## Overview Define and implement the Inbound layer of the three-layer chassis: the front door of every service. The chassis auto-wires request handling, observability, and authorization by composing native LabKit and per-language libraries, so the developer registers handlers declaratively and gets the rest by default. This is the layer that "owns the if": control decisions (auth, shedding, authorization, audit) run before business logic, so the handler only sees vetted input. GATE integration is resolved (Jun 4 2026 weekly): LabBench services don't embed GATE. A composed LabKit module verifies the **URT** GATE attaches at the data plane, rejecting any request that bypassed it. Fine-grained in-binary policy (Mode 3) is deferred. Earlier milestones already landed HTTP handler registration and probe endpoint auto-registration. HTTP RED metrics were assumed landed and are not: the chassis mounts `/-/metrics` but emits no request metrics, tracked as [bench#73](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/73). LB-D4 (service identity and mTLS) is decided: the chassis composes LabKit's [`v2/tls`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/tls) ([gitlab-org/labkit#143](https://gitlab.com/gitlab-org/labkit/-/work_items/143)); see the [2026-08-28 scope comment](#note_3926390265). ## Upstream state Two things about the per-language libraries shape this milestone's scope, and both were confirmed against [labkit `df307e03`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352) and [labkit-rs `main`](https://gitlab.com/gitlab-org/rust/labkit-rs). **Neither LabKit ships a gRPC server to compose.** Both provide middleware and expect the caller to construct the server: - Go's [`v2/grpcserver`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/grpcserver) is four files of interceptors; [`doc.go`](https://gitlab.com/gitlab-org/labkit/-/blob/df307e038980743f2e50a83cf718b1de2b50f352/v2/grpcserver/doc.go) scopes it to "gRPC server interceptors," with the caller building `grpc.NewServer`. Compare [`v2/httpserver`](https://gitlab.com/gitlab-org/labkit/-/tree/df307e038980743f2e50a83cf718b1de2b50f352/v2/httpserver), which ships a server, router, health endpoints, recovery, and TLS across 18 files. - Rust's [`labkit/src/grpc`](https://gitlab.com/gitlab-org/rust/labkit-rs/-/tree/main/labkit/src/grpc) provides Tower layers for Tonic (correlation, trace, access log, and metrics behind the `otel` feature), again with the caller building `tonic::transport::Server`. So "wire gRPC" needs a decision first: construct the server in both chassis, or get a server constructor upstream in two repos. Two details soften it. Rust's `GrpcMetricsLayer` already covers part of the gRPC RED-metrics requirement, and Go's correlation interceptors already ship in both unary and streaming forms, so the unary-plus-streaming split is the upstream pattern rather than a bench invention. **The Rust inbound-TLS gap is narrower than "no TLS".** labkit-rs has [`labkit/src/tls.rs`](https://gitlab.com/gitlab-org/rust/labkit-rs/-/blob/main/labkit/src/tls.rs), providing `ServerTls` with cert and key paths plus `min_version`, and its doc comment says it deliberately mirrors the Go split ("`v2/tls` holds the policy and `v2/httpserver` runs the listener"). The real gap is client verification: `tls.rs` builds its `rustls::ServerConfig` with `with_no_client_auth()` hardcoded and exposes no client-CA input. So `enabled`, `cert_file`, and `key_file` wire in both languages; `client_ca_files` and `client_auth` are Go-only until labkit-rs adds client-CA support. Also worth noting for the audit and scrubbing row below: [`v2/httpserver/mask.go`](https://gitlab.com/gitlab-org/labkit/-/blob/df307e038980743f2e50a83cf718b1de2b50f352/v2/httpserver/mask.go) already redacts sensitive query parameters and URL userinfo to `[FILTERED]`, inside the HTTP server the chassis composes today. ## Scope The example specs turned the remaining scope into fixtures. Full evidence for each gap lives in the example gap tables ([gate-iam](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/examples/gate-iam/README.md#gaps-found), [GKG](https://gitlab.com/gitlab-org/lab-bench/bench/-/blob/3205a6946ca01ceeba7124188f8e18c52c6ce578/examples/gkg/README.md#gaps-found)), not restated here. Gap numbers are written without a `#` so they don't render as issue references. | Deliverable | Fixture / evidence | |---|---| | gRPC handler wiring, unary **and** streaming. Stream interceptors carry URT and RED so streams can't bypass the inbound controls; shutdown drains long-lived streams | `examples/grpc-service`; gate-iam assemblies; GKG gap 14 (`ExecuteQuery` bidi stream) | | NATS handler wiring | `examples/nats-subscriber` | | JetStream durable-consumer config on `NATSEndpoint` (durable name, ack policy, pull/push) | GKG gap 15, consume half | | `ListenerTLS` per the [2026-08-28 comment](#note_3926390265): schema, validator defaults, Go wiring; Rust limited to server TLS pending labkit-rs client-CA support | GATE gap 4; GKG gap 13 | | Raise the listener cap (keep a cap) so one assembly can publish HTTP + gRPC | gap 6, twice: gate-iam `iam-auth`, GKG webserver | | URT surface: schema field, chassis composition seam, local-dev decision (stub vs test gate). Full verification blocked on the LabKit URT module, which doesn't exist yet | GATE gap 2 | | Inbound admission control (load shedding) — **owned by [bench#78](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/78) in [DM-6](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/3)**, not by this epic. Inbound shedding and outbound circuit breaking are one decision about overload policy: same thresholds, same degraded duration, same recovery semantics, same health signal. Filing them separately would give the chassis two unrelated notions of "overloaded" | `outbound.proto` `CircuitBreaker` (the existing half) | | HTTP RED metrics from the generated entrypoint. `Metrics: a.Metrics()` mounts `/-/metrics` and registers `go_`/`process_` collectors, but no request counters or histograms exist. Settles the metric names and label set the gRPC and NATS transports then match. **Cross-language constraint**: labkit-rs already ships `HttpMetricsLayer` and `GrpcMetricsLayer` emitting OTel-semantic-convention instruments (`http.server.request.duration`, `rpc.server.duration`), so Go should adopt those names rather than invent a parallel set — otherwise Go and Rust dashboards cannot be overlaid | [bench#73](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/73); exemplar hand-builds it with `promhttp`; `labkit/src/http/metrics_layer.rs` | | Audit logging and PII scrubbing at the inbound boundary (May 28 weekly). Scrubbing is partly covered by `v2/httpserver/mask.go`; bodies and audit are open | — | **Out of scope**: - Scheduled invocation (JetStream cron) and A/B hooks, a later [Theseus roadmap](https://docs.google.com/presentation/d/1MUCAiVtyAEQ-vcLRC27TOSOdtkHnO2Y78kDPGZpSNoo) phase - Mode 3 in-binary GATE policy (deferred) - Outbound transport config (`mtls_enabled` bool debt), which is [DM-6](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/3) - GKG gap 14's non-chassis parts: the Workhorse `senddata` upgrade (GitLab-side ingress) and the mid-stream redaction callback (handler logic on an Outbound backend) - NATS publish side ([DM-6](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/3)); analytical-DB backends like ClickHouse, GKG gap 12 (Outbound) ## Definition of done - [ ] `bench build examples/grpc-service` serves `gitlab.inventory.v1.InventoryService`; the gRPC "absent from the binary" warning is gone from both generators - [ ] The gRPC server-construction question is settled and recorded, either as a bench-side decision or upstream issues - [ ] Stream interceptors carry URT verification and RED metrics; shutdown drains long-lived streams - [ ] `bench build examples/nats-subscriber` produces a consumer binary subscribed to `events.catalog.*`, no published listener - [ ] `NATSEndpoint` expresses a JetStream durable consumer; the GKG indexer binding no longer omits its subscription config - [ ] `ListenerTLS` landed: schema, validator defaults, Go wiring without `crypto/tls` in generated code - [ ] Rust wires server TLS via labkit-rs `ServerTls`; a Rust assembly declaring `client_auth` fails validation rather than silently ignoring it, and an upstream labkit-rs issue exists for client-CA support - [ ] Listener cap raised; gate-iam and GKG collapse their split assemblies and retire both gap 6 annotations - [ ] URT schema surface + chassis seam defined; local-dev path decided; full verification tracked as blocked on the LabKit module - [ ] Inbound admission control delegated to [bench#78](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/78); this epic owns no shedding deliverable - [ ] Inbound audit and scrubbing scope decided: a decision record covering both, or an explicit deferral naming its trigger - [ ] HTTP RED metrics emitted from the generated entrypoint, with a low-cardinality route-pattern label ([bench#73](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/73)) - [ ] RED metrics auto-emitted for gRPC and NATS inbound traffic, using the metric names and label set [bench#73](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/73) settles - [ ] Go instrument names, units, and label keys match labkit-rs's existing `HttpMetricsLayer` and `GrpcMetricsLayer`, or the divergence is recorded with a reason ## Depends on [DM-3](https://gitlab.com/gitlab-org/lab-bench/bench/-/work_items/3), done for HTTP; gRPC and NATS parity is this epic. ## References - [GATE/IAM](https://gitlab.com/gitlab-org/auth/iam) - [LabBench SOA Architecture](https://docs.google.com/document/d/11Zj918LuZeY3fPcU50ZPhzJtcqzvyXaO0SDamW7cDc8) - [Phase 1 epic](https://gitlab.com/groups/gitlab-org/lab-bench/-/epics/1) (parent)