Every Connection Requires a Certificate — No Exceptions

What This Actually Is

The system uses mutual TLS (mTLS) — the same certificate technology behind the padlock on "https://" websites, except both sides have to prove who they are, not just one. When one part of the system (a "cell," like Scribe or Planner) tries to talk to the central coordinator (the Gateway), it must present a signed certificate. The Gateway checks it before allowing anything through.

What this makes possible:

• The Gateway server is configured to require client certificates (ssl_cert_reqs = CERT_REQUIRED), not just accept them if offered
• Every certificate is signed by a single trusted authority, so a forged or self-signed certificate is rejected automatically
• If a request arrives with no valid certificate, the connection is refused before any data is exchanged — not logged as a warning and let through anyway

Why Enforcement, Not Configuration

This isn't a setting that could be quietly switched off without anyone noticing:

• The check happens at the connection layer, before the request ever reaches application code
• There's a documented fallback path for cases where mTLS isn't available yet, but the system logs explicitly which mode it's running in — it doesn't pretend to be secure when it isn't
• Certificates are generated per-component, not one shared certificate for everything, so a compromised component can't impersonate another

What This Proves, and What It Doesn't

This proves that components can't talk to each other by accident, and can't be impersonated without a valid, signed certificate. It does not mean every possible attack is prevented, and it isn't unique technology — it's the same certificate approach used across finance and telecom. What matters here is that it's actually enforced in this system's code, not just described in a policy document.