ReserveGrid OS v0.3.0

ReserveGrid OS v0.3.0 — Fortify

Production security boundary, legal framework, and operational readiness probes. This release closes the two remaining pool operator concerns (verifier HTTP auth/TLS and health check depth) and adds the legal pages required before pilot onboarding.

Scope

Three workstreams: HTTP security hardening for pool-verifier, readiness probes for operational monitoring, and legal/compliance pages on the public website. No changes to the policy evaluator, protocol, or template-manager.

pool-verifier HTTP security

TLS termination

Pool-verifier now supports native TLS via VELDRA_TLS_CERT and VELDRA_TLS_KEY environment variables pointing to PEM files. When both are set, the HTTP server binds with rustls and serves HTTPS directly.

For development and testing, set VELDRA_TLS_SELF_SIGNED=1 to auto-generate a self-signed certificate on startup. The self-signed path logs a warning at startup and is not intended for production.

When neither TLS env var is set, the server starts in plaintext HTTP mode (existing behavior).

API key authentication

Set VELDRA_API_KEY to require a Bearer token on all HTTP endpoints except /health and /ready. Requests from localhost (127.0.0.1, ::1) bypass authentication regardless of configuration, preserving dev ergonomics.

When VELDRA_API_KEY is not set, all endpoints remain open (existing behavior). Unauthorized requests receive 401 with missing or invalid api key.

New environment variables

• VELDRA_TLS_CERT — path to PEM certificate file
• VELDRA_TLS_KEY — path to PEM private key file
• VELDRA_TLS_SELF_SIGNED — set to 1 to auto-generate a self-signed cert for dev
• VELDRA_API_KEY — bearer token required for non-health endpoints (localhost bypasses)

Readiness probes

/ready endpoint

New /ready endpoint returns 200 when the verifier is operationally healthy, 503 when degraded. Response is JSON with four fields:

{
  "ready": true,
  "policy_loaded": true,
  "mempool_reachable": true,
  "mempool_last_ok_age_secs": 2
}

Readiness requires both policy_loaded (policy parsed from file at startup, not degraded built-in default) and mempool_reachable (last successful mempool fetch within 30 seconds).

/health unchanged

/health remains a simple liveness probe returning "ok" unconditionally. Both /health and /ready bypass API key authentication.

Website legal pages

Privacy policy (/privacy/)

Covers rg-auth account data (name, email, org, Argon2id-hashed password), session tokens, planned analytics, and operational data boundaries. States that operator template data stays on operator infrastructure.

Terms of service (/terms/)

Governs observe mode access, acceptable use, account responsibilities, IP protection, limitation of liability, indemnification, and California governing law.

Disclaimer (/disclaimer/)

Software provided as-is, not financial advice, mining risk acknowledgment, no guarantee of correctness, consensus safety checks are informational only, operator responsibility for deployment security.

Site integration

• Legal footer section (Privacy, Terms, Disclaimer links) added to all 8 pages
• Sitemap updated with /observe/, /privacy/, /terms/, /disclaimer/
• GitHub source links removed from about, docs, and product pages
• Source-available section replaced with architecture overview and observe mode CTA

Dependencies

• axum-server 0.7 with tls-rustls feature (TLS termination)
• rcgen 0.13 (self-signed certificate generation)

Test matrix

Existing tests unaffected. New functionality is infrastructure-level (TLS, middleware, readiness probe) tested via integration.

Upgrade notes

No breaking changes. All new environment variables are optional. Existing deployments continue to work with plaintext HTTP and open access. To enable security:

1. Set VELDRA_TLS_CERT and VELDRA_TLS_KEY for TLS
2. Set VELDRA_API_KEY for endpoint authentication
3. Monitor /ready for operational health