techgopal · Nov 12, 2026 · Nov 12, 2026 · Nov 12, 2026 · Nov 12, 2026 · Nov 12, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -305,6 +305,14 @@ jobs:
           KRISHIV_TEST_UDF_PYTHON: ${{ runner.temp }}/udf-python/bin/python
           KRISHIV_UDF_POOL_REQUIRED: "1"
       - run: cargo test --workspace --doc --locked
+      # The feature-gated runs below rebuild their crates' test executables beside the workspace's, which
+      # have already run: drop those first, or the krishiv-server link runs out of disk (ld Bus error, #769).
+      # Libraries (`.rlib`, `.rmeta`, `.so`) stay, so nothing is compiled again.
+      - name: Drop the workspace's test executables
+        run: |
+          df -h /
+          find target/debug/deps -maxdepth 1 -type f -perm -u+x ! -name '*.so' ! -name '*.d' -delete
+          df -h /
       - run: cargo nextest run -p krishiv-session --features telemetry-otlp --test otlp_collector --locked
       # Server TLS (`tls`) and OIDC (`oidc`), both off by default: the in-memory rustls handshakes,
       # and the JWT verifier against keys generated per run.

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -179,10 +179,14 @@ rdkafka = { version = "0.39", default-features = false }
 wasmtime = { version = "49", default-features = false }
 axum = { version = "0.8.9", default-features = false }
 tower = { version = "0.5.3", default-features = false }
+# Test clients only: `TokioIo` for a tonic channel over a TLS stream.
+hyper-util = { version = "0.1.21", default-features = false }
 rust-embed = { version = "8.13", default-features = false }
 utoipa = { version = "6.0", default-features = false }
 rmcp = { version = "3.5.1", default-features = false }
 rustls = { version = "0.23", default-features = false }
+# Server TLS on the listeners (P3-T002 design §3.5): the async acceptor over `rustls`.
+tokio-rustls = { version = "0.26.6", default-features = false }
 # OIDC JWT signatures (krishiv-session `oidc`); already in the tree as rustls's crypto provider.
 aws-lc-rs = { version = "1.18.2", default-features = false, features = ["aws-lc-sys"] }
 tracing = { version = "0.1.44", default-features = false }

diff --git a/changelog.d/769.added.md b/changelog.d/769.added.md
@@ -0,0 +1 @@
+`krishiv server` authenticates every Spark Connect RPC once authentication is configured (static tokens, client certificates or OIDC): each session belongs to its caller, Connect requests follow the viewer/operator/admin role matrix, both ports serve TLS, and refusals are counted on `/metrics` (`krishiv_auth_failed_total`, `krishiv_auth_denied_total`).
diff --git a/crates/krishiv-cli/CLAUDE.md b/crates/krishiv-cli/CLAUDE.md
@@ -10,7 +10,7 @@ The `krishiv` binary: sql, server, coordinator, worker, mcp, ui, doctor, migrate
 Paths are relative to this crate.
 - `src/main.rs` subcommand dispatch and the allocator/memory hook set-up
 - `src/sql.rs` the `krishiv sql` subcommand: input (`-e`, `-f`, stdin), output (`-o`), `--conf`, `--table`, `--timing`, `--agent`, `--max-rows`, `--max-seconds`
-- `src/server.rs` `krishiv server` (feature `server`; `ui` implies it; design P3-T001): host checks before binding (non-loopback refused until P3-T002, root refused without `--allow-root`, core dumps off unless `krishiv.server.allowCoreDumps`), one tokio runtime for the Spark Connect listener (`krishiv-connect-server`, `--connect-port`, default 15002) and the admin listener (`--port` 8080: `/healthz`, `/readyz`, `/metrics` and the UI with `ui`; with `krishiv.auth.*` tokens configured they are guarded by `SessionGuard` over one `ServerAuth`, else by a random token printed once; `krishiv.auth.*` settings never reach the engine configuration), SIGTERM/SIGINT drain then exit 0 after the engine runtime is dropped, a second signal exits 130; `tests/server.rs`
+- `src/server.rs` `krishiv server` (feature `server`; `ui` implies it; design P3-T001): host checks before binding (`check_listener`: non-loopback needs `krishiv.auth.*`, bearer methods there need TLS, client certificates need TLS; root refused without `--allow-root`, core dumps off unless `krishiv.server.allowCoreDumps`), one tokio runtime for the Spark Connect listener (`krishiv-connect-server`, `--connect-port`, default 15002) and the admin listener (`--port` 8080: `/healthz`, `/readyz`, `/metrics` and the UI with `ui`; with `krishiv.auth.*` tokens configured they are guarded by `SessionGuard` over one `ServerAuth`, else by a random token printed once; `krishiv.auth.*` and `krishiv.server.tls.*` settings never reach the engine configuration; with `krishiv.server.tls.certFile`/`keyFile` both listeners speak TLS through one `ServerTls`, reloaded on SIGHUP (handler installed before the addresses print), and the printed addresses are `sc://...;use_ssl=true` / `https://`). With authentication on, the same `ServerAuth` authenticates every Connect RPC (`ConnectAuth`) and each caller's session is `Session::new_session_as(principal, PathPrefixPolicy(RolePolicy(role)))` (`krishiv_connect_server::role_sessions`; client code admin-only until T014b, ADR 0046 N1; the path confinement is checked at startup; a caller with no role is refused before any session), SIGTERM/SIGINT drain then exit 0 after the engine runtime is dropped, a second signal exits 130; `tests/server.rs`
 - `src/check_compat/` (P3-T029) `krishiv check-compat <paths>`: `mod.rs` args, file walk, exit codes (0 none, 1 findings, 2 read errors), JSON/text report; `scan.rs` SQL / Python / notebook-cell scanners; `alternatives.json` workarounds for not-yet functions (names only supported functions; a unit test checks), `functions.json` the function matrix (generated from the SQL reference pages by `tests/scripts/gen_compat_matrix.py`); corpus `tests/check_compat_corpus/` (`handwritten/` with a hand-checked `expected.json`, `supported_only/` must give no findings, `generated/` from `tests/scripts/gen_check_compat_corpus.py`); JSON report is `{schema_version, files_scanned, findings, errors}`
 - `src/repl.rs` the interactive loop (no `-e`/`-f` on a terminal): `.timer`, `.format`, `.complete`, `.history`, history persistence
 - `src/complete.rs` completion sources (keywords, function registry, session catalog, config registry)

diff --git a/crates/krishiv-cli/Cargo.toml b/crates/krishiv-cli/Cargo.toml
@@ -36,6 +36,7 @@ serde_json = { workspace = true }
 mimalloc = { workspace = true, optional = true }
 
 [dev-dependencies]
+rustls = { workspace = true, features = ["aws_lc_rs", "std", "tls12"] }
 tempfile.workspace = true
 libmimalloc-sys = { workspace = true, features = ["extended"] }
 
@@ -62,7 +63,9 @@ server = [
     "dep:krishiv-server",
     "krishiv-server/session",
     "krishiv-server/metrics-prometheus",
+    "krishiv-server/tls",
     "dep:krishiv-session",
+    "krishiv-session/tls",
     "dep:krishiv-connect-server",
     "dep:axum",
     "dep:tokio",
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		`krishiv server` authenticates every Spark Connect RPC once authentication is configured (static tokens, client certificates or OIDC): each session belongs to its caller, Connect requests follow the viewer/operator/admin role matrix, both ports serve TLS, and refusals are counted on `/metrics` (`krishiv_auth_failed_total`, `krishiv_auth_denied_total`).