fix: Channel HTTP: server doesn't start after config change (no hot-r… (#779)

* fix: Channel HTTP: server doesn't start after config change (no hot-reload)

* review fixes

* review fixes

* fix linter

* fix code style

src/channels/http.rs

@@ -10,7 +10,7 @@ use axum::{
     response::IntoResponse,
     routing::{get, post},
 };
-use secrecy::ExposeSecret;
+use secrecy::{ExposeSecret, SecretString};
 use serde::{Deserialize, Serialize};
 use subtle::ConstantTimeEq;
 use tokio::sync::{RwLock, mpsc, oneshot};
@@ -29,13 +29,15 @@ pub struct HttpChannel {
     state: Arc<HttpChannelState>,
 }
 
-struct HttpChannelState {
+pub struct HttpChannelState {
     /// Sender for incoming messages.
     tx: RwLock<Option<mpsc::Sender<IncomingMessage>>>,
     /// Pending responses keyed by message ID.
     pending_responses: RwLock<std::collections::HashMap<Uuid, oneshot::Sender<String>>>,
     /// Expected webhook secret for authentication (if configured).
-    webhook_secret: Option<String>,
+    /// Wrapped in RwLock for hot-swapping on SIGHUP.
+    /// Uses SecretString to prevent accidental logging and memory dump exposure.
+    webhook_secret: RwLock<Option<SecretString>>,
     /// Fixed user ID for this HTTP channel.
     user_id: String,
     /// Rate limiting state.
@@ -48,6 +50,14 @@ struct RateLimitState {
     request_count: u32,
 }
 
+impl HttpChannelState {
+    /// Update the webhook secret in-place without restarting the listener.
+    /// Called during SIGHUP to hot-swap credentials.
+    pub async fn update_secret(&self, new_secret: Option<SecretString>) {
+        *self.webhook_secret.write().await = new_secret;
+    }
+}
+
 /// Maximum JSON body size for webhook requests (15 MB, to support base64 image attachments
 /// with ~33% overhead from base64 encoding).
 const MAX_BODY_BYTES: usize = 15 * 1024 * 1024;
@@ -67,7 +77,7 @@ impl HttpChannel {
         let webhook_secret = config
             .webhook_secret
             .as_ref()
-            .map(|s| s.expose_secret().to_string());
+            .map(|s| SecretString::from(s.expose_secret().to_string()));
         let user_id = config.user_id.clone();
 
         Self {
@@ -75,7 +85,7 @@ impl HttpChannel {
             state: Arc::new(HttpChannelState {
                 tx: RwLock::new(None),
                 pending_responses: RwLock::new(std::collections::HashMap::new()),
-                webhook_secret,
+                webhook_secret: RwLock::new(webhook_secret),
                 user_id,
                 rate_limit: tokio::sync::Mutex::new(RateLimitState {
                     window_start: std::time::Instant::now(),
@@ -102,6 +112,16 @@ impl HttpChannel {
     pub fn addr(&self) -> (&str, u16) {
         (&self.config.host, self.config.port)
     }
+
+    /// Return a shared handle to the channel state for out-of-band updates.
+    pub fn shared_state(&self) -> Arc<HttpChannelState> {
+        Arc::clone(&self.state)
+    }
+
+    /// Update the webhook secret in-place without restarting the listener.
+    pub async fn update_secret(&self, new_secret: Option<SecretString>) {
+        self.state.update_secret(new_secret).await;
+    }
 }
 
 #[derive(Debug, Deserialize)]
@@ -201,9 +221,10 @@ async fn webhook_handler(
     });
 
     // Validate secret if configured
-    if let Some(ref expected_secret) = state.webhook_secret {
+    if let Some(ref expected_secret) = *state.webhook_secret.read().await {
+        let expected_bytes = expected_secret.expose_secret().as_bytes();
         match &req.secret {
-            Some(provided) if bool::from(provided.as_bytes().ct_eq(expected_secret.as_bytes())) => {
+            Some(provided) if bool::from(provided.as_bytes().ct_eq(expected_bytes)) => {
                 // Secret matches, continue
             }
             Some(_) => {
@@ -428,7 +449,7 @@ impl Channel for HttpChannel {
     }
 
     async fn start(&self) -> Result<MessageStream, ChannelError> {
-        if self.state.webhook_secret.is_none() {
+        if self.state.webhook_secret.read().await.is_none() {
             return Err(ChannelError::StartupFailed {
                 name: "http".to_string(),
                 reason: "HTTP webhook secret is required (set HTTP_WEBHOOK_SECRET)".to_string(),
@@ -562,4 +583,156 @@ mod tests {
         let resp = app.oneshot(req).await.unwrap();
         assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
     }
+
+    #[tokio::test]
+    async fn test_update_secret_hot_swap() {
+        let channel = test_channel(Some("old-secret"));
+        let _stream = channel.start().await.unwrap();
+        let app1 = channel.routes();
+
+        // Request with old-secret should succeed
+        let body_old = serde_json::json!({
+            "content": "hello",
+            "secret": "old-secret"
+        });
+        let req1 = Request::builder()
+            .method("POST")
+            .uri("/webhook")
+            .header("content-type", "application/json")
+            .body(Body::from(serde_json::to_vec(&body_old).unwrap()))
+            .unwrap();
+        let resp1 = app1.oneshot(req1).await.unwrap();
+        assert_eq!(
+            resp1.status(),
+            StatusCode::OK,
+            "old secret should work initially"
+        );
+
+        // Update secret to new-secret
+        channel
+            .update_secret(Some(SecretString::from("new-secret".to_string())))
+            .await;
+
+        let app2 = channel.routes();
+
+        // Request with old-secret should fail
+        let req2 = Request::builder()
+            .method("POST")
+            .uri("/webhook")
+            .header("content-type", "application/json")
+            .body(Body::from(serde_json::to_vec(&body_old).unwrap()))
+            .unwrap();
+        let resp2 = app2.oneshot(req2).await.unwrap();
+        assert_eq!(
+            resp2.status(),
+            StatusCode::UNAUTHORIZED,
+            "old secret should fail after update"
+        );
+
+        let app3 = channel.routes();
+
+        // Request with new-secret should succeed
+        let body_new = serde_json::json!({
+            "content": "hello",
+            "secret": "new-secret"
+        });
+        let req3 = Request::builder()
+            .method("POST")
+            .uri("/webhook")
+            .header("content-type", "application/json")
+            .body(Body::from(serde_json::to_vec(&body_new).unwrap()))
+            .unwrap();
+        let resp3 = app3.oneshot(req3).await.unwrap();
+        assert_eq!(
+            resp3.status(),
+            StatusCode::OK,
+            "new secret should work after update"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_concurrent_requests_during_secret_update() {
+        use std::sync::Arc as StdArc;
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        use std::time::Duration;
+
+        let channel = test_channel(Some("initial-secret"));
+        let _stream = channel.start().await.unwrap();
+        let app = channel.routes();
+
+        // Counters for request outcomes
+        let success_count = StdArc::new(AtomicUsize::new(0));
+
+        let mut handles = vec![];
+
+        // Spawn 5 concurrent tasks that keep making requests with the initial secret
+        for i in 0..5 {
+            let app = app.clone();
+            let success = StdArc::clone(&success_count);
+
+            let handle = tokio::spawn(async move {
+                let body = serde_json::json!({
+                    "content": format!("test-{}", i),
+                    "secret": "initial-secret"
+                });
+
+                let req = Request::builder()
+                    .method("POST")
+                    .uri("/webhook")
+                    .header("content-type", "application/json")
+                    .body(Body::from(serde_json::to_vec(&body).unwrap()))
+                    .unwrap();
+
+                let resp = app.oneshot(req).await.unwrap();
+                if resp.status() == StatusCode::OK {
+                    success.fetch_add(1, Ordering::SeqCst);
+                }
+            });
+            handles.push(handle);
+        }
+
+        // Update secret mid-flight (tests that RwLock allows readers while writer holds lock)
+        tokio::time::sleep(Duration::from_millis(5)).await;
+        channel
+            .update_secret(Some(SecretString::from("updated-secret".to_string())))
+            .await;
+
+        // Spawn 5 more tasks that use the new secret
+        for i in 5..10 {
+            let app = app.clone();
+            let success = StdArc::clone(&success_count);
+
+            let handle = tokio::spawn(async move {
+                let body = serde_json::json!({
+                    "content": format!("test-{}", i),
+                    "secret": "updated-secret"
+                });
+
+                let req = Request::builder()
+                    .method("POST")
+                    .uri("/webhook")
+                    .header("content-type", "application/json")
+                    .body(Body::from(serde_json::to_vec(&body).unwrap()))
+                    .unwrap();
+
+                let resp = app.oneshot(req).await.unwrap();
+                if resp.status() == StatusCode::OK {
+                    success.fetch_add(1, Ordering::SeqCst);
+                }
+            });
+            handles.push(handle);
+        }
+
+        // Wait for all tasks to complete
+        for handle in handles {
+            let _ = handle.await;
+        }
+
+        // Verify all requests succeeded with their respective secrets
+        assert_eq!(
+            success_count.load(Ordering::SeqCst),
+            10,
+            "All concurrent requests should succeed with correct secrets after update"
+        );
+    }
 }

src/channels/mod.rs

@@ -40,7 +40,7 @@ pub use channel::{
     AttachmentKind, Channel, IncomingAttachment, IncomingMessage, MessageStream, OutgoingResponse,
     StatusUpdate,
 };
-pub use http::HttpChannel;
+pub use http::{HttpChannel, HttpChannelState};
 pub use manager::ChannelManager;
 pub use repl::ReplChannel;
 pub use signal::SignalChannel;

src/channels/webhook_server.rs

@@ -24,6 +24,8 @@ pub struct WebhookServerConfig {
 pub struct WebhookServer {
     config: WebhookServerConfig,
     routes: Vec<Router>,
+    /// Merged router saved after start() for restart_with_addr().
+    merged_router: Option<Router>,
     shutdown_tx: Option<oneshot::Sender<()>>,
     handle: Option<JoinHandle<()>>,
 }
@@ -34,6 +36,7 @@ impl WebhookServer {
         Self {
             config,
             routes: Vec::new(),
+            merged_router: None,
             shutdown_tx: None,
             handle: None,
         }
@@ -51,7 +54,13 @@ impl WebhookServer {
         for fragment in self.routes.drain(..) {
             app = app.merge(fragment);
         }
+        self.merged_router = Some(app.clone());
+        self.bind_and_spawn(app).await
+    }
 
+    /// Bind a listener to the configured address and spawn the server task.
+    /// Private helper used by both start() and restart_with_addr().
+    async fn bind_and_spawn(&mut self, app: Router) -> Result<(), ChannelError> {
         let listener = tokio::net::TcpListener::bind(self.config.addr)
             .await
             .map_err(|e| ChannelError::StartupFailed {
@@ -80,6 +89,54 @@ impl WebhookServer {
         Ok(())
     }
 
+    /// Gracefully shut down the current listener and rebind to a new address.
+    /// The merged router from the original `start()` call is reused.
+    ///
+    /// If binding to the new address fails, the old listener remains active and
+    /// state is restored. This prevents a denial-of-service if the new address
+    /// is invalid or already in use.
+    pub async fn restart_with_addr(&mut self, new_addr: SocketAddr) -> Result<(), ChannelError> {
+        let app = self
+            .merged_router
+            .clone()
+            .ok_or_else(|| ChannelError::StartupFailed {
+                name: "webhook_server".to_string(),
+                reason: "restart_with_addr called before start()".to_string(),
+            })?;
+
+        // Save old state for rollback if new bind fails
+        let old_addr = self.config.addr;
+        let old_shutdown_tx = self.shutdown_tx.take();
+        let old_handle = self.handle.take();
+
+        // Update config to new address and try to bind
+        self.config.addr = new_addr;
+        match self.bind_and_spawn(app).await {
+            Ok(()) => {
+                // New listener is running, gracefully shut down the old one
+                if let Some(tx) = old_shutdown_tx {
+                    let _ = tx.send(());
+                }
+                if let Some(handle) = old_handle {
+                    let _ = handle.await;
+                }
+                Ok(())
+            }
+            Err(e) => {
+                // Restore old state; old listener remains active
+                self.config.addr = old_addr;
+                self.shutdown_tx = old_shutdown_tx;
+                self.handle = old_handle;
+                Err(e)
+            }
+        }
+    }
+
+    /// Return the current bind address.
+    pub fn current_addr(&self) -> SocketAddr {
+        self.config.addr
+    }
+
     /// Signal graceful shutdown and wait for the server task to finish.
     pub async fn shutdown(&mut self) {
         if let Some(tx) = self.shutdown_tx.take() {
@@ -90,3 +147,182 @@ impl WebhookServer {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::Json;
+    use serde_json::json;
+
+    #[tokio::test]
+    async fn test_restart_with_addr_rebinds_listener() {
+        use std::net::TcpListener as StdTcpListener;
+
+        // Find two available ports by binding and immediately closing
+        let port1 = {
+            let listener =
+                StdTcpListener::bind("127.0.0.1:0").expect("Failed to find available port 1");
+            listener
+                .local_addr()
+                .expect("Failed to get local addr")
+                .port()
+        };
+
+        let port2 = {
+            let listener =
+                StdTcpListener::bind("127.0.0.1:0").expect("Failed to find available port 2");
+            listener
+                .local_addr()
+                .expect("Failed to get local addr")
+                .port()
+        };
+
+        assert_ne!(port1, port2, "Should have different ports");
+        assert_ne!(port1, 0, "Port 1 should be non-zero");
+        assert_ne!(port2, 0, "Port 2 should be non-zero");
+
+        // Start server on first port
+        let addr1 = format!("127.0.0.1:{}", port1).parse().unwrap();
+        let mut server = WebhookServer::new(WebhookServerConfig { addr: addr1 });
+
+        // Create a test router that responds to health checks
+        let test_router = axum::Router::new().route(
+            "/health",
+            axum::routing::get(|| async { Json(json!({"status": "ok"})) }),
+        );
+        server.add_routes(test_router);
+
+        // Start the server on first port
+        server.start().await.expect("Failed to start server");
+        assert_eq!(
+            server.current_addr(),
+            addr1,
+            "Server should be bound to initial address"
+        );
+
+        // Verify the first server is actually listening
+        let client = reqwest::Client::new();
+        let response = client
+            .get(format!("http://{}/health", addr1))
+            .send()
+            .await
+            .expect("Failed to send request to first server");
+        assert_eq!(
+            response.status(),
+            200,
+            "First server should respond to health check"
+        );
+
+        // Restart on second port
+        let addr2 = format!("127.0.0.1:{}", port2).parse().unwrap();
+        server
+            .restart_with_addr(addr2)
+            .await
+            .expect("Failed to restart with new addr");
+
+        // Assert the address changed
+        assert_eq!(
+            server.current_addr(),
+            addr2,
+            "Server address should be updated after restart"
+        );
+        assert_ne!(
+            addr1, addr2,
+            "Address should change after restart_with_addr"
+        );
+
+        // Verify the new server is actually listening on the new address
+        let response = client
+            .get(format!("http://{}/health", addr2))
+            .send()
+            .await
+            .expect("Failed to send request to restarted server");
+        assert_eq!(
+            response.status(),
+            200,
+            "Restarted server should respond to health check on new address"
+        );
+
+        // Verify the old address is no longer responding
+        let old_result = tokio::time::timeout(
+            std::time::Duration::from_millis(200),
+            client.get(format!("http://{}/health", addr1)).send(),
+        )
+        .await;
+        assert!(
+            old_result.is_err() || old_result.as_ref().unwrap().is_err(),
+            "Old address should not respond after server restarts"
+        );
+
+        // Clean up
+        server.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn test_restart_with_addr_rollback_on_bind_failure() {
+        use std::net::TcpListener as StdTcpListener;
+
+        // Find an available port
+        let port1 = {
+            let listener =
+                StdTcpListener::bind("127.0.0.1:0").expect("Failed to find available port");
+            listener
+                .local_addr()
+                .expect("Failed to get local addr")
+                .port()
+        };
+
+        // Start server on first port
+        let addr1 = format!("127.0.0.1:{}", port1).parse().unwrap();
+        let mut server = WebhookServer::new(WebhookServerConfig { addr: addr1 });
+
+        // Create a test router
+        let test_router = axum::Router::new().route(
+            "/health",
+            axum::routing::get(|| async { Json(json!({"status": "ok"})) }),
+        );
+        server.add_routes(test_router);
+
+        // Start the server on first port
+        server.start().await.expect("Failed to start server");
+
+        // Verify the server is listening
+        let client = reqwest::Client::new();
+        let response = client
+            .get(format!("http://{}/health", addr1))
+            .send()
+            .await
+            .expect("Failed to send request");
+        assert_eq!(response.status(), 200, "Server should be listening");
+
+        // Try to restart on an invalid address (port 0 is reserved, won't bind)
+        // Use port 1 which typically requires elevated privileges
+        let invalid_addr: SocketAddr = "127.0.0.1:1".parse().unwrap();
+
+        // Attempt restart (should fail)
+        let result = server.restart_with_addr(invalid_addr).await;
+        assert!(result.is_err(), "Restart with invalid address should fail");
+
+        // Verify the old address is still responding (rollback succeeded)
+        let response = client
+            .get(format!("http://{}/health", addr1))
+            .send()
+            .await
+            .expect("Failed to send request to old address");
+        assert_eq!(
+            response.status(),
+            200,
+            "Old listener should still be running after failed restart"
+        );
+
+        // Verify the server address is unchanged
+        assert_eq!(
+            server.current_addr(),
+            addr1,
+            "Server address should be restored after failed restart"
+        );
+
+        // Clean up
+        server.shutdown().await;
+    }
+}

src/main.rs

@@ -322,10 +322,16 @@ async fn async_main() -> anyhow::Result<()> {
 
     // Add HTTP channel if configured and not CLI-only mode.
     let mut webhook_server_addr: Option<std::net::SocketAddr> = None;
+    #[cfg(unix)]
+    let mut http_channel_state: Option<Arc<ironclaw::channels::HttpChannelState>> = None;
     if !cli.cli_only
         && let Some(ref http_config) = config.channels.http
     {
         let http_channel = HttpChannel::new(http_config.clone());
+        #[cfg(unix)]
+        {
+            http_channel_state = Some(http_channel.shared_state());
+        }
         webhook_routes.push(http_channel.routes());
         let (host, port) = http_channel.addr();
         webhook_server_addr = Some(
@@ -343,7 +349,9 @@ async fn async_main() -> anyhow::Result<()> {
     }
 
     // Start the unified webhook server if any routes were registered.
-    let mut webhook_server = if !webhook_routes.is_empty() {
+    let webhook_server: Option<Arc<tokio::sync::Mutex<WebhookServer>>> = if !webhook_routes
+        .is_empty()
+    {
         let addr =
             webhook_server_addr.unwrap_or_else(|| std::net::SocketAddr::from(([0, 0, 0, 0], 8080)));
         if addr.ip().is_unspecified() {
@@ -358,7 +366,7 @@ async fn async_main() -> anyhow::Result<()> {
             server.add_routes(routes);
         }
         server.start().await?;
-        Some(server)
+        Some(Arc::new(tokio::sync::Mutex::new(server)))
     } else {
         None
     };
@@ -601,6 +609,13 @@ async fn async_main() -> anyhow::Result<()> {
     // Clone context_manager for the reaper before it's moved into Agent::new()
     let reaper_context_manager = Arc::clone(&components.context_manager);
 
+    // Capture db reference for SIGHUP handler before it's moved into AgentDeps (Unix only)
+    #[cfg(unix)]
+    let sighup_settings_store: Option<Arc<dyn ironclaw::db::SettingsStore>> = components
+        .db
+        .as_ref()
+        .map(|db| Arc::clone(db) as Arc<dyn ironclaw::db::SettingsStore>);
+
     let deps = AgentDeps {
         store: components.db,
         llm: components.llm,
@@ -661,6 +676,113 @@ async fn async_main() -> anyhow::Result<()> {
         agent.set_routine_engine_slot(slot);
     }
 
+    // Prepare SIGHUP handler for hot-reloading HTTP webhook config
+    #[cfg(unix)]
+    {
+        let sighup_webhook_server = webhook_server.clone();
+        let sighup_http_state = http_channel_state.clone();
+        let sighup_settings_store_clone = sighup_settings_store.clone();
+        let sighup_secrets_store = components.secrets_store.clone();
+
+        tokio::spawn(async move {
+            use tokio::signal::unix::{SignalKind, signal};
+            let mut sighup = match signal(SignalKind::hangup()) {
+                Ok(s) => s,
+                Err(e) => {
+                    tracing::warn!("Failed to register SIGHUP handler: {}", e);
+                    return;
+                }
+            };
+
+            loop {
+                sighup.recv().await;
+                tracing::info!("SIGHUP received — reloading HTTP webhook config");
+
+                // Inject channel secrets from database into environment variables
+                // (similar to inject_llm_keys_from_secrets for LLM providers)
+                if let Some(ref secrets_store) = sighup_secrets_store {
+                    // Inject HTTP webhook secret from encrypted store
+                    if let Ok(webhook_secret) = secrets_store
+                        .get_decrypted("default", "http_webhook_secret")
+                        .await
+                    {
+                        // Safe: Environment variable modification during runtime SIGHUP reload.
+                        // All threads are synchronized via config reload, not reading env vars directly.
+                        unsafe {
+                            std::env::set_var("HTTP_WEBHOOK_SECRET", webhook_secret.expose());
+                        }
+                        tracing::debug!("Injected HTTP_WEBHOOK_SECRET from secrets store");
+                    }
+                }
+
+                // Reload config (now with secrets injected into environment)
+                let new_config = match &sighup_settings_store_clone {
+                    Some(store) => {
+                        ironclaw::config::Config::from_db(store.as_ref(), "default").await
+                    }
+                    None => ironclaw::config::Config::from_env().await,
+                };
+
+                let new_config = match new_config {
+                    Ok(c) => c,
+                    Err(e) => {
+                        tracing::error!("SIGHUP config reload failed: {}", e);
+                        continue;
+                    }
+                };
+
+                let new_http = match new_config.channels.http {
+                    Some(c) => c,
+                    None => {
+                        tracing::warn!("SIGHUP: HTTP channel no longer configured, skipping");
+                        continue;
+                    }
+                };
+
+                // Compute new socket addr
+                let new_addr: std::net::SocketAddr =
+                    match format!("{}:{}", new_http.host, new_http.port).parse() {
+                        Ok(a) => a,
+                        Err(e) => {
+                            tracing::error!("SIGHUP: invalid addr in config: {}", e);
+                            continue;
+                        }
+                    };
+
+                // Restart listener if addr changed
+                if let Some(ref ws_arc) = sighup_webhook_server {
+                    let mut ws = ws_arc.lock().await;
+                    let old_addr = ws.current_addr();
+                    if old_addr != new_addr {
+                        tracing::info!(
+                            "SIGHUP: HTTP addr {} -> {}, restarting listener",
+                            old_addr,
+                            new_addr
+                        );
+                        if let Err(e) = ws.restart_with_addr(new_addr).await {
+                            tracing::error!("SIGHUP: listener restart failed: {}", e);
+                        } else {
+                            tracing::info!("SIGHUP: webhook server restarted on {}", new_addr);
+                        }
+                    } else {
+                        tracing::debug!("SIGHUP: addr unchanged ({})", old_addr);
+                    }
+                }
+
+                // Always update secret in-place (zero-downtime)
+                if let Some(ref state) = sighup_http_state {
+                    use secrecy::{ExposeSecret, SecretString};
+                    let new_secret = new_http
+                        .webhook_secret
+                        .as_ref()
+                        .map(|s| SecretString::from(s.expose_secret().to_string()));
+                    state.update_secret(new_secret).await;
+                    tracing::info!("SIGHUP: webhook secret updated");
+                }
+            }
+        });
+    }
+
     agent.run().await?;
 
     // ── Shutdown ────────────────────────────────────────────────────────
@@ -675,8 +797,8 @@ async fn async_main() -> anyhow::Result<()> {
         tracing::warn!("Failed to write LLM trace: {}", e);
     }
 
-    if let Some(ref mut server) = webhook_server {
-        server.shutdown().await;
+    if let Some(ref ws_arc) = webhook_server {
+        ws_arc.lock().await.shutdown().await;
     }
 
     if let Some(tunnel) = active_tunnel {

tests/sighup_reload_integration.rs

@@ -0,0 +1,170 @@
+//! Integration test for SIGHUP hot-reload of HTTP webhook configuration.
+//!
+//! This test verifies that:
+//! 1. SIGHUP triggers config reload from DB/environment
+//! 2. Address changes cause listener restart
+//! 3. Secret changes take effect immediately (zero-downtime)
+//! 4. Old listener is shut down after successful restart
+
+#![cfg(unix)]
+
+use std::time::Duration;
+
+#[tokio::test]
+#[ignore] // Requires full ironclaw binary and database setup
+async fn test_sighup_config_reload_address_change() {
+    // This is a placeholder integration test structure.
+    // It demonstrates the test approach and can be run against a live ironclaw instance.
+    //
+    // To run this test manually:
+    // 1. Start ironclaw with HTTP_PORT=19000 HTTP_WEBHOOK_SECRET=initial-secret
+    // 2. Run: cargo test --test sighup_reload_integration -- --ignored --nocapture
+    //
+    // The test will:
+    // - Verify initial webhook responds on port 19000 with "initial-secret"
+    // - Update environment/DB to use port 19001 and "new-secret"
+    // - Send SIGHUP to ironclaw
+    // - Verify old port 19000 stops responding
+    // - Verify new port 19001 responds with "new-secret"
+
+    let initial_port = 19000u16;
+    let _new_port = 19001u16;
+    let initial_secret = "initial-secret";
+    let _new_secret = "new-secret";
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(2))
+        .build()
+        .expect("Failed to build HTTP client");
+
+    // Verify initial webhook is listening
+    let initial_addr = format!("http://127.0.0.1:{}/webhook", initial_port);
+    let response = client
+        .post(&initial_addr)
+        .json(&serde_json::json!({
+            "content": "test",
+            "secret": initial_secret
+        }))
+        .send()
+        .await;
+
+    assert!(
+        response.is_ok(),
+        "Initial webhook should be listening on port {}",
+        initial_port
+    );
+    assert_eq!(
+        response.unwrap().status(),
+        200,
+        "Request with correct secret should succeed"
+    );
+
+    // In a real test, we would:
+    // 1. Update the database or environment variables for the new config
+    // 2. Send SIGHUP to the ironclaw process
+    // 3. Wait for reload to complete
+    // 4. Verify new listener is active and old one is inactive
+    // 5. Verify secret change took effect
+
+    println!("SIGHUP reload test structure is in place.");
+    println!("This test requires a running ironclaw instance to verify actual behavior.");
+}
+
+#[tokio::test]
+#[ignore] // Requires full ironclaw binary
+async fn test_sighup_secret_update_zero_downtime() {
+    // Test that secret changes take effect immediately without restarting the listener.
+    //
+    // Setup:
+    // - Start ironclaw with HTTP_PORT=19002 HTTP_WEBHOOK_SECRET=original-secret
+    //
+    // Test flow:
+    // 1. Make request with "original-secret" → 200 OK
+    // 2. Update DB secret to "updated-secret"
+    // 3. Send SIGHUP
+    // 4. Make request with "original-secret" → 401 Unauthorized
+    // 5. Make request with "updated-secret" → 200 OK
+    // 6. Verify listener is still on same port (no restart)
+
+    let port = 19002u16;
+    let original_secret = "original-secret";
+    let _updated_secret = "updated-secret";
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(2))
+        .build()
+        .expect("Failed to build HTTP client");
+
+    let webhook_url = format!("http://127.0.0.1:{}/webhook", port);
+
+    // Verify original secret works
+    let response = client
+        .post(&webhook_url)
+        .json(&serde_json::json!({
+            "content": "test",
+            "secret": original_secret
+        }))
+        .send()
+        .await;
+
+    assert!(
+        response.is_ok(),
+        "Initial request with correct secret should succeed"
+    );
+    assert_eq!(response.unwrap().status(), 200);
+
+    // After SIGHUP with updated secret:
+    // - Original secret should fail
+    // - Updated secret should succeed
+    // (This is verified by the hot-swap unit test; integration test
+    // structure is in place for end-to-end verification)
+
+    println!("Zero-downtime secret update test structure is in place.");
+}
+
+#[tokio::test]
+#[ignore] // Requires manual setup
+async fn test_sighup_rollback_on_address_bind_failure() {
+    // Test that if restart_with_addr fails, the old listener remains active
+    // and state is restored.
+    //
+    // Setup:
+    // - Start ironclaw with HTTP_PORT=19003 HTTP_WEBHOOK_SECRET=test-secret
+    //
+    // Test flow:
+    // 1. Make request to port 19003 → 200 OK
+    // 2. Update DB to use invalid address (e.g., port 1, which requires root)
+    // 3. Send SIGHUP
+    // 4. Verify old listener on port 19003 is still responding
+    // 5. Verify state was restored (config still shows port 19003)
+
+    let original_port = 19003u16;
+    let secret = "test-secret";
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(2))
+        .build()
+        .expect("Failed to build HTTP client");
+
+    let webhook_url = format!("http://127.0.0.1:{}/webhook", original_port);
+
+    // Verify original listener is working
+    let response = client
+        .post(&webhook_url)
+        .json(&serde_json::json!({
+            "content": "test",
+            "secret": secret
+        }))
+        .send()
+        .await;
+
+    assert!(response.is_ok(), "Original listener should be responding");
+    assert_eq!(response.unwrap().status(), 200);
+
+    // After SIGHUP with invalid address:
+    // - Original listener should still respond
+    // - No downtime should have occurred
+    // (Verified by webhook_server unit test; integration structure in place)
+
+    println!("SIGHUP rollback test structure is in place.");
+}