{"record":{"id":"0a98004aeba4e64e","repo":"zeroclaw-labs/zeroclaw","slug":"http-client-build","errorCode":null,"errorMessage":"HTTP client build","messagePattern":"HTTP client build","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/nodes/transport.rs","lineNumber":77,"sourceCode":"        .fold(0u8, |acc, (x, y)| acc | (x ^ y))\n        == 0\n}\n\n// ── Node transport client ───────────────────────────────────────\n\npub struct NodeTransport {\n    http: reqwest::Client,\n    shared_secret: String,\n    max_request_age_secs: i64,\n}\n\nimpl NodeTransport {\n    pub fn new(shared_secret: String) -> Self {\n        Self {\n            http: reqwest::Client::builder()\n                .timeout(std::time::Duration::from_secs(30))\n                .build()\n                .expect(\"HTTP client build\"),\n            shared_secret,\n            max_request_age_secs: 300, // 5 min replay window\n        }\n    }\n\n    /// Send an authenticated request to a peer node.\n    pub async fn send(\n        &self,\n        node_address: &str,\n        endpoint: &str,\n        payload: serde_json::Value,\n    ) -> Result<serde_json::Value> {\n        let body = serde_json::to_vec(&payload)?;\n        let timestamp = Utc::now().timestamp();\n        let nonce = uuid::Uuid::new_v4().to_string();\n        let signature = sign_request(&self.shared_secret, &body, timestamp, &nonce)?;\n\n        let url = format!(\"https://{node_address}/api/node-control/{endpoint}\");","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/nodes/transport.rs#L59-L95","documentation":"NodeTransport::new() builds the HTTP client used for authenticated peer-to-peer node requests (30s timeout, HMAC shared-secret auth) and expects reqwest::Client::builder().build() to succeed. As with error 1533, the only realistic failure is TLS backend initialization failure, which this constructor escalates to a panic.","triggerScenarios":"Constructing NodeTransport (i.e. enabling node-to-node transport) in a process whose TLS stack cannot initialize: missing CA store with native-tls, conflicting TLS features pulled in by another dependency, or broken OpenSSL linkage.","commonSituations":"Clustering ZeroClaw nodes inside minimal or hardened containers; adding SDK dependencies that change reqwest's enabled TLS backend; upgrading the base image to one with an incompatible OpenSSL.","solutions":["Ensure CA certificates are present in the deployment image when native-tls is in use.","Pin one TLS backend (rustls-tls) across all workspace crates to eliminate OpenSSL at runtime.","Verify shared library linkage and OpenSSL versions (ldd, openssl version) after base-image upgrades.","Smoke-test node startup in the target container before enabling clustering."],"exampleFix":"// before (Cargo.toml): one crate uses default-tls, another rustls-tls\n// after: unify on rustls\nreqwest = { version = \"0.12\", default-features = false, features = [\"rustls-tls\", \"json\"] }","handlingStrategy":"fallback","validationCode":"// Startup check before enabling node clustering:\nlet probe = reqwest::Client::builder()\n    .timeout(std::time::Duration::from_secs(30)).build();\nanyhow::ensure!(probe.is_ok(), \"node transport HTTP client cannot initialize (TLS backend): {:?\", probe.err());","typeGuard":null,"tryCatchPattern":"let http = match reqwest::Client::builder().timeout(Duration::from_secs(30)).build() {\n    Ok(c) => c,\n    Err(_) => reqwest::Client::builder().timeout(Duration::from_secs(30)).use_rustls_tls().build()?,\n};","preventionTips":["Unify reqwest TLS features across all workspace crates (prefer rustls-tls).","Verify CA certificates and OpenSSL linkage in the deployment image after every base-image bump.","Probe client construction at node startup and fail with a descriptive error before clustering activates."],"tags":["rust","reqwest","http-client","tls","clustering","docker"],"backgroundTag":"reqwest-client-build-failed","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}