[AAASM-3685] 🔒 (transport): Require TLS for non-loopback gateway/op-control#181

Merged

Chisanan232 merged 12 commits into

v0.0.1/AAASM-3685/transport_tls_hardening

Jun 25, 2026

Commits on Jun 25, 2026

🔒 (transport): Add shared loopback/scheme transport-security validator

Chisanan232
and
claude
committed
🔒 (op-control): Refuse plaintext gRPC channel to non-loopback gateway

Chisanan232
and
claude
committed
🔒 (gateway): Refuse Bearer API key over plaintext http to non-loopback host

Chisanan232
and
claude
committed
🔒 (transport): Add resolution-time insecure-http warning helper

Chisanan232
and
claude
committed
🔒 (assembly): Warn on resolved plaintext-http gateway with API key

Chisanan232
and
claude
committed
✅ (gateway): Opt test bearer-header check past plaintext-http refusal

Chisanan232
and
claude
committed
✅ (transport): Test loopback/scheme transport-security validator

Chisanan232
and
claude
committed
✅ (op-control): Test connect refuses plaintext gRPC to non-loopback

Chisanan232
and
claude
committed
✅ (gateway): Test Bearer-over-plaintext-http refusal and loopback allow

Chisanan232
and
claude
committed
✅ (assembly): Test plaintext-http+api-key resolution warning

Chisanan232
and
claude
committed
♻️ (test): Use GatewayClient as context manager in transport-security tests

Chisanan232
and
claude
committed
🔒 (transport_security): Drop bare http:// token from Bearer-refusal message

Chisanan232
and
claude
committed