internal CI rehearsal — datasource TLS verification (do not merge)

[michael-moffett]

Internal dress rehearsal of the target's PR checks on our own fork. Not for merge, not for review by anyone outside this org.
Will be closed when the run completes.

[greptile-apps]

Greptile Summary

The PR changes remote datasource TLS handling from unconditional certificate acceptance to verification by default, with an explicit opt-in for self-signed certificates.

• Adds and propagates the --allow-insecure-remote-tls CLI/config option.
• Centralizes datasource-client TLS selection across startup and remote-account fetching.
• Preserves each client's TLS posture when cloning.
• Adds tests for secure defaults, opt-in behavior, clone behavior, URL preservation, and backward-compatible config deserialization.

Confidence Score: 5/5

The PR appears safe to merge because no concrete changed-code failure remains after reviewing TLS selection, configuration propagation, and clone behavior.

Certificate verification is now the default, the insecure path requires an explicit operator opt-in, both datasource construction paths consume that setting, clones preserve the selected posture, and older serialized configurations default safely.

Important Files Changed

Filename	Overview
crates/cli/src/cli/mod.rs	Adds the explicit insecure-TLS CLI opt-in and copies it into the generated simulation configuration.
crates/core/src/runloops/mod.rs	Applies the configured TLS posture consistently when constructing startup and remote-account datasource clients.
crates/core/src/surfnet/remote.rs	Introduces centralized verified/insecure construction, preserves TLS posture across clones, and adds focused regression tests.
crates/types/src/types.rs	Adds a backward-compatible, secure-by-default TLS configuration field and verifies legacy deserialization behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[CLI or serialized SimnetConfig] --> B{offline_mode?}
    B -- Yes --> C[No startup datasource client]
    B -- No --> D{allow_insecure_remote_tls?}
    D -- False --> E[Verified SurfnetRemoteClient]
    D -- True --> F[Insecure SurfnetRemoteClient]
    E --> G[Clone preserves verified posture]
    F --> H[Clone preserves insecure posture]
    A --> I[FetchRemoteAccounts]
    I --> D

Loading

_{Reviews (1): Last reviewed commit: "fix(cli,core,types): verify datasource T..." | Re-trigger Greptile}

[michael-moffett]

internal rehearsal complete; closing