test: prove pg-erd upstream TLS trust boundary

[seonghobae]

Fixes #36.

Valid TLS delta

The generic composition root already has compiled local-CA/SNI verification, but that evidence cannot be transferred to the separate bounded pg-erd migration binary. This child adds Unix-only tests/pg_erd_local_ca_tls.rs without changing production routing/TLS code:

• matching explicit CA + backend.test SNI: characterized /api/tls must reach the TLS backend and a separate fallback request must still reach the distinct clear-text frontend authority;
• same valid CA + mismatched backend SNI: the routed backend request must fail closed as exact HTTP/1.1 502 without route failover, /readyz must remain HTTP 200, and a later fallback request must still reach frontend;
• the mismatch fixture proves the security invariant at the application-data boundary: the TLS backend must receive zero HTTP request bytes after hostname verification fails;
• downstream remains the characterized clear-text web contract. This is gateway-to-upstream TLS trust/hostname evidence only, not downstream TLS termination, certificate issuance/rotation ownership, representative TLS latency, or consumer cutover evidence.

The fixture keeps traffic/metrics listener reservations simultaneous until immediately before gateway startup, applies five-second socket I/O deadlines, caps origin request headers at 64 KiB, and parses only exact case-sensitive HTTP/1.1 three-digit status tokens. Numeric-prefix/protocol-case lookalikes are rejected. Touched helpers/tests retain purpose/constraint rustdoc.

Ordinary/non-force succession on final #33

Final parent #33 is exact df2a9bef4e99678259d1666c0262ae1cae9c4ff1 with terminal CI 34254199047, Supply Chain 34254199064, and an exact-head owner technical COMMENT reporting no actionable finding. That technical COMMENT is not independent human APPROVED governance.

Historical TLS head e6e083abc042fe79840a07c33eec09c9973f4c93 is preserved as first parent while final #33 is adopted as second parent through ordinary two-parent commit ed3e801bec9f4821b3021d86a8700a519e21e1b0. The resolution tree starts from final #33 and reapplies only the valid pg-erd TLS acceptance; no force-push, destructive rebase, stale-parent source, or predecessor receipt is replayed.

The PR base is the actual final #33 branch fix/deny-upgrades-at-peer-v1. Fresh parent→child comparison has merge base exactly df2a9bef..., behind_by=0, and four effective paths only: CHANGELOG.md, TEST_STRATEGY.md, docs/product-technical-gap-baseline.md, and tests/pg_erd_local_ca_tls.rs.

Hosted RED → minimal repair

Predecessor exact 462e1627709e37fa27184a4273410d8e91bce3cb reached real GitHub-hosted Rust 1.98.0 execution. CI 34255616052 produced GREEN routed/generic load-contract 102161033356; the test 102161033525 job passed exact checkout, native dependencies and Rust installation, then failed only at cargo fmt --all -- --check before compile/test/lint/rustdoc/coverage/lock. The runner prescribed three layout changes in tests/pg_erd_local_ca_tls.rs: one chained request read and two backend listener accept() calls.

Commit 519e0a9659e727ebf050e2238c3a592d86ede916 applies exactly those Rust 1.98.0 formatter-prescribed changes. TLS semantics, fixture timing/bounds, routing, status oracles, product/security authority, production Rust and traffic contracts are unchanged.

Documentation-only 04eeb15ca4bd5483cf7851e88a327db75cf492f2 makes docs/product-technical-gap-baseline.md code-current: final #33 is recorded as closed exact-head technical evidence, #37 is the distinct pg-erd upstream TLS trust/hostname acceptance, and representative TLS/downstream TLS/release/cutover remain explicit gaps. Mutable run IDs and head SHAs are intentionally not copied into the durable baseline.

A subsequent EOF normalization edit accidentally introduced literal diff-marker + characters into the tail of the test file on intermediate head f7f75d2d76e96dd5ce04a611fc5b875020ea36ca. The same fresh file/patch sweep caught that immediately before any GREEN credit. Test-only repair 4a57acaf0205cf202a4ef554f297e9c97ddd7f99 removes the text corruption and preserves the runner-prescribed rustfmt plus a normal terminal newline; the repaired current patch was re-read and contains no literal diff markers.

Current exact gate

Current exact head remains unchanged at 4a57acaf0205cf202a4ef554f297e9c97ddd7f99.

Exact CI 34257163107 currently has:

• load-contract 102165780357 terminal GREEN, including generic and routed pg-erd k6 traffic and exact-SHA latency evidence;
• oci-runtime 102165780170 terminal GREEN, including candidate image build, declared non-root identity and generic/pg-erd read-only least-privilege runtime;
• test 102165780450 GREEN through exact checkout, Rust 1.98.0 formatting, compile/test, strict lint, warnings-denied public rustdoc and pinned coverage-tool installation; owned-production coverage is still executing, so coverage enforcement and dependency-lock evidence are not yet credited.

Exact Supply Chain 34257163076 has GREEN exact checkout, Rust installation, pinned dependency-policy tool installation and committed dependency audit; exact candidate-image build is still executing, with SPDX SBOM, image scans, exact-source binding and evidence upload still pending.

Owner technical review 5144961823 is anchored to exact 4a57acaf... and reports no new actionable source, fixture, DDD-boundary, or documentation defect after re-reading all four effective paths. It is technical COMMENT evidence only, not independent human APPROVED governance and not a substitute for #56.

Keep Draft until this unchanged exact head closes the remaining owned-production coverage/lock and Supply Chain/SBOM/image/source-binding gates. No predecessor GREEN or partial result transfers to this exact head.

No self-approval, force-push/destructive rebase, gate weakening, protected merge, immutable release, canary/cutover, rollback or legacy-removal credit is claimed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head owner technical sweep on 4a57acaf0205cf202a4ef554f297e9c97ddd7f99 found no new actionable source, fixture, DDD-boundary, or documentation defect in the four-path parent→child delta. The pg-erd TLS fixture keeps explicit local-CA/SNI success and hostname-mismatch fail-closed behavior separate from product auth/business authority, bounds socket/header waits, preserves distinct frontend recovery, and uses exact HTTP/1.1 status parsing. CHANGELOG/TEST_STRATEGY/baseline distinguish upstream TLS acceptance from downstream TLS termination, certificate lifecycle ownership, representative TLS performance, release and cutover. The current tree was also re-read after repairing an intermediate text-edit corruption; the final fixture contains no literal diff markers and has a normal terminal newline. This COMMENT is technical evidence only, not independent human APPROVED governance; hosted CI/Supply Chain must still close on this unchanged exact head.