digitalkin 1.0.4.dev6__tar.gz → 1.0.4.dev7__tar.gz

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: digitalkin
-Version: 1.0.4.dev6
+Version: 1.0.4.dev7
 Summary: SDK to build kin used in DigitalKin
 Author-email: "DigitalKin.ai" <contact@digitalkin.ai>
 License: Attribution-NonCommercial-ShareAlike 4.0 International
@@ -453,7 +453,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: ag-ui-protocol==0.1.21.dev1787220377
-Requires-Dist: agentic-mesh-protocol==1.0.2.dev2
+Requires-Dist: agentic-mesh-protocol==1.0.2
 Requires-Dist: agno<3,>=2.8.0
 Requires-Dist: anyio>=4.13.0
 Requires-Dist: grpcio-health-checking==1.82.1

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/pyproject.toml

@@ -31,7 +31,7 @@
         # which is how a nested run's output is attributed to its author. Pinned exactly
         # because it is a dated prerelease; move to >=0.1.21 once that ships stable.
         "ag-ui-protocol==0.1.21.dev1787220377",
-        "agentic-mesh-protocol==1.0.2.dev2",
+        "agentic-mesh-protocol==1.0.2",
         "agno>=2.8.0,<3",
         "anyio>=4.13.0",
         "grpcio-health-checking==1.82.1",
@@ -41,7 +41,7 @@
         "pydantic>=2.12.4",
         "redis[hiredis]>=7.4.0,<9",
     ]
-    version = "1.0.4.dev6"
+    version = "1.0.4.dev7"
 
     [project.optional-dependencies]
         agno = [ "agno>=2.6" ]
@@ -208,15 +208,15 @@
         ]
 
         ignore = [
-            "any-type",  # Allow typing.Any — gRPC stubs, callbacks, and dynamic APIs require it
-            "missing-trailing-comma",  # Disable because of formatter incompatibility
-            "docstring-extraneous-exception",  # Allow extraneous-exception in docstring
-            "unused-import",    # Allow unused imports — used for availability checks
-            "invalid-function-name",    # Allow PascalCase methods — gRPC servicer convention
-            "import-outside-top-level", # Allow lazy imports — needed to break circular dependencies
-            "bad-dunder-method-name", # Allow __get_pydantic_core_schema__ — Pydantic dunder hook
-            "hardcoded-password-string",    # Hardcoded-password
-            "suspicious-pickle-import",    # Allow pickle import
+            "any-type",                       # Allow typing.Any — gRPC stubs, callbacks, and dynamic APIs require it
+            "missing-trailing-comma",         # Disable because of formatter incompatibility
+            "docstring-extraneous-exception", # Allow extraneous-exception in docstring
+            "unused-import",                  # Allow unused imports — used for availability checks
+            "invalid-function-name",          # Allow PascalCase methods — gRPC servicer convention
+            "import-outside-top-level",       # Allow lazy imports — needed to break circular dependencies
+            "bad-dunder-method-name",         # Allow __get_pydantic_core_schema__ — Pydantic dunder hook
+            "hardcoded-password-string",      # Hardcoded-password
+            "suspicious-pickle-import",       # Allow pickle import
         ]
 
         fixable = [ "ALL" ]

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/__version__.py

@@ -5,4 +5,4 @@ from importlib.metadata import PackageNotFoundError, version
 try:
     __version__ = version("digitalkin")
 except PackageNotFoundError:
-    __version__ = "1.0.4.dev6"
+    __version__ = "1.0.4.dev7"

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/core/resilience/bulkhead.py

@@ -15,13 +15,12 @@ Usage in ModuleContext or service wrapper::
 from __future__ import annotations
 
 import asyncio
-import os
 from typing import ClassVar
 
 from typing_extensions import Self
 
 from digitalkin.core.exceptions import BulkheadFullError
-from digitalkin.models.settings.resilience import get_bulkhead_settings
+from digitalkin.models.settings.resilience import BulkheadServiceSettings, get_bulkhead_settings
 
 
 class Bulkhead:
@@ -62,10 +61,10 @@ class Bulkhead:
             del cls._instances[oldest]
 
         settings = get_bulkhead_settings()
-        # Per-service override has a dynamic env-var suffix, so it cannot be a
-        # static settings field — read it directly, falling back to the setting.
-        env_max = os.environ.get(f"DIGITALKIN_BULKHEAD_{service_id.upper()}_MAX")
-        max_concurrent = int(env_max) if env_max is not None else settings.default_max
+        # The override carries the service id in the variable name; the settings
+        # class builds that prefix itself, so nothing here touches the environment.
+        override = BulkheadServiceSettings(service_id).max
+        max_concurrent = override if override is not None else settings.default_max
 
         inst = cls(
             service_id=service_id,

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/core/task_manager/redis/proto_streams.py

@@ -43,7 +43,7 @@ class ProtoStreamReader:
         """Initialize proto stream reader.
 
         Cursor TTL comes from ``GatewayStreamSettings.redis_cursor_ttl`` (env
-        ``DIGITALKIN_REDIS_CURSOR_TTL``).
+        ``DIGITALKIN_GATEWAY_STREAM_REDIS_CURSOR_TTL``).
 
         Args:
             task_id: Unique task identifier.

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/grpc_servers/_base_server.py

@@ -35,6 +35,7 @@ from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.types import GrpcServer, ServiceDescriptor, T
 from digitalkin.models.settings.server.server import get_server_settings
 from digitalkin.models.settings.utils.channel import ControlFlow, SecurityMode
+from digitalkin.utils.env_manager import EnvManager
 
 
 class BaseServer(abc.ABC):
@@ -257,10 +258,9 @@ class BaseServer(abc.ABC):
         Raises:
             SecurityError: If credentials are missing or unreadable.
         """
-        creds = get_server_settings().channel.credentials
-        if not creds:
-            msg = "Credentials must be provided for secure server"
-            raise SecurityError(msg)
+        # Explicit SERVER_CHANNEL_CREDENTIALS__* paths, else the CERTIFICATE_CERT_VOLUME
+        # directory; the resolution itself raises when the key or certificate is absent.
+        creds = EnvManager.server_credentials()
 
         try:  # ruff: ignore[too-many-statements-in-try-clause]
             if creds.key_path and creds.cert_path:

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/grpc_servers/module_server.py

@@ -1,6 +1,5 @@
 """Module gRPC server implementation for DigitalKin."""
 
-import os
 from collections.abc import Sequence
 from typing import TYPE_CHECKING, Any
 
@@ -15,9 +14,12 @@ from digitalkin.grpc_servers.gateway_servicer import GatewayServicer
 from digitalkin.grpc_servers.module_servicer import ModuleServicer
 from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.models import ClientConfig
+from digitalkin.models.services.services import ServicesMode
+from digitalkin.models.settings.redis import get_redis_settings
 from digitalkin.models.settings.server.server import get_server_settings
 from digitalkin.modules._base_module import BaseModule
 from digitalkin.services.registry import GrpcRegistry
+from digitalkin.utils.env_manager import EnvManager
 
 if TYPE_CHECKING:
     from digitalkin.services.registry import RegistryStrategy
@@ -40,6 +42,11 @@ class ModuleServer(BaseServer):
     ) -> None:
         """Initialize the module server.
 
+        In remote mode an omitted ``client_config`` is built from the
+        environment, so a module no longer declares one to reach the registry
+        and the services provider. Local mode keeps it unset: there is no
+        registry to register with.
+
         Args:
             module_class: The module class to serve.
             client_config: Client configuration for services and registry.
@@ -49,6 +56,8 @@ class ModuleServer(BaseServer):
 
         super().__init__(interceptors=all_interceptors or None)
         self.module_class = module_class
+        if client_config is None and EnvManager.services_mode() == ServicesMode.REMOTE:
+            client_config = EnvManager.client_config()
         self.client_config = client_config
         self.registry: RegistryStrategy | None = None
         self.module_servicer: ModuleServicer | None = None
@@ -93,9 +102,9 @@ class ModuleServer(BaseServer):
         dispatcher process, queue, or Redis stream for dispatch.
 
         Raises:
-            RuntimeError: If DIGITALKIN_REDIS_URL is not set.
+            RuntimeError: If DIGITALKIN_REDIS_URL resolves to an empty URL.
         """
-        redis_url = os.environ.get("DIGITALKIN_REDIS_URL")
+        redis_url = get_redis_settings().pool.url.get_secret_value()
         if not redis_url:
             msg = "DIGITALKIN_REDIS_URL is required. The gateway needs Redis for stream persistence."
             raise RuntimeError(msg)

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/grpc_servers/module_servicer.py

@@ -2,7 +2,6 @@
 
 import asyncio
 import json
-import os
 import time
 from argparse import ArgumentParser, Namespace
 from collections.abc import Awaitable, Callable
@@ -28,6 +27,7 @@ from digitalkin.models.module.module import ModuleCodeModel
 from digitalkin.models.module.setup_types import SetupModel
 from digitalkin.models.services.services import ServicesMode
 from digitalkin.models.settings.gateway import get_gateway_settings
+from digitalkin.models.settings.redis import get_redis_settings
 from digitalkin.models.settings.server.servicer import get_module_servicer_settings
 from digitalkin.modules._base_module import BaseModule
 from digitalkin.services.registry import GrpcRegistry, RegistryStrategy
@@ -37,6 +37,7 @@ from digitalkin.services.setup.setup_strategy import SetupStrategy, SetupVersion
 from digitalkin.services.user_profile import DefaultUserProfile, GrpcUserProfile, UserProfileStrategy
 from digitalkin.utils.arg_parser import ArgParser
 from digitalkin.utils.development_mode_action import DevelopmentModeMappingAction
+from digitalkin.utils.env_manager import EnvManager
 
 
 class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
@@ -55,9 +56,7 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
         parser.add_argument(
             "-d",
             "--dev-mode",
-            env_var="SERVICE_MODE",
             choices=ServicesMode.__members__,
-            default="local",
             action=DevelopmentModeMappingAction,
             dest="services_mode",
             help="Define Module Service configurations for endpoints",
@@ -70,13 +69,13 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
             module_class: The module type to serve.
 
         Raises:
-            RuntimeError: If DIGITALKIN_REDIS_URL is not set.
+            RuntimeError: If DIGITALKIN_REDIS_URL resolves to an empty URL.
         """
         super().__init__()
         module_class.discover()
         self.module_class = module_class
 
-        redis_url = os.environ.get("DIGITALKIN_REDIS_URL")
+        redis_url = get_redis_settings().pool.url.get_secret_value()
         if not redis_url:
             msg = "DIGITALKIN_REDIS_URL is required"
             raise RuntimeError(msg)
@@ -90,10 +89,7 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
         # Access-control client gating the setup cache. Always built, always called (fail-closed).
         if self.args.services_mode == ServicesMode.REMOTE:
             up_cfg = self.module_class.services_config_params.get("user_profile") or {}
-            up_client_config = up_cfg.get("client_config")
-            if not up_client_config:
-                msg = "user_profile client_config is required for setup access control"
-                raise RuntimeError(msg)
+            up_client_config = up_cfg.get("client_config") or EnvManager.client_config()
             self.user_profile = GrpcUserProfile("", "", "", up_client_config)
         else:
             self.user_profile = DefaultUserProfile("", "", "")

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/grpc_servers/utils/circuit_breaker.py

@@ -15,7 +15,7 @@ from typing import ClassVar
 from digitalkin.grpc_servers.exceptions import CircuitOpenError
 from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.circuit_breaker import CBState
-from digitalkin.models.settings.grpc_client import get_circuit_breaker_settings
+from digitalkin.models.settings.client.client import get_client_settings
 
 
 class CircuitBreaker:
@@ -45,7 +45,7 @@ class CircuitBreaker:
         """Get existing circuit breaker for a service or create one.
 
         Thresholds come from ``CircuitBreakerSettings`` (env
-        ``DIGITALKIN_CB_FAIL_MAX``, ``DIGITALKIN_CB_RESET_TIMEOUT``).
+        ``CLIENT_CIRCUIT_BREAKER_FAIL_MAX``, ``CLIENT_CIRCUIT_BREAKER_RESET_TIMEOUT``).
 
         Args:
             service_id: Service identifier.
@@ -54,7 +54,7 @@ class CircuitBreaker:
             Circuit breaker for this service.
         """
         if service_id not in cls._instances:
-            settings = get_circuit_breaker_settings()
+            settings = get_client_settings().circuit_breaker
             cls._instances[service_id] = cls(service_id, settings.fail_max, settings.reset_timeout)
         return cls._instances[service_id]
 

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/grpc_servers/utils/grpc_client_wrapper.py

@@ -21,7 +21,7 @@ from digitalkin.grpc_servers.interceptors.request_ids import RequestIdClientInte
 from digitalkin.grpc_servers.utils.circuit_breaker import CircuitBreaker
 from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.models import ClientConfig
-from digitalkin.models.settings.grpc_client import get_grpc_client_settings
+from digitalkin.models.settings.client.client import get_client_settings
 from digitalkin.models.settings.utils.channel import SecurityMode
 
 
@@ -240,7 +240,7 @@ class GrpcClientWrapper:
 
         Retries on transient errors (UNAVAILABLE, INTERNAL, DEADLINE_EXCEEDED)
         with exponential backoff. Retry count and backoff base are configurable
-        via DIGITALKIN_GRPC_QUERY_MAX_RETRIES and DIGITALKIN_GRPC_QUERY_BACKOFF_BASE_MS.
+        via CLIENT_MAX_RETRIES and CLIENT_BACKOFF_BASE_MS.
 
         Arguments:
             query_endpoint: rpc query name (e.g., "GetSetup", "CreateSetupVersion")
@@ -269,10 +269,10 @@ class GrpcClientWrapper:
             error_msg = f"[gRPC-client:{self.service_name}.{query_endpoint}] {e}"
             raise ServerError(error_msg) from e
 
-        grpc_settings = get_grpc_client_settings()
-        eff_timeout = timeout if timeout is not None else grpc_settings.timeout
-        max_retries = grpc_settings.max_retries
-        backoff_base_ms = grpc_settings.backoff_base_ms
+        client_settings = get_client_settings()
+        eff_timeout = timeout if timeout is not None else client_settings.timeout
+        max_retries = client_settings.max_retries
+        backoff_base_ms = client_settings.backoff_base_ms
         backoff_delays = tuple(backoff_base_ms / 1000 * (2**i) for i in range(max_retries))
         last_error: grpc.RpcError | None = None
 

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/mixins/filesystem_mixin.py

@@ -71,10 +71,10 @@ class FilesystemMixin:
                 )
             ])
         except Exception:
-            logger.exception("Failed to upload file '%s' (%s)", name, content_type)
+            logger.exception("Failed to upload file '%s' (%s)", name, content_type, extra=context.session.current_ids())
             return None
         if failed or not records:
-            logger.error("Upload rejected for file '%s' (%s)", name, content_type)
+            logger.error("Upload rejected for file '%s' (%s)", name, content_type, extra=context.session.current_ids())
             return None
         return records[0]
 
@@ -122,7 +122,7 @@ class FilesystemMixin:
         try:
             records, _total = await context.filesystem.get_files(filters, include_content=include_content)
         except Exception:
-            logger.exception("Failed to list files")
+            logger.exception("Failed to list files", extra=context.session.current_ids())
             return []
         return records
 
@@ -151,7 +151,7 @@ class FilesystemMixin:
                 permanent=permanent,
             )
         except Exception:
-            logger.exception("Failed to delete file '%s'", file_id)
+            logger.exception("Failed to delete file '%s'", file_id, extra=context.session.current_ids())
             return False
         return results.get(file_id, False)
 
@@ -181,7 +181,12 @@ class FilesystemMixin:
             try:
                 record = await context.filesystem.get_file(file.id, context=file_context, include_content=False)
             except Exception:
-                logger.warning("Could not resolve file '%s'; keeping it as submitted", file.id, exc_info=True)
+                logger.warning(
+                    "Could not resolve file '%s'; keeping it as submitted",
+                    file.id,
+                    exc_info=True,
+                    extra=context.session.current_ids(),
+                )
                 resolved.append(file)
                 continue
             resolved.append(

{digitalkin-1.0.4.dev6 → digitalkin-1.0.4.dev7}/src/digitalkin/models/grpc_servers/models.py

@@ -1,43 +1,15 @@
 """Data models for gRPC server configurations."""
 
-from enum import Enum
 from pathlib import Path
 from typing import Any
 
-import grpc
 from pydantic import BaseModel, Field, ValidationInfo, field_validator
 
 from digitalkin.grpc_servers.exceptions import ConfigurationError, SecurityError
-from digitalkin.models.settings.grpc_client import get_grpc_channel_settings, get_grpc_retry_settings
-from digitalkin.models.settings.utils.channel import ControlFlow, SecurityMode
+from digitalkin.models.settings.client.client import get_client_settings
+from digitalkin.models.settings.utils.channel import ControlFlow, GrpcCompression, SecurityMode
 
-
-class GrpcCompression(str, Enum):
-    """gRPC compression algorithm.
-
-    Attributes:
-        NONE: No compression
-        GZIP: Gzip compression
-        DEFLATE: Deflate compression
-    """
-
-    NONE = "none"
-    GZIP = "gzip"
-    DEFLATE = "deflate"
-
-    def to_grpc(self) -> grpc.Compression:
-        """Convert to grpc.Compression enum.
-
-        Returns:
-            The corresponding grpc.Compression value.
-        """
-        match self:
-            case GrpcCompression.NONE:
-                return grpc.Compression.NoCompression
-            case GrpcCompression.GZIP:
-                return grpc.Compression.Gzip
-            case GrpcCompression.DEFLATE:
-                return grpc.Compression.Deflate
+__all__ = ["ChannelConfig", "ClientConfig", "ClientCredentials", "GrpcCompression", "RetryPolicy"]
 
 
 class RetryPolicy(BaseModel):
@@ -82,9 +54,9 @@ class RetryPolicy(BaseModel):
         """Build a retry policy with backoff values sourced from the environment.
 
         Returns:
-            Retry policy populated from ``GrpcRetrySettings``.
+            Retry policy populated from ``GrpcClientRetrySettings``.
         """
-        settings = get_grpc_retry_settings()
+        settings = get_client_settings().retry
         return cls(
             max_attempts=settings.max_attempts,
             initial_backoff=settings.initial_backoff,
@@ -205,9 +177,13 @@ class ChannelConfig(BaseModel):
 class ClientConfig(ChannelConfig):
     """Base configuration for gRPC clients.
 
+    Every default is sourced from ``ClientSettings`` (env prefixes ``CLIENT_``,
+    ``CLIENT_CHANNEL_``, ``CLIENT_GRPC_``), so a deployment configures its
+    clients through the environment and only overrides per-target values here.
+
     Attributes:
-        host: Host address to bind the client to
-        port: Port to listen on
+        host: Host address the client dials
+        port: Port the client dials
         mode: Client operation mode (sync/async)
         security: Security mode (secure/insecure)
         credentials: Client credentials for secure mode
@@ -216,13 +192,28 @@ class ClientConfig(ChannelConfig):
         compression: gRPC compression algorithm for channel-level compression
     """
 
+    host: str = Field(
+        default_factory=lambda: get_client_settings().channel.host,
+        description="Host address the client dials",
+    )
+    port: int = Field(default_factory=lambda: get_client_settings().channel.port, description="Port the client dials")
+    mode: ControlFlow = Field(
+        default_factory=lambda: get_client_settings().channel.communication_mode,
+        description="Client operation mode (sync/async)",
+    )
+    security: SecurityMode = Field(
+        default_factory=lambda: get_client_settings().channel.security,
+        description="Security mode (secure/insecure)",
+    )
     credentials: ClientCredentials | None = Field(None, description="Client credentials for secure mode")
     retry_policy: RetryPolicy = Field(
         default_factory=RetryPolicy.from_settings, description="Retry policy for failed RPCs"
     )
-    compression: GrpcCompression = Field(GrpcCompression.GZIP, description="gRPC compression algorithm")
+    compression: GrpcCompression = Field(
+        default_factory=lambda: get_client_settings().grpc.compression, description="gRPC compression algorithm"
+    )
     channel_options: list[tuple[str, Any]] = Field(
-        default_factory=lambda: get_grpc_channel_settings().to_channel_options(),
+        default_factory=lambda: get_client_settings().grpc.options,
         description="Resilient gRPC channel options with DNS re-resolution, keepalive, and retries",
     )
 

digitalkin-1.0.4.dev7/src/digitalkin/models/settings/certificate.py

@@ -0,0 +1,90 @@
+"""TLS/mTLS certificate volume settings."""
+
+from functools import lru_cache
+from pathlib import Path
+
+from pydantic import Field
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+from digitalkin.grpc_servers.exceptions import SecurityError
+
+
+class CertificateSettings(BaseSettings):
+    """Directories holding the certificates a module serves and dials with.
+
+    Files follow the deployment convention: ``server.key`` / ``server.crt`` for
+    the module's own server, ``client.key`` / ``client.crt`` for its outgoing
+    calls, and ``ca.crt`` for the root of trust in both directories.
+
+    Attributes:
+        cert_volume (Path): Directory holding the module's server certificates.
+        services_provider_cert_volume (Path): Directory holding the client certificates
+            used to dial the services provider.
+
+    """
+
+    model_config = SettingsConfigDict(env_prefix="CERTIFICATE_", case_sensitive=False)
+
+    cert_volume: Path = Field(
+        default=Path("/certificates"),
+        description="Directory where the module's own server certificates are stored",
+    )
+    services_provider_cert_volume: Path = Field(
+        default=Path("/certificates"),
+        description="Directory where the services-provider client certificates are stored",
+    )
+
+    def get_server_certificate_paths(self, *, mtls: bool = False) -> tuple[Path, Path, Path | None]:
+        """Resolve the module server's key, certificate and root CA.
+
+        Args:
+            mtls: Return the CA certificate so incoming clients can be authenticated.
+
+        Returns:
+            Tuple of (server key, server certificate, root CA or None).
+
+        Raises:
+            SecurityError: If the server key or certificate is missing.
+        """
+        key_path = self.cert_volume / "server.key"
+        cert_path = self.cert_volume / "server.crt"
+        if not key_path.exists() or not cert_path.exists():
+            msg = f"Server key or certificate not found in {self.cert_volume}"
+            raise SecurityError(msg)
+        ca_path = self.cert_volume / "ca.crt"
+        return key_path, cert_path, (ca_path if mtls and ca_path.exists() else None)
+
+    def get_client_certificate_paths(self, *, mtls: bool = False) -> tuple[Path | None, Path | None, Path]:
+        """Resolve the client key, certificate and root CA used to dial the services provider.
+
+        Args:
+            mtls: Return the client key and certificate so the module can present them.
+
+        Returns:
+            Tuple of (client key or None, client certificate or None, root CA).
+
+        Raises:
+            SecurityError: If a required file is missing.
+        """
+        key_path = self.services_provider_cert_volume / "client.key"
+        cert_path = self.services_provider_cert_volume / "client.crt"
+        ca_path = self.services_provider_cert_volume / "ca.crt"
+        if mtls and (not key_path.exists() or not cert_path.exists()):
+            msg = f"Missing client.key or client.crt in {self.services_provider_cert_volume}"
+            raise SecurityError(msg)
+        if not ca_path.exists():
+            msg = f"Missing ca.crt in {self.services_provider_cert_volume}"
+            raise SecurityError(msg)
+        return (key_path if mtls else None, cert_path if mtls else None, ca_path)
+
+
+@lru_cache(maxsize=1)
+def get_certificate_settings() -> CertificateSettings:
+    """Process-wide ``CertificateSettings`` singleton.
+
+    Tests must call ``get_certificate_settings.cache_clear()`` after mutating env.
+
+    Returns:
+        The shared ``CertificateSettings`` instance.
+    """
+    return CertificateSettings()

digitalkin-1.0.4.dev7/src/digitalkin/models/settings/client/__init__.py

@@ -0,0 +1 @@
+"""Package for client settings."""

digitalkin-1.0.4.dev7/src/digitalkin/models/settings/client/channel.py

@@ -0,0 +1,68 @@
+"""Client channel settings."""
+
+from functools import lru_cache
+
+from pydantic import Field, NonNegativeInt, model_validator
+from pydantic_settings import SettingsConfigDict
+
+from digitalkin.models.settings.utils.channel import BaseChannelSettings
+
+
+class ClientChannelSettings(BaseChannelSettings):
+    """Settings for a client channel.
+
+    Overrides the bind-oriented defaults of ``BaseChannelSettings`` with dial
+    defaults: a client connects to a remote address instead of listening on
+    every interface.
+
+    Attributes:
+        host (str): Host address the client dials.
+        port (NonNegativeInt): Port the client dials.
+
+    """
+
+    model_config = SettingsConfigDict(
+        env_prefix="CLIENT_CHANNEL_",
+        env_nested_delimiter="__",
+        extra="forbid",
+        arbitrary_types_allowed=True,
+        validate_assignment=True,
+    )
+
+    host: str = Field(
+        default="[::]",
+        description="Host address the client dials (the services provider)",
+        json_schema_extra={"env_required": True},
+    )
+
+    port: NonNegativeInt = Field(
+        default=50051,
+        description="Port the client dials (the services provider)",
+        json_schema_extra={"env_required": True},
+    )
+
+    @model_validator(mode="after")
+    def validate_credentials(self) -> "ClientChannelSettings":
+        """Accept secure mode without explicit credential paths.
+
+        Unlike the server, a client falls back to the ``CERTIFICATE_`` volume:
+        ``EnvManager.client_config`` resolves the pair there and raises
+        ``SecurityError`` when the root CA is missing, so secure mode still
+        fails closed.
+
+        Returns:
+            The validated settings.
+        """
+        return self
+
+
+@lru_cache(maxsize=1)
+def get_client_channel_settings() -> ClientChannelSettings:
+    """Process-wide ``ClientChannelSettings`` singleton.
+
+    Tests must call ``get_client_channel_settings.cache_clear()`` after mutating env.
+
+    Returns:
+        The shared ``ClientChannelSettings`` instance.
+    """
+    return ClientChannelSettings()

digitalkin-1.0.4.dev7/src/digitalkin/models/settings/client/circuit_breaker.py

@@ -0,0 +1,19 @@
+"""Client circuit-breaker settings."""
+
+from pydantic import Field
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class CircuitBreakerSettings(BaseSettings):
+    """Per-service circuit-breaker thresholds.
+
+    Attributes:
+        fail_max (int): Consecutive failures before the circuit opens.
+        reset_timeout (float): Seconds the circuit stays open before a half-open probe.
+
+    """
+
+    model_config = SettingsConfigDict(env_prefix="CLIENT_CIRCUIT_BREAKER_", case_sensitive=False)
+
+    fail_max: int = Field(default=5, description="Consecutive failures before the circuit opens.")
+    reset_timeout: float = Field(default=30.0, description="Seconds the circuit stays open before a half-open probe.")