SCRATCH rehearsal 766-p1-node — do not review, internal CI probe

[michael-moffett]

Scratch internal CI rehearsal branch for ticket T-DIR-P035-766-P1-NODE-CI-RERUN-2026-08-18.
Not a submission. Not upstream. Will be closed at end of run. Ignore.

[greptile-apps]

Greptile Summary

The PR makes remote datasource TLS verification secure by default while retaining an explicit opt-in for self-signed certificates.

• Propagates the opt-in through CLI, MCP, Rust SDK, and Node SDK entry points.
• Preserves TLS posture when remote clients are cloned.
• Defaults new and deserialized legacy configurations to certificate verification.
• Adds focused configuration, schema, binding, command-generation, and clone tests.

Confidence Score: 5/5

The PR appears safe to merge because certificate verification remains the default and the explicit insecure opt-in is consistently propagated.

The reviewed changes preserve existing configuration behavior, correct verified-client cloning so it no longer disables certificate checks, and introduce no concrete blocking or non-blocking defect.

Important Files Changed

Filename	Overview
crates/core/src/surfnet/remote.rs	Introduces explicit verified and insecure TLS postures, centralizes datasource construction, and preserves the selected posture during cloning.
crates/core/src/runloops/mod.rs	Applies the configured TLS posture consistently to startup and later remote-account fetches.
crates/sdk/src/surfnet.rs	Adds the SDK builder option and refactors configuration assembly without changing existing payer, airdrop, or runtime settings.
crates/mcp/src/surfpool/mod.rs	Exposes an optional, default-false MCP parameter and forwards it through command and headless startup paths.
crates/mcp/src/surfpool/start_surfnet.rs	Carries the TLS opt-in into generated CLI commands and headless SimnetConfig instances.
crates/sdk-node/src/lib.rs	Adds the optional Node configuration field and forwards it to the Rust SDK builder.
crates/types/src/types.rs	Adds a backward-compatible, serde-defaulted TLS configuration field that remains false by default.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    CLI[CLI flag] --> Config[SimnetConfig]
    MCP[MCP parameter] --> Config
    RustSDK[Rust SDK builder] --> Config
    NodeSDK[Node SDK config] --> RustSDK
    Config --> Decision{allow insecure TLS?}
    Decision -->|false| Verified[Verified datasource client]
    Decision -->|true| Insecure[Explicit insecure client]
    Verified --> CloneV[Clone preserves verified posture]
    Insecure --> CloneI[Clone preserves insecure posture]
    CloneV --> RPC[Remote datasource requests]
    CloneI --> RPC

Loading

_{Reviews (1): Last reviewed commit: "expose allow_insecure_remote_tls on the ..." | Re-trigger Greptile}