gRPC C++ 1.82

Apply the C++23 prompt first. These rules cover gRPC Core/C++ 1.82, including its experimental TLS, authorization, and session APIs, and were checked against 1.82.2. Treat the 1.82 line as legacy and migrate production deployments to a supported, patched release line.

Transport credentials

• Use grpc::SslCredentials and grpc::SslServerCredentials, or the experimental TLS factories when certificate providers or custom verification are needed. Handle credential-creation failures without falling back to InsecureChannelCredentials() or InsecureServerCredentials().
• For rotating TLS credentials, create server options with TlsServerCredentialsOptions::Create(identity_provider) and check its status; configure roots with set_root_certificate_provider. Update FileWatcherCertificateProvider key/certificate files atomically, or check every InMemoryCertificateProvider::UpdateRoot and UpdateIdentityKeyCertPair result.
• Keep TlsChannelCredentialsOptions::set_verify_server_certs(true) and the default hostname verifier. Chain verification and peer-name verification are separate checks; NoOpCertificateVerifier or an always-successful custom verifier removes the latter protection.
• When implementing ExternalCertificateVerifier, preserve the intended peer-identity check, using HostNameCertificateVerifier where appropriate. Follow its synchronous/asynchronous result contract; never invoke an asynchronous callback on the same thread before Verify returns, and complete cancelled verification promptly through Cancel.
• Require verified client certificates