Matt Cockayne authored Aug 18, 2026 and Matt Cockayne committed Aug 18, 2026

Spec 0008 D4. forge has exposed WithHTTPTransport and WithHTTPClient since
v0.13.0 and this adapter read neither: the factory took opts ...forge.Option,
consulted Options.Logger, and dropped the rest. A consumer injecting a transport
to share a connection pool got no effect and no error.

Settings gains HTTPTransport and HTTPClient, the factory copies them from the
options, and all THREE places this module built a client now go through one of
two helpers. Three matters: a partial adoption is worse than none, because a
caller whose pool covers the API but not the asset download has one that quietly
does not cover every request.

  - apiClient honours both rungs, preferring a supplied client, which is the
    precedence forge.Options documents.
  - pooledClient shares a supplied transport and DELIBERATELY IGNORES a supplied
    client.

The second is a security decision and the reason this is not four identical
lines. pooledClient builds the redirect follower for an asset download, whose
whole purpose is to carry no credential: go-github makes the authenticated hop
to the API, stops at the redirect, and follows it with this client — so the bytes
come from a host named in author-controlled release metadata, reached by
something carrying nothing.

A caller's client may carry a credential. We cannot inspect it to find out, and
rung 2 exists for a caller who wants to own the request path — not for one who
wanted their token sent to whatever host a release author's asset URL resolves
to. Substituting it there would recreate, inside forge, the leak this estate's
credential-pinning documentation exists to prevent. The transport is still
shared, so no pooling is lost.

Every behaviour is falsified against the mutant that removes it. The one worth
naming: making pooledClient prefer the supplied client fails
TestTheRedirectFollowerIsNeverTheSuppliedClient with "the consumer's credential
reached an author-controlled asset host".

TestTheRungsReachThroughTheRegistry is the only test that catches a factory which
drops the options, and the registry is the path most consumers use — a Settings
field honoured by NewReleaseProvider but lost by the factory satisfies every
other test here.