security hardening (mTLS, secret scoping, sandbox profiles, signed artifacts)

[ashupednekar]

Summary

Harden service-to-service security and supply-chain controls.

Motivation

Multi-component function execution path needs stronger defaults for identity, secrets, and artifact trust.

Proposal

• mTLS between core services.
• Project-scoped secret access with least privilege.
• Runtime sandbox policy profiles by trust level.
• Signed image/artifact verification before deploy.

Acceptance criteria

• Service identity and encrypted in-cluster traffic are enforced.
• Secrets are scoped and auditable per project/function.
• Artifact signature verification is integrated in deploy path.