feat(callout): add praxis-proxy-callout crate

[usize]

This establishes a standalone crate for a reqwest-based callout client. It has its own circuit breaker, loop detection, and error handling logic. The loop detection in particular is built with the intention of supporting callouts from within filters.

Part of #358. Follow-ups will use this client to implement a reference filter implementation, capable of handling arbitrary HTTP requests from within filters, for easy integration with external guardrails systems and other similar services.

[praxis-bot-app]

Missing Signed-off-by: c8c991f, d5a8423. All commits require sign-off (via git commit --signoff).

[praxis-bot-app]

PR too large: 1461 lines added (limit: 750, excludes Cargo files, tests, docs, examples, and benchmarks). Please split into smaller PRs. Add skip/pr-conventions label to override.

[praxis-bot]

PR Review

Summary: Adds praxis-proxy-callout crate — a standalone reqwest-based HTTP callout client with circuit breaker, loop-depth prevention, and fail-open/closed semantics. PR 1 of 3 for #358.

Overall the architecture and code quality are strong. The circuit breaker state machine is correct, the test coverage is thorough (45 tests), and the crate is properly standalone. A few issues around response body handling, workspace consistency, and missing #![deny(unsafe_code)].

Severity	Count
Critical	1
Large	3
Medium	5

Non-inline findings

• [Medium] The tests/smoke workspace member present on main is missing from the PR's Cargo.toml members list. Verify this was not accidentally dropped during the rebase.
• [Medium] The PR bumps rust-version from 1.94 to 1.96 and upgrades several existing dependency versions (bytes, chrono, h2, http, prost, regex, zeroize, etc.) plus changes Pingora from git to crates.io. These are unrelated to the callout crate and should be split into a separate PR or at minimum noted in the PR description.

[praxis-bot]

[Critical] process_response takes &reqwest::Response but never reads the body — CalloutResponse::body is always Vec::new(). The response body is consumed by response.bytes().await, which requires ownership or &mut. Since the caller (execute) has an owned Response, change process_response to take ownership and .bytes().await the body. As-is, every successful callout returns an empty body, which will make the JSONPath extraction in PR 2 impossible.

async fn process_response(&self, response: reqwest::Response) -> CalloutResult {
    let status = response.status();
    if !status.is_success() { ... }
    self.record_success();
    let headers = extract_headers(&response);
    let body = response.bytes().await.map(|b| b.to_vec()).unwrap_or_default();
    CalloutResult::Success(CalloutResponse { body, headers, status: status.as_u16() })
}

[praxis-bot]

[Large] Missing #![deny(unsafe_code)] at the crate root. Project convention (CLAUDE.md: "#![deny(unsafe_code)] in all crate roots") requires this. Add it after the license/copyright header.

[praxis-bot]

[Large] The doctest uses ignore instead of being runnable. Project conventions prefer ample, runnable doctests. Since CalloutClient::new is sync and only execute is async, the constructor portion can at least be a no_run test:

/// ```no_run
/// use praxis_callout::{CalloutClient, CalloutConfig};
///
/// let client = CalloutClient::new(CalloutConfig::default()).unwrap();
/// ```

If the full async example is needed, use tokio::main with no_run.

[praxis-bot]

[Medium] extract_headers silently drops headers with non-UTF-8 values via filter_map + to_str().ok(). This is a reasonable default for most use cases, but a tracing::debug! for dropped headers would aid debugging when a callout target returns binary header values that the caller expects to see.

[praxis-bot]

[Medium] name.to_string() on a HeaderName triggers the str_to_string lint that is denied in the workspace. HeaderName implements Display, not &str-to-String, so this is technically to_string() on a non-string type — which is the allowed case per conventions. However, verify this compiles under the workspace lint profile since str_to_string is denied and the lint sometimes fires on Display impls depending on the clippy version.

[praxis-bot]

[Medium] body.clone() in send_request copies the entire request body. For large bodies (the proposal mentions 1 MiB max), consider taking body by value from CalloutRequest (the execute method already takes ownership of the request). Change the signature to async fn send_request(&self, request: CalloutRequest) and use request.body directly instead of borrowing.

[praxis-bot]

[Large] In check(), when the state is HalfOpen, it returns Open (line 97). The doc comment says "the first caller gets HalfOpen (probe allowed); subsequent callers still see Open." This is correct for single-probe semantics, but there is a race: between check() returning HalfOpen and the probe completing (calling record_success/record_failure), concurrent callers see Open and are rejected. If the probe is slow, a burst of legitimate requests is rejected unnecessarily.

Consider adding a probing: bool field to CircuitInner that check() sets when transitioning to HalfOpen, so the state remains HalfOpen (not Open) for concurrent readers — they would still be rejected, but the observability would be accurate. Not blocking, but worth documenting as a known limitation.

[praxis-bot]

[Medium] The blanket #[allow(clippy::missing_assert_message)] suppresses the workspace-required missing_assert_message lint for all tests. The project convention (CLAUDE.md) says every assert! needs a message string. Most assert!(matches!(...)) calls here would benefit from a failure message (e.g., "expected Success variant"). Consider removing the blanket allow and adding messages to each assertion.

[praxis-bot]

[Medium] reqwest = { version = "0.12.18", ... } — the Cargo.lock resolves to 0.12.28. Since this is a workspace dependency, consider pinning to the actual resolved version (0.12.28) to be explicit about which version is tested and to match the Cargo.lock. Same for wiremock = "0.6.4" resolving to 0.6.5.