Background

#490 added a for_installs_strict_ssl_false_relaxes_verification unit test that asserts the client builds with strict_ssl: Some(false) but doesn't actually verify the request-time behavior — danger_accept_invalid_certs(true) is a builder toggle, and mockito only speaks HTTP, so there's no live-traffic counterpart that proves a self-signed cert is accepted (or rejected with strict_ssl: Some(true)).

A real integration test would:

1. Stand up a TLS-capable mock server with a self-signed cert. wiremock-rs with rustls support is a candidate; axum + axum-server with RustlsConfig is another. Either way the test needs to depend on rustls-pemfile or similar to load a fixture cert into the server.
2. Run two requests:
   • strict_ssl: Some(false) → expect 2xx
   • strict_ssl: Some(true) (or unset) → expect TLS handshake failure
3. The reqwest client built by ThrottledClient::for_installs would route directly (no proxy), so the integration test exercises apply_tls's danger_accept_invalid_certs branch end-to-end.

What to do

1. Pick a TLS-mock harness. Candidates: wiremock (rustls feature), axum + tokio-rustls, or a hand-rolled tokio::TcpListener + tokio_native_tls::TlsAcceptor. Prefer one that's already in the workspace dep tree or close to it.
2. Generate a fixture self-signed cert + key in crates/network/tests/fixtures/ (the existing test-ca.pem is cert-only; would need a matching test-server.{crt,key} pair).
3. Add a #[tokio::test] that stands the server up on a random port and exercises both strict_ssl branches.
4. Make the test conditional on the harness being available — if the dep is heavy, gate behind a feature flag or #[ignore] with a doc comment explaining how to run.

Out of scope

• Mocking the full pnpm tarball-download surface. This is a TLS-handshake test, not a registry test.
• Per-registry TLS interactions. Separate issue.

References

• feat(config,network,cli): TLS keys + local-address from .npmrc #490 — where the placeholder unit test lives (for_installs_strict_ssl_false_relaxes_verification in crates/network/src/tests.rs)
• Copilot comment flagging the missing live-traffic counterpart

Written by an agent (Claude Code, claude-opus-4-7).