Dependencies

This PR is the final change in the existing Grid data-plane stack:

1. feat(filters): add grid_route #339 adds grid_route.
2. feat(grid): hot reload route overlays #540 adds overlay hot reload and authenticated provider-hop context.
3. This PR adds the secure provider gateway boundary and final-hop credential replacement.

It remains draft until its dependencies land. No separate provider-boundary PR is required.

Summary

Adds the provider-side Praxis AI pipeline used after an edge grid_route decision:

edge grid_route
  -> mTLS provider connection
  -> peer_identity_trust
  -> request/model parsing
  -> grid_provider_route
  -> grid_credential_inject, when required
  -> load_balancer
  -> private provider backend

The provider gateway is a Praxis AI inference gateway, not a generic reverse proxy. It validates the edge-selected candidate against provider-local policy, selects a preconfigured local backend cluster, replaces customer credentials at the final hop, and forwards through the normal Praxis load-balancer pipeline.

grid_provider_route

grid_provider_route is an exact provider-local validation and mapping filter, not a second Grid routing engine. It maps:

authenticated selected candidate
  + model
  + request path
  + provider-local route map
  -> local backend cluster
  + optional credential reference metadata

It:

• fails closed for missing, unknown, blank, or oversized candidate identity;
• rejects disallowed models and paths;
• strips spoofable edge/provider attribution and customer authorization state;
• emits provider attribution from the provider gateway;
• writes shared typed metadata for the selected local route;
• selects only clusters declared in provider-local configuration.

Provider boundary enforcement

Proxy startup validation rejects a Grid provider chain unless:

• the listener requires downstream client certificates;
• peer_identity_trust is the first filter;
• peer_identity_trust precedes grid_provider_route.

This keeps x-grid-peer-* values from being treated as trusted merely because they are present. They are consumed only after Praxis establishes the mTLS peer identity and the provider-local trust policy accepts it.

grid_credential_inject

The credential filter consumes credential-reference metadata from either grid_route or grid_provider_route. It:

• resolves an allow-listed (name, namespace, key, strategy) entry;
• supports mounted-file, environment, and explicit-value sources;
• requires exactly one source per credential;
• stores token material in zeroizing memory;
• removes the incoming Authorization header;
• injects the provider bearer token only on the final upstream hop;
• fails closed for missing, malformed, unsupported, or unknown credential references.

Only references appear in Grid overlays and route metadata. Provider token values are not written to overlays, filter metadata, logs, or errors.

Architecture boundary

• Grid owns discovery, admission, scoring, candidate ordering, and overlay rendering.
• Edge grid_route makes the Grid candidate selection.
• Provider grid_provider_route validates that selection against a local allow-list and maps it to a local cluster.
• grid_credential_inject performs final-hop credential replacement.
• Praxis core continues to provide generic mTLS, peer identity, filter execution, and load-balancer mechanics.

This PR does not add another scoring engine, session store, dynamic cluster system, credential subsystem, or Grid-specific Praxis core abstraction.

Validation

The final stacked head passes:

• cargo +nightly fmt --all -- --check
• cargo check --workspace
• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps
• cargo xtask lint-separators
• cargo xtask lint-filter-docs
• git diff --check

Focused tests cover filter construction, chain validation, header stripping, unknown candidates, model/path denial, metadata output, credential replacement, missing credentials, and fail-closed runtime behavior.

The combined Grid GLB environment additionally proves the Praxis edge-to-provider mTLS hop, valid and invalid peer identities, provider-local route denial, private backend traversal, provider attribution, customer-token removal, and Secret-backed provider credential replacement.

Review focus

• provider-chain startup invariants;
• exact provider-local mapping semantics;
• trusted-context stripping and reconstruction;
• credential-reference bounds and fail-closed behavior;
• absence of token material from metadata and diagnostics.