gRPC for .NET 2.83

Apply the ASP.NET Core 10.0 and C# 14 prompts first. These rules cover gRPC for .NET 2.83 transports, credentials, services, interceptors, protobuf input, deadlines, retries, streaming, errors, and operations.

Transport and channel trust

• Use an HTTPS channel address with normal certificate and hostname validation; an HTTP address selects an insecure transport and must not carry production credentials or protected data.
• Keep GrpcChannelOptions.UnsafeUseInsecureChannelCallCredentials=false; setting it to true permits call credentials to be sent over plaintext HTTP. Authorization headers supplied directly through Metadata are outside this gate.
• Build channel addresses, proxy settings, root trust, and client certificates from trusted service configuration, not request-controlled URLs or model output.
• Use HttpClientHandler.ClientCertificates for mTLS where required and map the authenticated certificate to an application identity; encryption or certificate presence alone is not authorization.
• Do not replace ServerCertificateCustomValidationCallback with an accept-all callback; pin only when operational rotation and exact host validation remain defined.

Service exposure and authorization

• Apply .RequireAuthorization() or method policies to every non-public MapGrpcService<T>(), then authorize the concrete resource inside the method; a valid channel or token does not establish tenant access.
• Register unary and streaming server interceptors in deliberate order, with authentication, limits, and policy outside business interceptors; server