TLS Termination vs Transparent Transit Security Enforcement

Comparison scope

Historical claim C-008 is withdrawn. Its broad cross-service visibility assertion was not revalidated. Historical mappings are retained for traceability and do not support that assertion for the current release.

Build-specific executable support and limits

TLS termination creates a configured cryptographic boundary. The released v0.5.5 native catalog describes gateway TLS negotiation on configured listeners; it does not establish visibility or policy enforcement on every service-to-service path.

Evidence to review

Security controls map • EC2 and EKS deployment validation • Historical C-008 mapping — withdrawn claim

Decision guidance

• Identify where traffic is actually routed and TLS terminates; confirm the relevant listener identity and trust configuration.
• Measure each service path and adapter separately. A gateway capability report or policy acknowledgment does not prove coverage of traffic that does not traverse that gateway.
• Compare rollout receipts and telemetry deltas before assuming policy coverage is complete.

Next related reading

KMS alone vs orchestration • PQC migration planning • Evidence index • Claim-to-evidence matrix