fix(io): validate server TLS FIPS compliance

[aqian01]

Summary

• Add shared client/server TLS FIPS validation helpers in saluki-tls.
• Validate IPC client/server TLS configs and HTTP server TLS configs before serving.
• Add fallible self-signed TLS builder variants for API builders.

Fixes #1910

Testing

Unit tests

[pr-commenter]

Binary Size Analysis (Agent Data Plane)

Baseline: 6860990 · Comparison: 0bef301 · diff
Analysis Configuration: stripped binaries · Pass/Fail Threshold: +5%
Sizes: 40.48 MiB (baseline) vs 40.52 MiB (comparison)
Size Change: +44.91 KiB (+0.11%)

✅ Binary size difference within threshold

Changes by Module

Module	File Size	Symbols
figment	+40.76 KiB	194
serde_json	-7.66 KiB	150
serde_core	+7.56 KiB	397
anon.60ac4bcae015a9609972edcdca639b3b.1.llvm.2935971484734148233	-7.55 KiB	1
anon.058104e7c5e17815cc397c51159e7bb6.17.llvm.5917434062816465002	+7.54 KiB	1
anon.3015a67249c97e7be245550373800190.8.llvm.1255512461083497172	-4.39 KiB	1
anon.7e7e0dac8a0d3502438f43789a3c7bd2.242.llvm.17903347727370837858	+4.39 KiB	1
bytes	-4.35 KiB	35
anon.e483e132d776eb8442672bf60522c699.792.llvm.7778877363241912539	+3.71 KiB	1
anon.91ae4b17ba2fe0e59c3e749e1bd4209b.3.llvm.4766316480766188126	-3.71 KiB	1
futures_channel	+3.55 KiB	53
anyhow	+3.26 KiB	815
[Unmapped]	-3.14 KiB	1
tokio_rustls	+3.08 KiB	9
anon.80a84f9759beeb40830337c0ccfaa221.373.llvm.12057969949507315138	-2.98 KiB	1
anon.ecb2310ec29f4df3377ba63c8e8a6064.363.llvm.8335614251879647448	+2.98 KiB	1
anon.75571037cd0723bbe125d64ea26c3745.2.llvm.6756009048372103969	+2.96 KiB	1
anon.286206aeea79a865cad7926d6839b7a2.2.llvm.15165086171491752223	-2.96 KiB	1
anon.265145364ac9183ae9d58dbe66c06932.685.llvm.18011210454701615218	+2.93 KiB	1
h2	+2.90 KiB	269

Detailed Symbol Changes

    FILE SIZE        VM SIZE    
 --------------  -------------- 
  +0.4% +45.1Ki  +0.5% +35.3Ki    [21688 Others]
  [NEW] +39.4Ki  [NEW] +39.3Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::h918965bf68a9c86d
  [NEW] +29.7Ki  [NEW] +29.6Ki    agent_data_plane::cli::dogstatsd::handle_dogstatsd_command::_{{closure}}::hd0e8ea2018a4b016
  [NEW] +24.5Ki  [NEW] +24.3Ki    agent_data_plane::internal::remote_agent::run_remote_agent_registration_loop::_{{closure}}::hdb21714c63e256a9
  [NEW] +23.9Ki  [NEW] +23.7Ki    core::ptr::drop_in_place<agent_data_plane::cli::run::handle_run_command::{{closure}}>::h7d001d15bb1c4e93
  [NEW] +22.1Ki  [NEW] +21.9Ki    _<agent_data_plane::components::host_tags::HostTagsConfiguration as saluki_core::components::transforms::builder::SynchronousTransformBuilder>::build::_{{closure}}::h1c2e0daa35c11c89
  [NEW] +21.5Ki  [NEW] +21.4Ki    agent_data_plane::cli::run::create_topology::_{{closure}}::hfa8cd01b42020a3b
  [NEW] +20.7Ki  [NEW] +20.5Ki    agent_data_plane::internal::env::ADPEnvironmentProvider::from_configuration::_{{closure}}::hcb7c87a80c7bf0f9
  [NEW] +20.4Ki  [NEW] +20.3Ki    agent_data_plane::cli::debug::handle_debug_command::_{{closure}}::h22ed65aa40f0b9a1
  [NEW] +19.4Ki  [NEW] +19.3Ki    agent_data_plane::internal::env::workload::build_collector::_{{closure}}::h941a0000a4bd9922
  [NEW] +17.4Ki  [NEW] +17.2Ki    _<backon::retry::Retry<B,T,E,Fut,FutureFn,SF$C&C$NF,AF> as core::future::future::Future>::poll::he3fbb93b10759c4d
  [DEL] -17.3Ki  [DEL] -17.1Ki    _<backon::retry::Retry<B,T,E,Fut,FutureFn,SF$C&C$NF,AF> as core::future::future::Future>::poll::h1affd1c66063491e
  [DEL] -19.4Ki  [DEL] -19.3Ki    agent_data_plane::internal::env::workload::build_collector::_{{closure}}::h00c92f75c1b1d28f
  [DEL] -20.4Ki  [DEL] -20.3Ki    agent_data_plane::cli::debug::handle_debug_command::_{{closure}}::h1ccd53100b94fc71
  [DEL] -20.6Ki  [DEL] -20.4Ki    agent_data_plane::internal::env::ADPEnvironmentProvider::from_configuration::_{{closure}}::h1dfaca6fe73e62bd
  [DEL] -21.5Ki  [DEL] -21.4Ki    agent_data_plane::cli::run::create_topology::_{{closure}}::habec478076275291
  [DEL] -22.5Ki  [DEL] -22.3Ki    _<agent_data_plane::components::host_tags::HostTagsConfiguration as saluki_core::components::transforms::builder::SynchronousTransformBuilder>::build::_{{closure}}::h8b7d61b64eaf603d
  [DEL] -24.0Ki  [DEL] -23.8Ki    core::ptr::drop_in_place<agent_data_plane::cli::run::handle_run_command::{{closure}}>::h48a35334c9eace0c
  [DEL] -24.6Ki  [DEL] -24.4Ki    agent_data_plane::internal::remote_agent::run_remote_agent_registration_loop::_{{closure}}::ha74974083d627ea7
  [DEL] -29.7Ki  [DEL] -29.6Ki    agent_data_plane::cli::dogstatsd::handle_dogstatsd_command::_{{closure}}::h4590010eb3ca1383
  [DEL] -39.2Ki  [DEL] -39.1Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::h359f21f5704ce78a
  +0.1% +44.9Ki  +0.1% +35.1Ki    TOTAL

[pr-commenter]

Regression Detector (Agent Data Plane)

Run ID: fd211d1d-c9bd-4fdc-ae13-057e63f14d88
Baseline: 68609904 · Comparison: 0bef301d · diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment (5)

Experiments configured erratic: true are tagged (ignored) and skipped when determining which experiments regressed or improved. Experiments which are detected as erratic at runtime are tagged (erratic) to flag that the run's sample dispersion was high, but their regression / improvement signal still counts.

experiment	goal	Δ mean %	links
quality_gates_rss_idle	memory	⚪ +0.50	metrics profiles logs
quality_gates_rss_dsd_low	memory	⚪ +0.23	metrics profiles logs
quality_gates_rss_dsd_ultraheavy	memory	⚪ +0.06	metrics profiles logs
quality_gates_rss_dsd_medium	memory	⚪ -0.07	metrics profiles logs
quality_gates_rss_dsd_heavy	memory	⚪ -0.19	metrics profiles logs

Bounds Checks: ✅ Passed (5)

experiment	check	replicates	observed	links
quality_gates_rss_dsd_heavy	memory_usage	10/10	✅ 138 MiB ≤ 140 MiB	metrics profiles logs
quality_gates_rss_dsd_low	memory_usage	10/10	✅ 42.1 MiB ≤ 50 MiB	metrics profiles logs
quality_gates_rss_dsd_medium	memory_usage	10/10	✅ 63.9 MiB ≤ 75 MiB	metrics profiles logs
quality_gates_rss_dsd_ultraheavy	memory_usage	10/10	✅ 191 MiB ≤ 200 MiB	metrics profiles logs
quality_gates_rss_idle	memory_usage	10/10	✅ 27.9 MiB ≤ 40 MiB	metrics profiles logs

Explanation

A change is flagged as a regression when |Δ mean %| > 5.00% in the regressing direction for its optimization goal AND SMP marks the experiment as a regression (is_regression: true). Improvements use the matching criteria for the improving direction. Experiments configured erratic: true (tagged (ignored)) are skipped outright; experiments detected as erratic at runtime (tagged (erratic)) still count, since that flag describes sample dispersion rather than directional certainty. The Δ mean % cell is colored accordingly: 🟢 = improvement, 🔴 = regression, ⚪ = neutral. Reduction in CPU or memory is an improvement; reduction in ingress throughput is a regression.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e18650bbc9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Reject server key logging in FIPS validation

In FIPS builds, this accepts any ServerConfig whose rustls FIPS marker is true, but rustls 0.23.41's ServerConfig::fips() does not inspect operational secret-export settings such as key_log. A caller can pass a config with config.key_log replaced through HttpServer::with_tls_config/API with_tls_config, this check passes, and the server will export TLS secrets even though this crate already treats TLS key logging as non-FIPS-compliant on the client side. The server validator should explicitly reject or clear key logging (and similar secret-extraction knobs) before serving.

Useful? React with 👍 / 👎.

[aqian01]

Addressed