fix: enforce production transport policy

Every PostgreSQL connection this repository opened was plaintext, in every
environment: no connection site set `ssl` at all, so credentials, session
tokens, and row data crossed the network in the clear and nothing in
configuration, startup, or `pnpm doctor` said so. The public identity URL
boundary was also looser than it appeared.

`core/src/database/transport.ts` is now the one typed policy. It has exactly two
modes: `verify-full` (TLS required, certificate chain verified, and server
identity verified against the configured host — the production default) and
`disable` (the development/test default, refused outright in production). There
is deliberately no encryption-only `require` mode, no chain-only `verify-ca`,
and no `rejectUnauthorized: false` escape hatch anywhere in the configuration
surface; every loose or aliased spelling is rejected in both environments, so a
typo never quietly becomes a weaker mode. Production has no plaintext exception
at all, not even for a loopback database — a connection string cannot prove the
database is process-local.

Verification is certificate *and* hostname. The policy supplies an explicit
`checkServerIdentity` pinned to the host parsed from DATABASE_URL, because the
pinned driver sets TLS `servername` only for non-IP hosts and Node performs no
identity check when it is unset — so `rejectUnauthorized: true` alone accepts a
certificate from any host the trusted CA ever signed when connecting by IP.
Both halves are proven against a real TLS-enabled PostgreSQL, including that the
same connection without the pinned callback succeeds. Every CA, certificate, and
key is generated at test runtime and deleted afterwards.

A DATABASE_URL may no longer carry its own TLS parameters. The pinned driver
merges parsed connection-string values over explicitly passed options, so a
`?sslmode=disable` in the URL would silently replace the policy's verified `ssl`
object; that now fails with a stable code, reported by both `pnpm doctor` and
the migration CLIs rather than as "failed unexpectedly".

One shared environment reader keeps `process.env` out of Core's reusable
constructors, and every executable that opens a connection resolves the policy
identically: the API (validated before any pool, Better Auth instance, module
runtime, or listener exists), both migration commands, the bootstrap CLI, and
Doctor's own connection. Doctor reports it as a blocking failure, never a
warning, naming only the effective mode.

Separately, the identity base URL and every trusted origin must now be exactly
one canonical origin — the WHATWG origin serialization must equal the supplied
string — so a path, trailing slash, credentials, explicit default port, or
non-canonical case is rejected rather than normalized into something that no
longer matches what a browser sends. Production's loopback rejection now
classifies the address instead of comparing against three literals, covering
`.localhost`, all of 127.0.0.0/8, 0.0.0.0, `::`, expanded and IPv4-mapped
forms. This is a configuration-shape guarantee only: it does not resolve DNS or
prove reachability, and TLS protects the connection, not the exposure.

Co-Authored-By: Claude Opus 5 <[email protected]>

README.md

@@ -117,13 +117,35 @@ guarantee, and it does not complete Phase 5D** — passes 2–5 (identity/databa
 authorization integrity, module/runtime/migration correctness, and deployment/supply-chain closure
 plus a final independent re-audit) remain outstanding before Phase 6 (Surface work) may begin.
 
+Phase 5D pass 2 of 5 corrects identity session resolution and enforces a database transport policy.
+A request carrying no cookies, or only unrelated cookies, now performs **no** identity database
+work at all; only a request presenting the configured session cookie that Better Auth resolved to
+`null` is disambiguated, by a real read of the session relation and the exact columns the adapter
+depends on (under `where false`, so no row is ever read) rather than the previous `select 1`. A
+missing table, dropped column, revoked privilege, unreachable database, or query timeout therefore
+produces a sanitized `503`, never a silent anonymous downgrade. The identity base URL and every
+trusted origin must now be exactly one canonical origin, and production rejects the full
+loopback/unspecified address space rather than three literal spellings. **Production PostgreSQL
+connections now require TLS with certificate *and* hostname verification** — from the API, both
+migration commands, the bootstrap CLI, and `pnpm doctor` alike — with no encryption-only mode, no
+`rejectUnauthorized: false` escape hatch, no plaintext exception (not even for a loopback
+database), and an explicit refusal of a `DATABASE_URL` that tries to carry its own TLS parameters,
+which the pinned driver would otherwise let silently override the policy. See
+[Identity](docs/development/identity.md), [API](docs/development/api.md#database-transport-tls), and
+[ADR 0018](docs/architecture/decisions/0018-identity-session-resolution-and-database-transport.md).
+**This pass adds no secret store, no certificate rotation, no client-certificate authentication, and
+no distributed rate limiting; TLS protects the connection, not the exposure, so the network boundary
+remains the deployment's own responsibility. Phase 5D is still not complete** — passes 3–5
+(authorization integrity, module/runtime/migration correctness, and deployment/supply-chain closure
+plus a final independent re-audit) remain outstanding.
+
 ## Quick start
 
 Prerequisites: Node.js 24 LTS, pnpm 11.12, and Docker with Compose.
 
 ```bash
 pnpm install --frozen-lockfile
-cp .env.example .env
+cp .env.example .env   # keep its NODE_ENV=development: see below
 pnpm infrastructure:up
 pnpm modules:validate
 pnpm migrations:validate
@@ -135,9 +157,15 @@ pnpm verify
 ```
 
 `pnpm doctor` builds the workspace first, then reports the supported Node.js runtime, installed
-modules and dependency order, schema and migration inventories, optional read-only PostgreSQL
-planning, and the current object-storage integration state. It never applies migrations, creates a
-history table, starts module servers, or performs storage operations. Schema discovery does import
+modules and dependency order, schema and migration inventories, the effective PostgreSQL transport
+(TLS) policy, optional read-only PostgreSQL planning, and the current object-storage integration
+state. `.env.example` sets `NODE_ENV=development` deliberately: anything else, including an unset
+value, is validated as production, and production requires certificate-verified PostgreSQL TLS and
+rejects loopback/`http` identity origins — so the plaintext loopback database this repository's own
+development infrastructure provides is only usable with it set.
+
+Doctor never applies migrations, creates a history table, starts module servers, or performs
+storage operations. Schema discovery does import
 compiled schema-definition entrypoints; those entrypoints are contractually side-effect-free.
 
 With no installed modules and no `DATABASE_URL`, the current repository produces a report shaped
@@ -167,6 +195,8 @@ Data definitions
     core:0001_authorization_core_tables · 830e1fbc26d0
 
 PostgreSQL
+  ✓ Database TLS verified
+    TLS required with certificate and hostname verification.
   ○ Connection check skipped
     DATABASE_URL is not configured.
   ○ Migration plan skipped