Upgrade httpx after the TCP_NODELAY fixes

[Eddy Ashton (eddyashton)]

Stack and intent

Stacked on #8410, targeting agents/tcp-nodelay-client-optimization, not main. This is proposed as a later, separate upgrade: #8410 removes Nagle-related delays and fixes tests exposed by faster requests; this PR removes the old httpx pin and addresses additional upgrade compatibility issues. Further upgrade-specific fixes may be needed as CI exercises the wider suite. Retarget to main after #8410 merges.

Changes

• Upgrade httpx[http2] from 0.23.* to >=0.28.1, <0.29 (latest stable). Remove the private httpcore backend injection and its new 0.16.3 pin. Resolved httpcore 1.0.9 sets TCP_NODELAY by default, confirmed in source and on a live httpx socket. Keep RawSocketClient's explicit setting.
• Build an SSL context in HttpxClient and load the client certificate into it. In httpx 0.28.1 the deprecated verify=<CA filename> path returns before loading cert=, otherwise causing authenticated requests to return 401. Preserve ca=None / verify_ca=False and add an e2e regression proving client authentication still works with server verification disabled.
• URL-encode query test data consistently for all clients. The old parser escaped all percent signs when any malformed percent escape was present, incidentally preserving literal %20 text in our awkward sample. The test now encodes parameter values explicitly, as its exhaustive character cases and curl path already did. Add reserved-character coverage; retain the existing assertions.

Long-lived forwarding passes with the inherited #8410 fixes, without further timing changes. JWT tests needed no JWT-specific changes. The query failure was an encoding assumption, not a timing race.

TLS behavior to review

There is no higher-level SSL context being replaced: callers supply certificate filenames and identities, and the transport constructs the context. This follows our raw-socket and Locust patterns. httpcore still configures ALPN.

The upgrade follows Python/new-httpx defaults rather than reproducing every old httpx TLS setting: Common Name fallback is enabled, TLS 1.3 post-handshake authentication is disabled, and cipher selection uses Python/OpenSSL defaults. Minimum TLS remains 1.2 in the tested environment. These client policy differences are distinct from the unchanged server TLS offerings.

Validation

On the rebased branch (base a5850d1):

• RelWithDebInfo builds of logging, logging_cose_only, programmability and js_generic: passed.
• scripts/ci-checks.sh and diff whitespace checks: passed.
• e2e_logging_http2 and programmability_and_jwt: passed.
• e2e_logging: initial run had commit/connection timeouts; three consecutive full reruns passed unchanged. Cause not established; not claiming the initial failure was unrelated.

Earlier investigation on the original #8410 head:

• Reproduced missing client-certificate and query failures before fixing them; reproduced the disabled-verification regression before its fix.
• Independent review identified the disabled-verification case and the fix was integrated.
• Repeated logging and JWT suites passed. One intervening JWT run lost nodes to unexplained SIGKILL.
• Opt-in client_protocols TLS scan: old and new clients produced byte-for-byte identical normalized reports. Both fail the golden comparison only on missing ML-KEM groups with local OpenSSL 3.3.7; golden file unchanged.
• HTTP/2 compliance portion run separately: 147/147 passed.

Full repository runtime suite not run; broader CI remains necessary. Test infrastructure only, no product changelog entry.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Restrict the regression to HttpxClient or update alternate transports to honor disabled verification.

Review effort: Lite
Findings: None

What changed in this PR

Upgrades the e2e HTTP client stack to httpx 0.28.x while updating TLS handling and query-encoding tests.

Changes:

• Removes private httpcore integration and updates dependency constraints.
• Builds TLS contexts with client-certificate support.
• Adds TLS regression coverage and reserved-character query tests.

File	Summary
tests/​requirements.txt	Updates httpx constraints and removes the httpcore pin.
tests/​infra/​clients.py	Reworks TLS setup and client-certificate loading.
tests/​e2e_logging.py	Adds TLS/query coverage. Moderate finding (1 vote): the TLS regression may fail for alternate clients before reaching the assertion when verification is disabled.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.