gRPC Python 1.84

Apply the Python 3 baseline first. These rules cover grpcio 1.84 synchronous and AsyncIO services and clients.

Transport and destination trust

• Create network clients with grpc.secure_channel() or grpc.aio.secure_channel() and grpc.ssl_channel_credentials(). Serve with add_secure_port() and grpc.ssl_server_credentials(); keep insecure_channel() and add_insecure_port() off untrusted networks. If TLS terminates at a proxy, use a gRPC-aware boundary, protect the backend hop and accept asserted identities only from authenticated, trusted proxies.
• For mutual TLS, supply trusted client roots and set require_client_auth=True; its default is false. Map verified ServicerContext.peer_identities() and auth_context() values to application principals. Never authenticate from peer() addresses or caller-supplied identity metadata.
• Retain certificate and hostname verification. Do not use grpc.ssl_target_name_override to make a mismatched certificate pass. Protect private keys and the configured root bundle; do not add arbitrary roots to repair a connection. Keep keys and bearer credentials out of channel targets, logs and exception text.
• Rotate certificates and credentials without falling back to insecure transport. For server certificate reloads, use a controlled dynamic_ssl_server_credentials() fetcher returning ssl_server_certificate_configuration() and retain require_client_authentication=True when mutual TLS is required; returning None keeps the current configuration. Test reload failures and expiration.
• With root_certificates=None,