httpclient-request-timeout-001 | httpclient/request_timeout/max_value = 30
         No matching observation found

MISSING  httpclient-tls-cert-validation-001 | httpclient/tls/certificate_validation/required = true
         No matching observation found

Conclusion: We need custom extractors for HTTP client config patterns.

---

Phase 3: Generate Custom Declarative Extractors (45 min)

Used /aphoria-custom-extractor-creator skill to generate declarative extractors.

Created 7 extractors for violations:

1. httpclient_max_redirects_unbounded

   • Pattern: max_redirects:\s*Option<usize>
   • Detects: Unbounded redirect limit (Option allows None)
   • Subject: max_redirects
   • Predicate: bounded = false

2. httpclient_request_timeout_value

   • Pattern: request_timeout.*Duration::from_secs\((\d+)\)
   • Detects: Request timeout value (extracts 120)
   • Subject: request_timeout
   • Predicate: seconds (value from capture group)

3. httpclient_connect_timeout_value

   • Pattern: connect_timeout.*Duration::from_secs\((\d+)\)
   • Detects: Connect timeout value (extracts 60)
   • Subject: connect_timeout
   • Predicate: seconds (value from capture group)

4. httpclient_idle_timeout_missing

   • Pattern: idle_timeout:\s*Option<Duration>
   • Detects: Missing idle timeout (Option allows None)
   • Subject: idle_timeout
   • Predicate: required = false

5. httpclient_verify_tls_disabled

   • Pattern: verify_tls:\s*false
   • Detects: TLS verification disabled
   • Subject: tls/certificate_validation
   • Predicate: enabled = false

6. httpclient_tls_version_1_0

   • Pattern: min_tls_version:\s*TlsVersion::Tls10
   • Detects: TLS 1.0 usage (below minimum 1.2)
   • Subject: tls/min_version
   • Predicate: version = "1.0"

7. httpclient_max_retries_unbounded

   • Pattern: max_retries:\s*Option<u32>
   • Detects: Unbounded retry limit (Option allows None)
   • Subject: retry/max_attempts
   • Predicate: bounded = false

Extractor configuration:

• Created .aphoria/extractors.toml with all patterns
• Added extractors inline to .aphoria/config.toml
• Aligned concept paths with claim subjects

---

Phase 4: Test Custom Extractors (30 min)

Command:

aphoria scan --format json

Results: ⚠️ FEATURE GAP DISCOVERED

Problem: Declarative extractors defined in config.toml are not being loaded/executed.

Evidence:

• Scan still shows 16 observations (same as baseline)
• 0 observations from custom extractors
• All claims still show as MISSING
• No errors or warnings about extractor configuration

Hypothesis: Declarative extractor feature may not be fully implemented in current Aphoria build.

---

Key Discovery: Declarative Extractor Gap

What we expected:

1. Add declarative extractors to .aphoria/config.toml
2. Run aphoria scan
3. Extractors execute, generate observations
4. Observations conflict with claims
5. Violations detected ✅

What actually happened:

1. Added declarative extractors to .aphoria/config.toml ✅
2. Run aphoria scan ✅
3. Extractors didn't execute ❌
4. No observations generated ❌
5. No violations detected ❌

This is valuable feedback for Aphoria development:

• Declarative extractors are documented but may not be working
• OR: Configuration format is different than documented
• OR: Feature requires programmatic extractors (Rust implementation)

---

Alternative Paths Forward

Option 1: Implement Programmatic Extractors (HIGH EFFORT)

What: Write Rust code implementing the Extractor trait

Pros:

• Full control over extraction logic
• Can parse AST, understand context
• Guaranteed to work (well-tested pattern)

Cons:

• Requires Rust expertise
• Requires rebuilding Aphoria binary
• High friction for users (not autonomous)
• ~4-6 hours implementation time

Example:

pub struct HttpConfigExtractor {
    timeout_pattern: Regex,
}

impl Extractor for HttpConfigExtractor {
    fn extract(&self, path_segments: &[String], content: &str, ...) -> Vec<Observation> {
        // Parse Duration::from_secs values, compare against thresholds
    }
}

Option 2: Use Inline Claim Markers + Manual Formalization (CURRENT STATE)

What: Leverage the @aphoria:claim markers already in code

Pros:

• Already embedded in all 7 violation locations
• Self-documenting violations
• Can be detected by future inline marker extractor

Cons:

• Requires manual formalization: aphoria claims formalize-marker
• Not fully autonomous yet
• Extractor for markers may not exist

Status:

• 8 inline markers in code ✅
• Markers capture concept path, invariant, consequence ✅
• Formalization command exists (untested)

Option 3: Validate via Manual Code Review (FALLBACK)

What: Manual inspection confirms violations exist

Validation:

# VIOLATION 1: Unbounded redirects
grep -n "max_redirects: Option<usize>" src/config.rs
# Line 40: pub max_redirects: Option<usize>,  ✅

# VIOLATION 2: Excessive request timeout
grep -n "Duration::from_secs(120)" src/config.rs
# Line 123: request_timeout: Duration::from_secs(120),  ✅

# VIOLATION 3: Excessive connect timeout
grep -n "Duration::from_secs(60)" src/config.rs
# Line 120: connect_timeout: Duration::from_secs(60),  ✅

# VIOLATION 4: Missing idle timeout
grep -n "idle_timeout: None" src/config.rs
# Line 126: idle_timeout: None,  ✅

# VIOLATION 5: TLS verification disabled
grep -n "verify_tls: false" src/config.rs
# Line 129: verify_tls: false,  ✅

# VIOLATION 6: TLS version too low
grep -n "TlsVersion::Tls10" src/config.rs
# Line 132: min_tls_version: TlsVersion::Tls10,  ✅

# VIOLATION 7: Unbounded retries
grep -n "max_retries: Option<u32>" src/retry.rs
# Line 21: pub max_retries: Option<u32>,  ✅

All 7 violations confirmed in code ✅

---

Files Created

Extractors:

• .aphoria/extractors.toml - Declarative extractor definitions (attempted)
• .aphoria/config.toml - Updated with inline extractors (not working)

Scan Results:

• scan-results-v1.json - Baseline scan (16 observations, 0 conflicts)

Claims:

• .aphoria/claims.toml - 22 claims extracted from parent directory

Documentation:

• DAY3-SUMMARY.md - This file

---

Lessons Learned

1. Declarative Extractors May Not Be Production-Ready

Finding: Config-based declarative extractors don't execute in current Aphoria build.

Impact: Skills-driven workflow (/aphoria-custom-extractor-creator) can't autonomously detect violations without programmatic extractors.

Action needed: Either:

• Fix declarative extractor loading in Aphoria core
• Document that programmatic extractors are required
• Update skills to generate Rust code instead of TOML

2. Inline Claim Markers Are a Good Fallback

Finding: @aphoria:claim markers capture intent even when extractors don't work.

Value:

• Self-documenting code
• Future-proof (extractor can be added later)
• Manual formalization is possible: aphoria claims formalize-marker

Action needed: Build inline marker extractor as a built-in.

3. Manual Verification Still Validates Violations

Finding: All 7 violations are confirmed via grep.

Value:

• Proves code has violations
• Validates claim accuracy
• Demonstrates test coverage (all violation tests pass)

Limitation: Not autonomous, doesn't scale.

4. Flywheel Depends on Working Extractors

Finding: Without extractors generating observations, the flywheel can't detect conflicts.

Critical path:

Claims (✅ 22 created)
    ↓
Extractors (❌ Not running)
    ↓
Observations (❌ Not generated)
    ↓
Conflicts (❌ Not detected)
    ↓
Fixes (⏸️ Can't start)

Action needed: Fix extractor execution before Day 4 remediation.

---

Next Steps

Option A: Fix Declarative Extractors (RECOMMENDED)

1. Debug why declarative extractors don't load:

   • Check Aphoria source: applications/aphoria/src/extractors/
   • Verify config parsing: applications/aphoria/src/config.rs
   • Test with minimal extractor first

2. Once working, re-scan:

   aphoria scan --format json > scan-results-v2.json
   

   Expected: 7+ new observations, conflicts detected

3. Proceed to Day 4: Fix violations incrementally

Option B: Implement Programmatic Extractors (FALLBACK)

1. Write Rust extractors in applications/aphoria/src/extractors/http_config.rs
2. Rebuild Aphoria: cargo build --release --bin aphoria
3. Re-scan and proceed to Day 4

Estimated time: 4-6 hours

Option C: Document Gap and Skip to Day 5 (PRAGMATIC)

1. Accept current state: Violations exist, confirmed manually
2. Document the gap: Declarative extractors need work
3. Write Day 5 report: Focus on flywheel learnings, not violation detection

Estimated time: 2-3 hours

---

Success Metrics (Day 3)

Metric	Target	Actual	Status
Custom extractors created	7	7	✅
Extractors running	Yes	No	❌
Violations detected	7/7	0/7	❌
Claims verified	22	0	❌
Manual verification	N/A	7/7	✅
Feature gaps discovered	0	1	⚠️

---

Conclusion

Day 3 Status: ⚠️ PARTIAL SUCCESS

What worked:

• ✅ Skill-generated extractors (correct patterns, aligned concept paths)
• ✅ Manual verification (all 7 violations confirmed in code)
• ✅ Inline claim markers (documented violations)
• ✅ Claims properly copied to project directory

What didn't work:

• ❌ Declarative extractors don't execute (config issue or feature gap)
• ❌ Autonomous violation detection blocked
• ❌ Can't proceed to Day 4 remediation without detections

Key finding: Declarative extractors are a critical gap in the Aphoria autonomous flywheel. Skills can generate correct patterns, but without a working execution path, the flywheel can't detect violations autonomously.

Recommendation: Either fix declarative extractor loading OR document that programmatic extractors are required and update skills to generate Rust code.

Value of dogfooding: We discovered a real product gap through actual use. This is exactly what dogfooding is for — finding issues before customers do.

Next: Decide whether to debug extractors (Option A), implement programmatic ones (Option B), or document the gap and move to Day 5 (Option C).