Sebastián Ramírez <******@****.***> 1688149516 +0200

Additionally, we enforce the peer has a valid mesh identity (but do not assert _which_ identity, yet).

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.
If the target destination has a waypoint, we enforce that the request is coming from that waypoint. Otherwise, the request is rejected.
If there is no waypoint, ztunnel will enforce RBAC policies against the request.

- **Cross-Language Compatibility:** Java serialization is inherently Java-centric and does not support cross-language scenarios well.

- **Type Safety:** Java serialization does not enforce type safety as strictly as some alternatives, potentially leading to runtime errors.

## Decision

- **Cross-Language Compatibility:**
Java serialization is inherently Java-centric and does not support cross-language scenarios well.

- **Type Safety:**
Java serialization does not enforce type safety as strictly as some alternatives, potentially leading to runtime errors.

## Decision

We do not use Java serialization.

                    NoPluginFoundForPrefixException, LifecycleNotFoundException, PluginVersionResolutionException {
        List<MojoExecution> me = new ArrayList<>();
        me.add(createMojoExecution("enforce", "enforce-versions", VALIDATE));
        me.add(createMojoExecution("resources", "default-resources", PROCESS_RESOURCES));
        me.add(createMojoExecution("compile", "default-compile", COMPILE));

                for (Plugin element : src) {
                    if (element.isInherited() || !element.getExecutions().isEmpty()) {
                        // NOTE: Enforce recursive merge to trigger merging/inheritance logic for executions
                        Plugin plugin = Plugin.newInstance(false);
                        plugin = mergePlugin(plugin, element, sourceDominant, context);

ACCEPTED

## Consequences

- Assign ownership of each architecture module to one team.
- Assign each source file to one architecture module.
- Align the source tree layout with this architecture.

// contains one valid set of trust anchors for that signer. Signers may have
// multiple associated ClusterTrustBundles; each is an independent set of trust
// anchors for that signer. Admission control is used to enforce that only users
// with permissions on the signer can create or modify the corresponding bundle.
message ClusterTrustBundle {
  // metadata contains the object metadata.
  // +optional

   *
   * HTTP/2 requires deployments of HTTP/2 that use TLS 1.2 support
   * [CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256], present in Java 8+ and Android 5+.
   * Servers that enforce this may send an exception message including the string
   * `INADEQUATE_SECURITY`.
   */
  HTTP_2("h2"),

  /**
   * Cleartext HTTP/2 with no "upgrade" round trip. This option requires the client to have prior

PROPOSED

## Consequences

- Assign ownership of each architecture module to one team.
- Assign each source file to one architecture module.
- Align the source tree layout with this architecture.