SCRATCH rehearsal 766-p1 — do not review, internal CI probe

[michael-moffett]

Scratch internal CI rehearsal branch for ticket T-DIR-P035-766-P1-CI-RERUN-2026-08-18. Not a submission. Not upstream. Will be closed at end of run. Ignore.

[greptile-apps]

Greptile Summary

The PR changes remote datasource connections to verify TLS certificates by default while retaining invalid-certificate support behind an explicit opt-in.

• Adds the allow_insecure_remote_tls option to CLI, SDK, MCP, and serialized simnet configuration.
• Centralizes verified versus insecure datasource-client construction and preserves the selected TLS posture when clients are cloned.
• Propagates the option through initial datasource setup, remote account hydration, generated MCP commands, and headless startup.
• Adds tests covering secure defaults, backward-compatible deserialization, option propagation, generated commands, and clone behavior.

Confidence Score: 5/5

The PR appears safe to merge, with certificate verification enabled by default and insecure TLS retained only through an explicit, consistently propagated opt-in.

The changed entry points, configuration types, runloops, and remote-client cloning preserve a single TLS posture end to end, and no concrete build, runtime, compatibility, or security failure remains reachable in the reviewed paths.

Important Files Changed

Filename	Overview
crates/core/src/surfnet/remote.rs	Centralizes datasource TLS posture, defaults to certificate verification, and preserves that posture across client clones.
crates/core/src/runloops/mod.rs	Applies the configured TLS posture consistently to initial datasource access and startup account hydration.
crates/cli/src/cli/mod.rs	Adds a false-by-default, explicitly documented CLI opt-in and propagates it into SimnetConfig.
crates/sdk/src/surfnet.rs	Exposes the TLS opt-in through SurfnetBuilder while preserving existing builder configuration semantics.
crates/mcp/src/surfpool/mod.rs	Adds a backward-compatible optional MCP parameter and forwards it through command and headless startup paths.
crates/mcp/src/surfpool/start_surfnet.rs	Carries the TLS choice into generated CLI commands and embedded SimnetConfig instances.
crates/types/src/types.rs	Adds the serialized TLS setting with a secure default for both new and legacy configurations.

Sequence Diagram

sequenceDiagram
    actor Operator
    participant Entry as CLI / SDK / MCP
    participant Config as SimnetConfig
    participant Runloop
    participant Client as SurfnetRemoteClient
    participant Remote as Datasource RPC
    Operator->>Entry: Configure datasource and TLS opt-in
    Entry->>Config: allow_insecure_remote_tls
    Config->>Runloop: Start surfnet
    Runloop->>Client: for_datasource(url, opt-in)
    alt opt-in is false
        Client->>Remote: TLS connection with certificate verification
    else opt-in is true
        Client->>Remote: TLS connection accepting invalid certificates
    end

Loading

_{Reviews (1): Last reviewed commit: "test: the start_surfnet tool advertises ..." | Re-trigger Greptile}