yovision/contracts/transport/v1/README.md

Machine transport policy v1

yovision.transport/v1 applies to every connector protected by machine identity v1.

• HTTPS is mandatory. TLS 1.2 is the minimum and TLS 1.3 is preferred.
• Certificate-chain and hostname verification are mandatory. InsecureSkipVerify, plaintext fallback and query-string credentials are forbidden.
• Connection, response-header and total request timeouts are explicit and bounded; consumers enforce a route-specific body limit before decoding.
• X-Request-ID is an opaque 16–128 character correlation value. It may be generated by the caller or first trusted hop, is never an authentication factor, and must not contain credentials or personal data.
• Retry only timeout, connection loss, 429 and 5xx according to the connector policy. Authentication/authorization failures and contract 4xx responses are terminal until configuration changes.
• Each retry signs a new machine token and jti. The business idempotency key and payload remain unchanged.

Transport failures must not start Sense, Brain or Bell with weakened authentication. Rollback disables the connector and preserves local facts, Outbox/Receipt state and last-known-good configuration.