[jagnd1]

Summary

• fail closed for REST and gRPC authentication, reject GP in production, and make runtime configuration fail fast
• protect the internal unwrap command with explicit enablement and a key-custodian role
• add provider-aware readiness, bounded server behavior, typed input errors, validation guards, and explicit rejection of unsupported GP parameters
• add pinned CI gates, race and transport tests, container verification, and updated operational documentation
• record Python endpoint parity and deferred PayShield capabilities in a permanent migration ledger

Design boundary

GP remains a deterministic local/test HSM emulator. Its fixed LMK derivation is intentional for reproducible development, but production startup with GP is rejected. Unwrap remains available only as an opt-in internal command and is not covered by the broad crypto administrator wildcard.

Verification

• make proto-check test-race standalone
• go vet ./...
• govulncheck ./... (no vulnerabilities found)
• docker build -f services/crypto_svc/Dockerfile -t fmcrypto:service-baseline services
• git diff --check

Staticcheck is deliberately not enabled yet because v0.7.0 cannot decode Go 1.27 export data; this remains tracked in todo.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.