gRPC for PHP 1.83

Apply the PHP 8.5 baseline first. These rules cover outbound clients using the 1.83 line of the grpc/grpc Composer package and native grpc extension. Apply server authentication and authorization in the receiving service's implementation; a PHP client stub cannot enforce them for the server.

Runtime and generated code

• Verify the locked Composer package, the loaded extension version with phpversion('grpc') in the deployed SAPI, and the Core version bundled or linked by the extension build; updating Composer alone does not update the native transport. Test the extension with the actual PHP 8.5 build and worker mode.
• Declare and lock the protobuf runtime used by generated messages, whether google/protobuf or ext-protobuf, and declare google/auth when used. Generate reviewed schemas with pinned protoc and grpc_php_plugin tooling; never pair newer generated code with an older protobuf runtime.

Channels, destinations, and TLS

• Pass 'credentials' => Grpc\ChannelCredentials::createSsl($trustedRootsPem) for remote services. createInsecure() returns null, and a raw Grpc\Channel with missing or null credentials is plaintext; confine these paths to isolated tests and fail on TLS errors without falling back.
• Supply trusted PEM contents, not filenames, to createSsl; supply both private key and certificate chain for mutual TLS. Establish ChannelCredentials::setDefaultRootsPem() only from trusted startup configuration; its default-root state is process-wide, not tenant-local.
• Keep grpc.ssl_target_name_override out of production settings and