gRPC Python 1.83

Apply the Python 3 baseline first. These rules cover gRPC Python 1.83 channel security, metadata, interceptors, protobuf validation, streaming limits, errors, reflection, and deployment.

Channels and transport security

• Use grpc.secure_channel(..., grpc.ssl_channel_credentials(...)) and grpc.ssl_server_credentials(...) for network connections; reserve insecure_channel() for an independently protected local boundary.
• Verify server identity through trusted roots and the expected hostname; do not override the target name to bypass validation.
• For mutual TLS, pass trusted client roots and require_client_auth=True to grpc.ssl_server_credentials() and authorize the verified identity exposed by ServicerContext.auth_context().
• Keep private keys and bearer credentials outside source, channel targets, logs, and exception text.
• Rotate channel and server credentials without silently falling back to insecure transport.

Authentication and authorization

• Authenticate metadata at a server interceptor before invoking protected handlers. When wrapping the returned RpcMethodHandler, keep its request_streaming, response_streaming, request_deserializer, and response_serializer, and wrap whichever of unary_unary, unary_stream, stream_unary, or stream_stream is set; a unary-only wrapper leaves streaming methods outside the control.
• Use grpc.metadata_call_credentials() or grpc.access_token_call_credentials() on TLS channels for bearer tokens; raw metadata= has no credential transport-security check.
• Authorize every RPC method and