fix: derive Forwarded scheme from downstream transport

[seonghobae]

Refs #51.

Writer-safe child of #86 exact 258c2cf7d1e20d01221158394a99f7bbfe47ee69. This closes the forwarding-scheme trust slice without moving product identity/auth, Keyverse, Wardnet, or EgressWeave authority into the gateway.

Verified RED

The real-wire fixture uses a CA-verified version-2 downstream TLS/HTTP/1.1 connection, deliberately supplies spoofed Forwarded and X-Forwarded-* identity, and lets a real cleartext H1 origin inspect the request emitted by the gateway. RFC 7239 §5.4 defines proto from the client-facing request and explicitly covers TLS offload, so the origin must receive Forwarded: proto=https even though the selected upstream transport is cleartext HTTP.

Initial test-only head 1150833f60472ada7c0fecc957b7b802eeb251df first exposed a hosted rustfmt-only RED. Exact formatter repair 99e2d96fc9c0a665c8d7793433c1095360b378d5 then reached the real-wire test in CI 34598294915: tls_termination_rebuilds_forwarded_scheme_from_transport_and_drops_spoofed_identity failed because the origin did not receive forwarded: proto=https. Existing production still emitted its cleartext-only proto=http constant. The run was later cancelled by the causal source update, but the semantic failure had already been emitted by the exact fixture.

Causal fix

Production repair 42992ea3daf9e367a9ad2e64c6fbb2aa4c019b4f derives one bounded gateway-owned Forwarded value from already-validated Admin Config during GatewayProxy activation: no downstream TLS -> proto=http; downstream TLS -> proto=https. upstream_request_filter strips request-controlled Forwarded, all X-Forwarded-*, and X-Real-IP, then emits only that validated transport truth. No client-IP or trusted-hop chain is synthesized. A focused unit test covers both scheme branches; the real-wire fixture proves TLS termination behavior and spoof removal.

docs/doctoring/DOWNSTREAM_TLS_HTTP2_TRACEABILITY.md was also stale at #84. Documentation-forward current exact 5868fb61e8f66dc5d79bb15a6e7887156dc7684a brings it code-current through #86/#87, adds RFC 7239 to standards/APA traceability, and leaves generic client-IP/trusted-hop semantics explicitly unclaimed. docs/product-technical-gap-baseline.md remains owned by dedicated lane #61 and was not modified.

Exact-current evidence

Current head 5868fb61e8f66dc5d79bb15a6e7887156dc7684a remains ahead-only/behind-0 from exact #86. CI 34599014435, Supply Chain 34599014384, and PgErd bounded-origin capacity 34599014304 are all terminal GREEN. CI passed formatting, the complete compile/test suite including the repaired Forwarded wire acceptance, Clippy, warnings-denied rustdoc, complete owned-production coverage, resolved dependency-lock verification, routed/loopback load-contract traffic, and both least-privilege OCI runtime profiles. Supply Chain passed dependency audit, admitted candidate builds, SPDX SBOM generation, both image scans, exact-source binding, and evidence upload. Fresh review-thread enumeration is empty. Exact-current technical COMMENT 5178684754 found no additional writer-safe source/test/documentation/DDD or authority-boundary defect and is evidence only, not independent approval.

This PR is Ready for independent governance review. The active organization ruleset still requires one approving review, resolved review threads, and central required workflows before default-branch integration. No bypass, protected merge, immutable release, canary/shadow, rollback, cutover, or legacy-removal credit is claimed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 865a78eb-f05a-4848-a831-1f2190efb46f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current technical review on 5868fb61e8f66dc5d79bb15a6e7887156dc7684a after execution. Re-read the complete three-path range: src/gateway_proxy.rs derives only proto=http|https from already-validated downstream TLS presence; sanitization still removes request-controlled Forwarded, every X-Forwarded-*, and X-Real-IP; no generic client-IP/trusted-hop authority is invented. tests/downstream_tls_forwarded_scheme_wire.rs proves a CA-verified TLS/HTTP1 downstream with spoofed proxy identity reaches the cleartext H1 origin as Forwarded: proto=https. TRACEABILITY is current through #86/#87 and leaves the dedicated product-gap baseline with #61. Exact-current CI 34599014435, Supply Chain 34599014384, and PgErd bounded-origin capacity 34599014304 are terminal GREEN; CI includes formatting, full compile/test, Clippy, warnings-denied rustdoc, complete owned-production coverage, resolved-lock verification, load-contract traffic, and least-privilege OCI runtime. Fresh review-thread enumeration is empty. No additional writer-safe source/test/documentation/DDD or authority-boundary defect found in this exact range. This COMMENT is technical evidence only and is not independent APPROVED governance credit.