fix(story-1.1): apply review fixes

- CHANGELOG: httpx2 constraint matches pyproject (>=2.0.0,<3.0); fix
  broken [Unreleased] compare link (HEAD...HEAD → commits/main).
- pyproject: refactor [all] extra to self-reference siblings to
  prevent version drift.
- README: document the [niquests] extra alongside [msgspec]/[otel]/[all].
- CI: drop duplicate --cov flag (addopts already injects --cov source).
- Story 1.1 doc: fix File List header miscount (15 → 14); status → done.
- New docs/deferred-work.md: log items intentionally deferred from this
  review (fork-PR codecov, just publish env-var guards, uv_build window,
  3.14 wheel risk, unpinned ruff/ty, no [test] extra).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: lesnik512

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
           cache-dependency-glob: "**/pyproject.toml"
       - run: uv python install ${{ matrix.python-version }}
       - run: just install
-      - run: just test --cov=src/httpware --cov-report xml
+      - run: just test --cov-report xml
       - uses: codecov/codecov-action@v4.0.1
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

CHANGELOG.md

@@ -10,11 +10,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Initial project scaffold: `src/httpware/` package, `py.typed` marker, `pyproject.toml` with `uv_build` backend.
 - Org conventions ported from `modern-python/modern-di`: `Justfile`, `.github/workflows/ci.yml`, `[tool.ruff]` config, `[tool.pytest.ini_options]`, dev and lint dep groups.
-- Declared dependencies: `httpx2>=2.0.0b1,<3.0`, `pydantic>=2.0,<3.0`.
+- Declared dependencies: `httpx2>=2.0.0,<3.0`, `pydantic>=2.0,<3.0`.
 - Declared install extras: `[msgspec]`, `[otel]`, `[niquests]`, `[all]`.
 - `SECURITY.md` with 90-day private-disclosure window.
 - `CONTRIBUTING.md` with development workflow.
 - `CLAUDE.md` with AI-agent guidance.
 - Core data types: `Request`, `Response`, `Limits`, `Timeout`, `ClientConfig` — frozen+slotted dataclasses with `with_*` immutability helpers on `Request` and computed `text`/`json()` accessors on `Response` (Story 1.2).
 
-[Unreleased]: https://github.com/modern-python/httpware/compare/HEAD...HEAD
+[Unreleased]: https://github.com/modern-python/httpware/commits/main

README.md

@@ -22,6 +22,7 @@ Optional extras:
 ```bash
 pip install httpware[msgspec]    # msgspec ResponseDecoder
 pip install httpware[otel]       # OpenTelemetry instrumentation
+pip install httpware[niquests]   # niquests transport
 pip install httpware[all]        # all of the above
 ```
 

docs/deferred-work.md

@@ -0,0 +1,12 @@
+# Deferred Work
+
+Items raised in reviews that are real but not actionable now.
+
+## Deferred from: code review of story-1-1 (2026-05-13)
+
+- **Codecov upload fails on fork PRs** — fork PRs cannot access `CODECOV_TOKEN`; matches modern-di pattern, accepted tradeoff. (`.github/workflows/ci.yml:46-52`)
+- **`just publish` lacks env-var validation** — recipe assumes `GITHUB_REF_NAME` and `PYPI_TOKEN` are set; running locally could corrupt the version. Add `test -n "$GITHUB_REF_NAME"` guard before release work. (`Justfile:25-29`)
+- **`uv_build>=0.11,<0.12` narrow window** — single-minor band will expire as soon as uv_build 0.12 ships; bump when that happens. (`pyproject.toml:54`)
+- **Python 3.14 wheel availability risk** — `httpx2` / `pydantic` / `uv_build` may not have 3.14 wheels yet, breaking the matrix entry. Watch CI red on 3.14. (`.github/workflows/ci.yml:30-33`)
+- **Unpinned `ruff`/`ty` with `select=["ALL"]`** — any new ruff release adds rules and can break CI overnight. Pin major versions or pin specific rules when a regression occurs. (`pyproject.toml:70-72, 84-85`)
+- **No `[test]` extra; CI uses `--all-extras`** — future heavy extras will be installed in every CI run. Declare a `test` extra and switch CI to `--extra test`. (`pyproject.toml:35-47`)

docs/stories/1-1-project-scaffold-and-tooling.md

@@ -3,7 +3,7 @@ story_key: 1-1-project-scaffold-and-tooling
 epic: 1
 story: 1
 title: Project scaffold and tooling
-status: review
+status: done
 created: 2026-05-12
 completed: 2026-05-13
 input_documents:
@@ -168,7 +168,7 @@ input_documents:
 
 ## File List
 
-Files added (15 total):
+Files added (14 total):
 
 - `.github/workflows/ci.yml` — CI workflow (ruff/ty/pytest, Python 3.11-3.14 matrix)
 - `.gitignore` — modern-di convention + project-specific ignores
@@ -201,4 +201,25 @@ Generated/transient (not committed):
 
 ## Status
 
-`review`
+`done`
+
+### Review Findings
+
+_Code review run: 2026-05-13. Reviewers: Blind Hunter, Edge Case Hunter, Acceptance Auditor. 6 patches applied, 3 dismissed by maintainer (not errors), 6 deferred, 20 dismissed as noise (2 decision-needed items were resolved → dismissed: `.gitignore plan.md` blacklist is intentional convention; AC6 lint-on-single-version matches modern-di canon and is accepted)._
+
+- [x] [Review][Patch] CHANGELOG declared `httpx2>=2.0.0b1,<3.0` while pyproject shipped `>=2.0.0,<3.0`. [`CHANGELOG.md:13`] — applied
+- [x] [Review][Patch] CHANGELOG `[Unreleased]` link was `compare/HEAD...HEAD` — replaced with `commits/main` until first tag. [`CHANGELOG.md:20`] — applied
+- [x] [Review][Dismissed] `version = "0"` placeholder. [`pyproject.toml:29`] — dismissed by maintainer, not an error
+- [x] [Review][Patch] `[all]` extra refactored to self-reference siblings: `all = ["httpware[msgspec,otel,niquests]"]`. [`pyproject.toml:42-47`] — applied
+- [x] [Review][Patch] README "Optional extras" snippet — added `pip install httpware[niquests]`. [`README.md:22-26`] — applied
+- [x] [Review][Dismissed] CI `timeout-minutes`. [`.github/workflows/ci.yml:14, 26`] — dismissed by maintainer, not an error
+- [x] [Review][Dismissed] CI explicit `permissions:` block. [`.github/workflows/ci.yml:1-12`] — dismissed by maintainer, not an error
+- [x] [Review][Patch] Duplicate `--cov` flag — dropped `--cov=src/httpware` from CI invocation; `addopts` is now the single source of `--cov` source. [`.github/workflows/ci.yml:45`] — applied
+- [x] [Review][Patch] File List header `15 total` → `14 total`. [`docs/stories/1-1-project-scaffold-and-tooling.md:171`] — applied
+
+- [x] [Review][Defer] Codecov upload fails on fork PRs without `CODECOV_TOKEN`; matches modern-di pattern, accepted tradeoff. [`.github/workflows/ci.yml:46-52`] — deferred, pre-existing
+- [x] [Review][Defer] `just publish` does not validate `GITHUB_REF_NAME` / `PYPI_TOKEN`; local invocation could corrupt the version. [`Justfile:25-29`] — deferred, release-flow hygiene
+- [x] [Review][Defer] `uv_build>=0.11,<0.12` is a one-minor-version window that will expire fast. [`pyproject.toml:54`] — deferred, will bump on release
+- [x] [Review][Defer] Python 3.14 in CI matrix; httpx2 / pydantic / uv_build wheels may not yet exist on 3.14, causing the matrix entry to fail. [`.github/workflows/ci.yml:30-33`] — deferred, wait-and-see
+- [x] [Review][Defer] `[tool.ruff.lint] select = ["ALL"]` paired with unpinned `ruff`/`ty` — any new ruff release adds rules and breaks CI overnight. [`pyproject.toml:70-72, 84-85`] — deferred, matches modern-di
+- [x] [Review][Defer] No `[test]` extra declared; CI relies on `--all-extras`, so any future heavy extra is pulled into every CI run. [`pyproject.toml:35-47`] — deferred, scope creep concern

pyproject.toml

@@ -39,12 +39,7 @@ otel = [
     "opentelemetry-sdk>=1.20",
 ]
 niquests = ["niquests>=3.18"]
-all = [
-    "msgspec>=0.18",
-    "opentelemetry-api>=1.20",
-    "opentelemetry-sdk>=1.20",
-    "niquests>=3.18",
-]
+all = ["httpware[msgspec,otel,niquests]"]
 
 [project.urls]
 repository = "https://github.com/modern-python/httpware"