Feat: Outbound TLS bridge (Phase 1) — decrypt agent egress HTTPS into the pipeline - #522

Merged

huang195 merged 24 commits into

rossoctl:mainfrom

huang195:feat/tlsbridge-phase1

Jun 18, 2026

Commits on Jun 17, 2026

Docs: Add TLS bridge design spec + Phase 1 plan; add package skeleton
huang195
committed
6eb2b32
feat(tlsbridge): CASource (ephemeral + file, multi-format key)
huang195
committed
147cb1c
feat(tlsbridge): per-host leaf Minter (shared P-256 key) with LRU/TTL cache
huang195
committed
bf93538
feat(tlsbridge): Decision (record-header + scope gate) and SkipSet
huang195
committed
60fdb0b
test(tlsbridge): drop empty-branch (SA9003) in minter IP-SAN test
huang195
committed
ba1be47
test(tlsbridge): tighten TLS-record check (reject SSLv3) and cover Decision branches
huang195
committed
c52a347
feat(tlsbridge): upstream client with system + injected roots
huang195
committed
1c25fa6
feat(tlsbridge): Terminator + one-conn keep-alive ServeConn (h2)
huang195
committed
54e7597
refactor(forwardproxy): extract serveOutbound; add tlsbridge.Engine facade + sniff Peek
huang195
committed
8e52e20

Commits on Jun 18, 2026