refactor(gateway): delete server.rs shim + relocate tests to slices — ironclaw#2599 stage 6

[ilblackdragon]

Summary

Finishes the feature-slice migration started in stage 4a. After this lands:

• src/channels/web/server.rs no longer exists.
• Every caller of crate::channels::web::server::* points at platform::router::start_server or platform::state::* directly.
• The ~60 caller-level tests that used to live in server.rs::tests now live inside the feature slice they actually exercise, next to the handler they test.

Builds on #2704 (cross-slice test builder promotion), which landed the prerequisite.

What moved where

Classification driven by the handler each test drives:

Slice	Tests
features/chat/mod.rs::tests	3 × history, 4 × auth-token/cancel + gate-resolve, 1 × approval, 3 × pending-gate-extension-name, 1 × test_auth_manager helper
features/pairing/mod.rs::tests	1 × list, 5 × approve, make_pairing_test_state helper
features/extensions/mod.rs::tests	2 × activation classifier, 2 × path-traversal guards, 1 × setup-submit-not-activated, 2 × list-inactive-wasm-channel, 1 × phase-precedence, 1 × readiness, 2 × apply_extension_readiness
features/oauth/mod.rs::tests (new)	13 × oauth callback, 5 × relay oauth callback, TestOauthProxy / EnvVarGuard / set_env_var / fresh_pending_oauth_flow / expired_flow_created_at / test_oauth_router / test_relay_oauth_router helpers
platform/static_files.rs::tests (new)	13 × CSP / CSS / stamp-nonce / frontend-html tests
platform/state.rs::tests (new)	1 × workspace_pool_resolve_seeds_new_user_workspace
handlers/llm.rs::tests	3 × llm admin-role guards
handlers/users.rs::tests (new)	1 × delete_user_evicts_auth_and_pairing_caches

Cross-slice fixtures

Four helpers that multiple slices share moved into src/channels/web/test_helpers.rs as #[cfg(test)] pub(crate) free functions alongside the three builders landed in #2704:

• insert_test_user (pairing + users)
• test_secrets_store (extensions + oauth)
• test_ext_mgr (extensions + oauth)
• test_ext_mgr_with_db (extensions + oauth)

All keep the exact positional signatures they had in server.rs::tests.

Mechanical renames (25 files)

channels::web::server::<item> call sites now import from:

• platform::router::start_server
• platform::state::{GatewayState, RateLimiter, PerUserRateLimiter, WorkspacePool, FrontendCacheKey, FrontendHtmlCache, ActiveConfigSnapshot, PromptQueue, RoutineEngineSlot, rate_limit_key_from_headers}

Covers src/main.rs, src/app.rs, src/tools/builtin/{job,memory}.rs, all 13 handlers in handlers/*.rs, the four integration tests (ws_gateway_integration, openai_compat_integration, multi_tenant_integration, oauth_greeting_integration), plus tests/support/gateway_workflow_harness.rs and src/channels/web/tests/multi_tenant.rs. No behavior change.

Boundary checker retained

scripts/check_gateway_boundaries.py still rejects any crate::channels::web::server:: path as a defense-in-depth guard against accidental re-introduction (literal new server.rs, stray imports, etc.). The explanatory comment and the regression test's docstring now reflect "shim is gone; this guard prevents re-creation" instead of "shim exists; don't route through it."

Documentation updates

• src/channels/web/CLAUDE.md: deleted the server.rs File Map row, updated the test_helpers.rs row to list all seven pub(crate) fixtures, fixed every prose reference that pointed at server.rs, and updated the "Adding a New API Endpoint" recipe to point at features/<slice>/ and platform/router.rs.
• src/channels/web/platform/state.rs: module docstring now says "shim was removed" instead of "shim exists pending migration."
• src/bridge/CLAUDE.md: pending_gate_extension_name reference now points at features/chat/mod.rs.

Quality gate

• cargo fmt --all
• cargo clippy --all --benches --tests --examples --all-features — zero warnings
• cargo check -p ironclaw --no-default-features --features libsql --tests — clean
• cargo test -p ironclaw --lib channels::web — 434 passed (up from 431 before this PR — three tests that were filtered under channels::web::server::tests now surface under their proper slice module path)
• cargo test -p ironclaw --test multi_tenant_integration — 40 passed
• cargo test -p ironclaw --test openai_compat_integration — 16 passed
• cargo test -p ironclaw --test ws_gateway_integration — 11 passed
• python3 scripts/check_gateway_boundaries.py — clean, empty allowlist preserved
• python3 scripts/check_gateway_boundaries.py test — 16/16
• bash scripts/pre-commit-safety.sh — clean

Regression coverage

Pure relocation + mechanical rename; no behavior change. The existing ~60 tests from server.rs::tests continue to pass unmodified under their new module paths — that's the regression evidence. A "test that would have caught this" would necessarily duplicate the existing tests; no new test adds coverage. Commit carries [skip-regression-check].

Migration progress (ironclaw#2599)

Slice	Stage	PR	Status
oauth	4a	#2645	✅ merged
logs / pairing / status	4b	#2665	✅ merged
chat	4c	#2680	✅ merged
extensions + jobs + settings + routines	4d + 5	#2687	✅ merged
test-helper promotion	6a	#2704	✅ merged
server.rs deletion + test relocation	6	this PR	in review
handlers/{auth,engine,frontend,llm,memory,secrets,skills,system_prompt,tokens,tool_policy,users,webhooks} → features/	7 (evaluate)	pending
contracts crate	8 (evaluate)	pending

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Removes the last channels::web::server compatibility shim and completes stage-6 of the gateway slice migration by redirecting all call sites to platform::{router,state} and relocating the former server.rs::tests into the feature slices they exercise.

Changes:

• Deleted the server.rs module path usage by switching imports to platform::router::start_server and platform::state::* across the app, handlers, and integration tests.
• Relocated ~60 caller-level tests from the former server.rs::tests into features/{chat,extensions,oauth,pairing}, plus new test modules in platform/{static_files,state} and a few handler test modules.
• Expanded channels::web::test_helpers with additional cross-slice #[cfg(test)] pub(crate) fixtures and updated boundary-checker + docs to reflect shim removal.

Reviewed changes

Copilot reviewed 35 out of 36 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/ws_gateway_integration.rs	Updates server startup/state imports to platform::{router,state}.
tests/support/gateway_workflow_harness.rs	Updates harness imports to platform::{router,state}.
tests/openai_compat_integration.rs	Updates server startup/state imports to platform::{router,state}.
tests/oauth_greeting_integration.rs	Updates server startup/state imports to platform::{router,state}.
tests/multi_tenant_integration.rs	Updates server startup calls/imports away from web::server.
src/tools/builtin/memory.rs	Switches WorkspacePool reference to platform::state.
src/tools/builtin/job.rs	Updates comment to reference platform::state::PromptQueue.
src/main.rs	Switches state type aliases/constructors to platform::state.
src/channels/web/tests/multi_tenant.rs	Updates imports to platform::state types.
src/channels/web/test_helpers.rs	Adds shared cross-slice test fixtures and updates imports to platform.
src/channels/web/responses_api.rs	Repoints GatewayState import to platform::state.
src/channels/web/platform/static_files.rs	Adds a large in-module test suite for CSP/static serving behavior.
src/channels/web/platform/state.rs	Updates module docs and adds a WorkspacePool unit test.
src/channels/web/openai_compat.rs	Repoints GatewayState import to platform::state.
src/channels/web/mod.rs	Removes pub mod server; and rewires remaining state/start_server references to platform.
src/channels/web/handlers/webhooks.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/users.rs	Repoints GatewayState import and adds deletion cache-eviction test.
src/channels/web/handlers/tool_policy.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/tokens.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/system_prompt.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/static_files.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/skills.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/secrets.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/memory.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/llm.rs	Repoints GatewayState import and adds admin-guard tests.
src/channels/web/handlers/engine.rs	Repoints GatewayState import to platform::state.
src/channels/web/handlers/auth.rs	Repoints GatewayState import and updates rate-limit key helper call.
src/channels/web/features/pairing/mod.rs	Adds relocated pairing tests + shared state builder helper.
src/channels/web/features/oauth/mod.rs	Adds relocated OAuth/relay callback test suite and helpers.
src/channels/web/features/extensions/mod.rs	Adds relocated extensions tests (validation, readiness, setup-submit, etc.).
src/channels/web/features/chat/mod.rs	Adds relocated chat tests (history, auth-token/cancel, gate resolve, pending-gate name).
src/channels/web/CLAUDE.md	Updates documentation for shim removal + new test helper locations.
src/bridge/CLAUDE.md	Updates references to pending_gate_extension_name new location.
src/app.rs	Switches WorkspacePool constructor to platform::state.
scripts/check_gateway_boundaries.py	Updates comments/tests to treat web::server as a forbidden “no reintroduction” path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The assertion only checks is_ascii_hexdigit() (accepts A–F) but the failure message says the nonce must be lowercase hex. Either tighten the check to enforce lowercase (since generate_csp_nonce() uses hex::encode which is lowercase) or adjust the message to match what’s actually being validated.

Suggested change

	a.chars().all(|c| c.is_ascii_hexdigit()),
	a.chars().all(|c| matches!(c, '0'..='9' | 'a'..='f')),

[ilblackdragon]

Fixed in b8dda5e. Tightened the assertion to matches!(c, '0'..='9' | 'a'..='f') so it matches the "lowercase hex" message and what generate_csp_nonce actually produces via hex::encode.

[gemini-code-assist]

Code Review

This pull request completes the removal of the server.rs backward-compatibility shim as part of the ironclaw#2599 migration, updating all internal and external references to the new platform/ and features/ modules. It also introduces comprehensive unit and integration tests for chat, extensions, OAuth, and pairing features. Feedback suggests improving test robustness by using .expect() instead of early returns when setting up environmental test state to avoid silent false positives.

[gemini-code-assist]

The pattern of returning early from a test when expired_flow_created_at() returns None makes the test suite fragile and prone to silent false positives. On systems with low uptime, Instant::now().checked_sub(...) will return None. Per repository rules, you should prefer using .expect() to explicitly fail the test with a clear message if the setup is not possible, rather than allowing the test to silently skip the logic.

References

1. In tests, when setting up a state that depends on environmental factors, prefer expect() to explicitly fail the test with a clear message if the setup is not possible. Avoid fallbacks that could cause the test to silently check the wrong logic.

[ilblackdragon]

Good catch — fixed in b8dda5e. Changed expired_flow_created_at() to return Instant directly (moving the .expect(...) inside the helper) and collapsed the five let Some(..) = expired_flow_created_at() else { eprintln!(...); return; }; call sites into let created_at = expired_flow_created_at();.

On a just-booted CI host the test now fails loudly with "monotonic clock must have run long enough for expired_flow_created_at" instead of silently skipping the expired-flow branch. The .expect() carries a // safety: cfg(test) fixture suppression for the pre-commit safety check, consistent with the other test fixtures in test_helpers.rs.