fix(rate-limiter): production hardening — TLS support for managed Redis

plugins/rust/python-package/rate_limiter/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rate_limiter"
-version = "0.0.5"
+version = "0.0.6"
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
@@ -24,7 +24,21 @@ pyo3-stub-gen = { workspace = true }
 pyo3-log = { workspace = true }
 parking_lot = "0.12"
 thiserror = { workspace = true }
-redis = { version = "0.27", features = ["aio", "tokio-comp"] }
+redis = { version = "0.32", features = ["aio", "tokio-comp", "tls-rustls", "tokio-rustls-comp"] }
+# Direct rustls dep with the `ring` crypto provider feature. redis 0.32
+# pulls rustls in transitively but via `default-features = false`, so no
+# crypto provider is enabled by default — rustls 0.23 then panics at
+# first TLS use ("Call CryptoProvider::install_default()..."). We add
+# `ring` here and install it as the default provider once at plugin init.
+#
+# Note on CA roots: by NOT enabling `tls-rustls-webpki-roots`, the redis
+# crate falls back to `rustls-native-certs` (Apache-2.0 / MIT / ISC) which
+# reads CA certificates from the host OS trust store at runtime. This
+# avoids a transitive dep on `webpki-roots` (CDLA-Permissive-2.0). The
+# trade-off: the host container must have a CA bundle installed — true
+# for the UBI Minimal image mcp-context-forge ships on, and for any
+# distribution that keeps `ca-certificates` in its base.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 tokio = { workspace = true }
 
 [dev-dependencies]

plugins/rust/python-package/rate_limiter/cpex_rate_limiter/plugin-manifest.yaml

@@ -1,6 +1,6 @@
 description: "Rate limiting by user/tenant/tool — memory (single-process) or Redis (shared across instances)"
 author: "ContextForge Contributors"
-version: "0.0.5"
+version: "0.0.6"
 kind: "cpex_rate_limiter.rate_limiter.RateLimiterPlugin"
 available_hooks:
   - "prompt_pre_fetch"