Problem
Every test, including the "integration" suite, fakes the HTTP layer. Http::fake bypasses Guzzle's URI resolution, redirects, timeouts, and streaming, which is exactly where the riskiest audit findings live. Bugs of this class are invisible to the current suite. Coverage reporting is configured in phpunit.xml.dist but CI runs with coverage: none, so there is no coverage signal or gate.
Location
tests/Feature/PassageIntegrationTest.php (8 Http::fake calls)- CI workflows
Fix
Add a small real-server test lane (PHP built-in server or WireMock container) covering body types, header forwarding, query forwarding, streaming, and the allowed-hosts guard. Enable a coverage job with a modest floor (start at 80%).
Sizing
Priority 18 (Impact 3, Risk 3, Effort 3). Estimated 1-2 days.
From the tech debt audit dated 2026-07-05.
Problem
Every test, including the "integration" suite, fakes the HTTP layer.
Http::fakebypasses Guzzle's URI resolution, redirects, timeouts, and streaming, which is exactly where the riskiest audit findings live. Bugs of this class are invisible to the current suite. Coverage reporting is configured inphpunit.xml.distbut CI runs withcoverage: none, so there is no coverage signal or gate.Location
tests/Feature/PassageIntegrationTest.php(8Http::fakecalls)Fix
Add a small real-server test lane (PHP built-in server or WireMock container) covering body types, header forwarding, query forwarding, streaming, and the allowed-hosts guard. Enable a coverage job with a modest floor (start at 80%).
Sizing
Priority 18 (Impact 3, Risk 3, Effort 3). Estimated 1-2 days.
From the tech debt audit dated 2026-07-05.