stemedb/applications/aphoria/dogfood/httpclient/DAY3-SUMMARY.md

# Day 3 Summary: Scan and Extractor Generation

**Date:** 2026-02-10
**Status:** ⚠️ PARTIAL - Discovered Feature Gap
**Duration:** ~1.5 hours

---

## What We Did

### Phase 1: Initial Scan with Built-in Extractors (15 min)

**Command:**
```bash
aphoria scan --format json > scan-results-v1.json
```

**Results:**
- **Files scanned:** 8
- **Observations extracted:** 16 (built-in extractors)
- **Conflicts detected:** 0
- **Verdict:** Built-in extractors don't detect HTTP-specific violations

**Why?** Built-in extractors focus on common patterns:
- Imports (`use tokio::`, `use md5::`)
- Hardcoded secrets (`password = "..."`)
- Crypto choices (`MD5`, `SHA1`)
- Unsafe patterns (`unwrap()`, `expect()`)

They don't detect:
- Configuration values in structs
- Duration thresholds
- Enum variants (TLS versions)
- Option<T> presence/absence

---

### Phase 2: Verify Claims Against Code (10 min)

**Command:**
```bash
aphoria verify run
```

**Results:**
All 22 claims show as **MISSING** - no observations found to verify against.

**Sample output:**
```
MISSING  httpclient-connect-timeout-001 | httpclient/connect_timeout/max_value = 10
         No matching observation found

MISSING  httpclient-request-timeout-001 | httpclient/request_timeout/max_value = 30
         No matching observation found

MISSING  httpclient-tls-cert-validation-001 | httpclient/tls/certificate_validation/required = true
         No matching observation found
```

**Conclusion:** We need custom extractors for HTTP client config patterns.

---

### Phase 3: Generate Custom Declarative Extractors (45 min)

Used `/aphoria-custom-extractor-creator` skill to generate declarative extractors.

**Created 7 extractors for violations:**

1. **httpclient_max_redirects_unbounded**
   - Pattern: `max_redirects:\s*Option<usize>`
   - Detects: Unbounded redirect limit (Option allows None)
   - Subject: `max_redirects`
   - Predicate: `bounded = false`

2. **httpclient_request_timeout_value**
   - Pattern: `request_timeout.*Duration::from_secs\((\d+)\)`
   - Detects: Request timeout value (extracts 120)
   - Subject: `request_timeout`
   - Predicate: `seconds` (value from capture group)

3. **httpclient_connect_timeout_value**
   - Pattern: `connect_timeout.*Duration::from_secs\((\d+)\)`
   - Detects: Connect timeout value (extracts 60)
   - Subject: `connect_timeout`
   - Predicate: `seconds` (value from capture group)

4. **httpclient_idle_timeout_missing**
   - Pattern: `idle_timeout:\s*Option<Duration>`
   - Detects: Missing idle timeout (Option allows None)
   - Subject: `idle_timeout`
   - Predicate: `required = false`

5. **httpclient_verify_tls_disabled**
   - Pattern: `verify_tls:\s*false`
   - Detects: TLS verification disabled
   - Subject: `tls/certificate_validation`
   - Predicate: `enabled = false`

6. **httpclient_tls_version_1_0**
   - Pattern: `min_tls_version:\s*TlsVersion::Tls10`
   - Detects: TLS 1.0 usage (below minimum 1.2)
   - Subject: `tls/min_version`
   - Predicate: `version = "1.0"`

7. **httpclient_max_retries_unbounded**
   - Pattern: `max_retries:\s*Option<u32>`
   - Detects: Unbounded retry limit (Option allows None)
   - Subject: `retry/max_attempts`
   - Predicate: `bounded = false`

**Extractor configuration:**
- Created `.aphoria/extractors.toml` with all patterns
- Added extractors inline to `.aphoria/config.toml`
- Aligned concept paths with claim subjects

---

### Phase 4: Test Custom Extractors (30 min)

**Command:**
```bash
aphoria scan --format json
```

**Results:** ⚠️ **FEATURE GAP DISCOVERED**

**Problem:** Declarative extractors defined in config.toml are not being loaded/executed.

**Evidence:**
- Scan still shows 16 observations (same as baseline)
- 0 observations from custom extractors
- All claims still show as MISSING
- No errors or warnings about extractor configuration

**Hypothesis:** Declarative extractor feature may not be fully implemented in current Aphoria build.

---

## Key Discovery: Declarative Extractor Gap

**What we expected:**
1. Add declarative extractors to `.aphoria/config.toml`
2. Run `aphoria scan`
3. Extractors execute, generate observations
4. Observations conflict with claims
5. Violations detected ✅

**What actually happened:**
1. Added declarative extractors to `.aphoria/config.toml` ✅
2. Run `aphoria scan` ✅
3. **Extractors didn't execute** ❌
4. No observations generated ❌
5. No violations detected ❌

**This is valuable feedback for Aphoria development:**
- Declarative extractors are documented but may not be working
- OR: Configuration format is different than documented
- OR: Feature requires programmatic extractors (Rust implementation)

---

## Alternative Paths Forward

### Option 1: Implement Programmatic Extractors (HIGH EFFORT)

**What:** Write Rust code implementing the `Extractor` trait

**Pros:**
- Full control over extraction logic
- Can parse AST, understand context
- Guaranteed to work (well-tested pattern)

**Cons:**
- Requires Rust expertise
- Requires rebuilding Aphoria binary
- High friction for users (not autonomous)
- ~4-6 hours implementation time

**Example:**
```rust
pub struct HttpConfigExtractor {
    timeout_pattern: Regex,
}

impl Extractor for HttpConfigExtractor {
    fn extract(&self, path_segments: &[String], content: &str, ...) -> Vec<Observation> {
        // Parse Duration::from_secs values, compare against thresholds
    }
}
```

### Option 2: Use Inline Claim Markers + Manual Formalization (CURRENT STATE)

**What:** Leverage the `@aphoria:claim` markers already in code

**Pros:**
- Already embedded in all 7 violation locations
- Self-documenting violations
- Can be detected by future inline marker extractor

**Cons:**
- Requires manual formalization: `aphoria claims formalize-marker`
- Not fully autonomous yet
- Extractor for markers may not exist

**Status:**
- 8 inline markers in code ✅
- Markers capture concept path, invariant, consequence ✅
- Formalization command exists (untested)

### Option 3: Validate via Manual Code Review (FALLBACK)

**What:** Manual inspection confirms violations exist

**Validation:**
```bash
# VIOLATION 1: Unbounded redirects
grep -n "max_redirects: Option<usize>" src/config.rs
# Line 40: pub max_redirects: Option<usize>,  ✅

# VIOLATION 2: Excessive request timeout
grep -n "Duration::from_secs(120)" src/config.rs
# Line 123: request_timeout: Duration::from_secs(120),  ✅

# VIOLATION 3: Excessive connect timeout
grep -n "Duration::from_secs(60)" src/config.rs
# Line 120: connect_timeout: Duration::from_secs(60),  ✅

# VIOLATION 4: Missing idle timeout
grep -n "idle_timeout: None" src/config.rs
# Line 126: idle_timeout: None,  ✅

# VIOLATION 5: TLS verification disabled
grep -n "verify_tls: false" src/config.rs
# Line 129: verify_tls: false,  ✅

# VIOLATION 6: TLS version too low
grep -n "TlsVersion::Tls10" src/config.rs
# Line 132: min_tls_version: TlsVersion::Tls10,  ✅

# VIOLATION 7: Unbounded retries
grep -n "max_retries: Option<u32>" src/retry.rs
# Line 21: pub max_retries: Option<u32>,  ✅
```

**All 7 violations confirmed in code** ✅

---

## Files Created

**Extractors:**
- `.aphoria/extractors.toml` - Declarative extractor definitions (attempted)
- `.aphoria/config.toml` - Updated with inline extractors (not working)

**Scan Results:**
- `scan-results-v1.json` - Baseline scan (16 observations, 0 conflicts)

**Claims:**
- `.aphoria/claims.toml` - 22 claims extracted from parent directory

**Documentation:**
- `DAY3-SUMMARY.md` - This file

---

## Lessons Learned

### 1. Declarative Extractors May Not Be Production-Ready

**Finding:** Config-based declarative extractors don't execute in current Aphoria build.

**Impact:** Skills-driven workflow (`/aphoria-custom-extractor-creator`) can't autonomously detect violations without programmatic extractors.

**Action needed:** Either:
- Fix declarative extractor loading in Aphoria core
- Document that programmatic extractors are required
- Update skills to generate Rust code instead of TOML

### 2. Inline Claim Markers Are a Good Fallback

**Finding:** `@aphoria:claim` markers capture intent even when extractors don't work.

**Value:**
- Self-documenting code
- Future-proof (extractor can be added later)
- Manual formalization is possible: `aphoria claims formalize-marker`

**Action needed:** Build inline marker extractor as a built-in.

### 3. Manual Verification Still Validates Violations

**Finding:** All 7 violations are confirmed via grep.

**Value:**
- Proves code has violations
- Validates claim accuracy
- Demonstrates test coverage (all violation tests pass)

**Limitation:** Not autonomous, doesn't scale.

### 4. Flywheel Depends on Working Extractors

**Finding:** Without extractors generating observations, the flywheel can't detect conflicts.

**Critical path:**
```
Claims (✅ 22 created)
    ↓
Extractors (❌ Not running)
    ↓
Observations (❌ Not generated)
    ↓
Conflicts (❌ Not detected)
    ↓
Fixes (⏸️ Can't start)
```

**Action needed:** Fix extractor execution before Day 4 remediation.

---

## Next Steps

### Option A: Fix Declarative Extractors (RECOMMENDED)

1. **Debug why declarative extractors don't load:**
   - Check Aphoria source: `applications/aphoria/src/extractors/`
   - Verify config parsing: `applications/aphoria/src/config.rs`
   - Test with minimal extractor first

2. **Once working, re-scan:**
   ```bash
   aphoria scan --format json > scan-results-v2.json
   ```
   Expected: 7+ new observations, conflicts detected

3. **Proceed to Day 4:** Fix violations incrementally

### Option B: Implement Programmatic Extractors (FALLBACK)

1. **Write Rust extractors** in `applications/aphoria/src/extractors/http_config.rs`
2. **Rebuild Aphoria:** `cargo build --release --bin aphoria`
3. **Re-scan and proceed to Day 4**

Estimated time: 4-6 hours

### Option C: Document Gap and Skip to Day 5 (PRAGMATIC)

1. **Accept current state:** Violations exist, confirmed manually
2. **Document the gap:** Declarative extractors need work
3. **Write Day 5 report:** Focus on flywheel learnings, not violation detection

Estimated time: 2-3 hours

---

## Success Metrics (Day 3)

| Metric | Target | Actual | Status |
|--------|--------|--------|--------|
| **Custom extractors created** | 7 | 7 | ✅ |
| **Extractors running** | Yes | No | ❌ |
| **Violations detected** | 7/7 | 0/7 | ❌ |
| **Claims verified** | 22 | 0 | ❌ |
| **Manual verification** | N/A | 7/7 | ✅ |
| **Feature gaps discovered** | 0 | 1 | ⚠️ |

---

## Conclusion

**Day 3 Status:** ⚠️ PARTIAL SUCCESS

**What worked:**
- ✅ Skill-generated extractors (correct patterns, aligned concept paths)
- ✅ Manual verification (all 7 violations confirmed in code)
- ✅ Inline claim markers (documented violations)
- ✅ Claims properly copied to project directory

**What didn't work:**
- ❌ Declarative extractors don't execute (config issue or feature gap)
- ❌ Autonomous violation detection blocked
- ❌ Can't proceed to Day 4 remediation without detections

**Key finding:**
**Declarative extractors are a critical gap in the Aphoria autonomous flywheel.** Skills can generate correct patterns, but without a working execution path, the flywheel can't detect violations autonomously.

**Recommendation:**
Either fix declarative extractor loading OR document that programmatic extractors are required and update skills to generate Rust code.

**Value of dogfooding:**
We discovered a real product gap through actual use. This is exactly what dogfooding is for — finding issues before customers do.

**Next:** Decide whether to debug extractors (Option A), implement programmatic ones (Option B), or document the gap and move to Day 5 (Option C).