docs(connectrpc): document the ConnectRPC adapter module

Add the connectrpc/ module to the workspace layout tables, the
dependency policy, the README module list, the CHANGELOG, and the OTel
span catalog (connectrpcsec.Authenticate / connectrpcsec.Authorize).

grpc/go.mod picks up the workspace-aligned google.golang.org/protobuf
v1.36.11 via go work sync.

Author: euskadi31

CHANGELOG.md

@@ -30,6 +30,10 @@ legacy packages (`authentication/`, `authorization/`, the in-tree
 - **gRPC adapter** (`grpcsec`): unary and stream server interceptors,
   `UnaryAuthorize`/`StreamAuthorize`, a `metadata.MD` carrier, and an
   `ErrorMapper` to `codes.Code`.
+- **ConnectRPC adapter** (`connectrpcsec`): `NewAuthenticationInterceptor`
+  and `NewAuthorizationInterceptor` returning `connect.Interceptor` values
+  (unary + streaming), an `http.Header` carrier, and an `ErrorMapper` to
+  `connect.Code`.
 - **Schemes**: `basic` (HTTP Basic extractor + authenticator) and `bearer`
   (Bearer extractor + pluggable `TokenVerifier`).
 - **Password hashing** (`password`): `Hasher` interface with bcrypt and
@@ -56,7 +60,7 @@ legacy packages (`authentication/`, `authorization/`, the in-tree
   rotation, a `Manager` (Login/Get/Touch/Rotate/Logout), and a
   synchronizer-token CSRF helper.
 - **Observability**: OpenTelemetry spans emitted directly by the core,
-  `httpsec`, `grpcsec`, `jwtsec`, and `session`. See
+  `httpsec`, `grpcsec`, `connectrpcsec`, `jwtsec`, and `session`. See
   [docs/observability.md](docs/observability.md).
 - **Documentation**: `docs/architecture.md`, `docs/observability.md`,
   `docs/security-considerations.md`, `docs/migration-from-v0.md`, and a

CLAUDE.md

@@ -84,6 +84,7 @@ is intentionally skipped in CI.
 | `.`                       | `security`                                 | Core transport-agnostic primitives                   |
 | `./http`                  | `.../http` → `httpsec`                     | `net/http` adapter (middleware, `Authorize`, carrier) |
 | `./grpc`                  | `.../grpc` → `grpcsec`                      | gRPC unary/stream interceptors + `Authorize`         |
+| `./connectrpc`            | `.../connectrpc` → `connectrpcsec`          | ConnectRPC auth + authorize interceptors             |
 | `./basic`                 | `.../basic`                                | HTTP Basic extractor + authenticator                 |
 | `./bearer`                | `.../bearer`                               | Bearer extractor + `TokenVerifier` authenticator     |
 | `./password`              | `.../password`                             | BCrypt + Argon2id hashers (`NeedsRehash`)            |
@@ -93,7 +94,7 @@ is intentionally skipped in CI.
 | `./oauth2/storage/memory` | `.../oauth2/storage/memory`                | In-memory `oauth2.Storage` — **package of `oauth2`** |
 | `./oauth2/store/sql`      | `.../oauth2/store/sql`                      | Production storage on `database/sql` (PG/MySQL/SQLite) |
 | `./oauth2/store/redis`    | `.../oauth2/store/redis`                    | Production storage on Redis (Lua atomicity)          |
-| `./examples`              | `.../examples`                             | Runnable demos: basic-http, bearer-jwt, grpc-bearer, session-web, oauth2 |
+| `./examples`              | `.../examples`                             | Runnable demos: basic-http, bearer-jwt, grpc-bearer, connectrpc-bearer, session-web, oauth2 |
 | `./internal/integrations` | (private)                                  | Cross-module end-to-end tests                        |
 
 `oauth2/storage/memory` is **not** a standalone module — it is a sub-package
@@ -102,8 +103,8 @@ of `oauth2`. The other rows are independent modules (own `go.mod`).
 **The dependency direction is a hard rule** (enforced by review, see
 `MIGRATION.md`): the **core (`.`) must depend only on stdlib +
 `go.opentelemetry.io/otel`** (+ `testify` in its own tests). It MUST NOT
-import gRPC, JOSE/JWT libs, OAuth2, Redis, SQL drivers, HTTP routers, or
-concrete loggers. Adapters depend on the core, never the reverse. The
+import gRPC, ConnectRPC, JOSE/JWT libs, OAuth2, Redis, SQL drivers, HTTP
+routers, or concrete loggers. Adapters depend on the core, never the reverse. The
 `oauth2` module has **no hard dependency on `jwt`** — JWT access tokens are
 wired via an adapter (`jwt` depends on `oauth2`, not the other way). When
 adding code, check the allowed-dependency list in `MIGRATION.md` before
@@ -163,7 +164,7 @@ Conventions baked into the core:
 - **OTel spans live directly in each module** — there is intentionally no
   `EventSink` abstraction and no separate `otel/` module. The core uses
   scope `github.com/hyperscale-stack/security`; each instrumented module
-  (`httpsec`, `grpcsec`, `jwtsec`, `session`) uses its own. See
+  (`httpsec`, `grpcsec`, `connectrpcsec`, `jwtsec`, `session`) uses its own. See
   `docs/observability.md` for the span catalog.
 
 ## OAuth2 server (`oauth2/`)
@@ -187,8 +188,8 @@ configurable via `ServerConfig.RoutePrefix`).
   the shared `oauth2/storetest` conformance suite.
 
 `examples/oauth2/main.go` is the canonical wiring example for the v2 stack;
-`examples/` also has `basic-http`, `bearer-jwt`, `grpc-bearer`, and
-`session-web` demos.
+`examples/` also has `basic-http`, `bearer-jwt`, `grpc-bearer`,
+`connectrpc-bearer`, and `session-web` demos.
 
 ## Tooling caveats
 

MIGRATION.md

@@ -12,6 +12,7 @@ released on its own cadence.
 | `.`                       | `github.com/hyperscale-stack/security`                          | Core: transport-agnostic primitives (Authentication, Engine, Voter…) |
 | `./http`                  | `github.com/hyperscale-stack/security/http`                     | `httpsec` — `net/http` adapter                                       |
 | `./grpc`                  | `github.com/hyperscale-stack/security/grpc`                     | `grpcsec` — gRPC unary/stream interceptors                           |
+| `./connectrpc`            | `github.com/hyperscale-stack/security/connectrpc`               | `connectrpcsec` — ConnectRPC auth + authorize interceptors           |
 | `./basic`                 | `github.com/hyperscale-stack/security/basic`                    | HTTP Basic extractor + authenticator                                 |
 | `./bearer`                | `github.com/hyperscale-stack/security/bearer`                   | Bearer extractor + `TokenVerifier`-based authenticator               |
 | `./password`              | `github.com/hyperscale-stack/security/password`                 | BCrypt + Argon2id hashers                                            |
@@ -39,6 +40,7 @@ own tests).
 core (.)                ← stdlib + go.opentelemetry.io/otel
 http/                   ← core + otel
 grpc/                   ← core + otel + google.golang.org/grpc
+connectrpc/             ← core + otel + connectrpc.com/connect
 basic/                  ← core + password
 bearer/                 ← core
 password/               ← golang.org/x/crypto
@@ -52,8 +54,8 @@ examples/               ← may depend on every module above
 (`oauth2/storage/memory` is a sub-package of the `oauth2` module.)
 ```
 
-The core MUST NOT depend on: gRPC, JWT/JOSE libs, OAuth2, Redis, SQL drivers,
-HTTP routers, or concrete loggers. Its direct dependency set is exactly
+The core MUST NOT depend on: gRPC, ConnectRPC, JWT/JOSE libs, OAuth2, Redis,
+SQL drivers, HTTP routers, or concrete loggers. Its direct dependency set is exactly
 stdlib + `go.opentelemetry.io/otel` (+ `stretchr/testify` scoped to its own
 tests). The policy is enforced by review.
 

README.md

@@ -8,9 +8,9 @@ Hyperscale security [![Last release](https://img.shields.io/github/release/hyper
 | master  | [![Build Status](https://github.com/hyperscale-stack/security/workflows/Go/badge.svg?branch=master)](https://github.com/hyperscale-stack/security/actions?query=workflow%3AGo) | [![Coveralls](https://img.shields.io/coveralls/hyperscale-stack/security/master.svg)](https://coveralls.io/github/hyperscale-stack/security?branch=master) |
 
 A transport-agnostic authentication and authorization toolkit for Go —
-HTTP and gRPC, OAuth2, JWT, sessions, and a composable Voter-based access
-model. It is shipped as a multi-module workspace so you import only what
-you need.
+HTTP, gRPC and ConnectRPC, OAuth2, JWT, sessions, and a composable
+Voter-based access model. It is shipped as a multi-module workspace so you
+import only what you need.
 
 ## Modules
 
@@ -19,6 +19,7 @@ you need.
 | `github.com/hyperscale-stack/security`              | Core: `Authentication`, `Engine`, `Manager`, `Voter`, ADM       |
 | `…/security/http`                                   | `httpsec` — `net/http` middleware + authorization               |
 | `…/security/grpc`                                   | `grpcsec` — unary/stream interceptors                           |
+| `…/security/connectrpc`                             | `connectrpcsec` — ConnectRPC auth + authorize interceptors      |
 | `…/security/basic`                                  | HTTP Basic extractor + authenticator                            |
 | `…/security/bearer`                                 | Bearer extractor + `TokenVerifier` authenticator                |
 | `…/security/password`                               | BCrypt + Argon2id hashers (`NeedsRehash`)                       |

docs/architecture.md

@@ -9,7 +9,7 @@ transitive dependencies.
 ## Design goals
 
 - **Transport-agnostic core.** The authentication pipeline knows nothing
-  about `net/http` or gRPC. Transports are thin adapters.
+  about `net/http`, gRPC, or ConnectRPC. Transports are thin adapters.
 - **Small, immutable interfaces.** `Authentication` is read-only; state
   changes produce new values. No mutable `interface{}` credential bag.
 - **Composable authorization.** A Voter / `AccessDecisionManager` model
@@ -26,6 +26,7 @@ transitive dependencies.
 | `.`                       | `github.com/hyperscale-stack/security`                       | Core: `Authentication`, `Engine`, `Manager`, `Voter`, `AccessDecisionManager` |
 | `./http`                  | `…/security/http`                                            | `httpsec` — `net/http` middleware + carrier                          |
 | `./grpc`                  | `…/security/grpc`                                            | `grpcsec` — unary/stream interceptors + carrier                      |
+| `./connectrpc`            | `…/security/connectrpc`                                      | `connectrpcsec` — ConnectRPC auth + authorize interceptors           |
 | `./basic`                 | `…/security/basic`                                           | HTTP Basic extractor + authenticator                                 |
 | `./bearer`                | `…/security/bearer`                                          | Bearer extractor + `TokenVerifier`-based authenticator               |
 | `./password`              | `…/security/password`                                        | BCrypt + Argon2id hashers (`NeedsRehash`)                            |
@@ -46,6 +47,7 @@ separate module) — it ships an in-memory `oauth2.Storage` for dev and tests.
 core (.)                ← stdlib + go.opentelemetry.io/otel
 http/                   ← core + otel
 grpc/                   ← core + otel + google.golang.org/grpc
+connectrpc/             ← core + otel + connectrpc.com/connect
 basic/                  ← core + password
 bearer/                 ← core
 password/               ← golang.org/x/crypto
@@ -57,9 +59,9 @@ oauth2/store/redis/     ← oauth2 + github.com/redis/go-redis/v9
 examples/               ← may depend on every module above
 ```
 
-The core MUST NOT depend on gRPC, JOSE libraries, OAuth2, Redis, SQL
-drivers, HTTP routers, or concrete loggers. This boundary is what keeps the
-core importable from any transport.
+The core MUST NOT depend on gRPC, ConnectRPC, JOSE libraries, OAuth2,
+Redis, SQL drivers, HTTP routers, or concrete loggers. This boundary is
+what keeps the core importable from any transport.
 
 ## The authentication pipeline
 
@@ -80,7 +82,8 @@ Carrier ──▶ Extractor ──▶ Authentication (pending)
 
 - **`Carrier`** abstracts a transport message — read credentials, write
   challenges. `httpsec.Carrier` wraps `*http.Request`/`http.ResponseWriter`;
-  `grpcsec.Carrier` wraps `metadata.MD`.
+  `grpcsec.Carrier` wraps `metadata.MD`; `connectrpcsec.Carrier` wraps
+  `http.Header`.
 - **`Extractor`** pulls raw, unauthenticated credentials from a `Carrier`.
   Returns `(nil, nil)` when its scheme is absent.
 - **`Authenticator`** validates a pending `Authentication` and returns an
@@ -128,6 +131,10 @@ and a `Carrier`, then map security errors to transport responses.
 - **`grpcsec`** — `UnaryServerInterceptor` / `StreamServerInterceptor`
   authenticate every RPC; `UnaryAuthorize` / `StreamAuthorize` enforce an
   ADM. `ErrorMapper` turns sentinels into `codes.Code`.
+- **`connectrpcsec`** — `NewAuthenticationInterceptor` authenticates every
+  RPC; `NewAuthorizationInterceptor` enforces an ADM. Both return a
+  `connect.Interceptor` covering unary and streaming. `ErrorMapper` turns
+  sentinels into `connect.Code`.
 
 ## OAuth2
 

docs/observability.md

@@ -10,13 +10,14 @@ application; the library uses the global provider via `otel.Tracer`.
 
 Each module reports under a stable instrumentation scope (the tracer name):
 
-| Module    | Instrumentation scope                          |
-| --------- | ---------------------------------------------- |
-| core      | `github.com/hyperscale-stack/security`         |
-| `httpsec` | `github.com/hyperscale-stack/security/http`    |
-| `grpcsec` | `github.com/hyperscale-stack/security/grpc`    |
-| `jwtsec`  | `github.com/hyperscale-stack/security/jwt`     |
-| `session` | `github.com/hyperscale-stack/security/session` |
+| Module          | Instrumentation scope                             |
+| --------------- | ------------------------------------------------- |
+| core            | `github.com/hyperscale-stack/security`            |
+| `httpsec`       | `github.com/hyperscale-stack/security/http`       |
+| `grpcsec`       | `github.com/hyperscale-stack/security/grpc`       |
+| `connectrpcsec` | `github.com/hyperscale-stack/security/connectrpc` |
+| `jwtsec`        | `github.com/hyperscale-stack/security/jwt`        |
+| `session`       | `github.com/hyperscale-stack/security/session`    |
 
 The `basic`, `bearer`, `password` and `oauth2` modules do not open spans of
 their own — keeping them free of a direct `go.opentelemetry.io/otel`
@@ -60,6 +61,16 @@ it delegates to `security.AccessDecisionManager.Decide`.
 `grpcsec` deliberately does **not** open an `rpc` span — that belongs to
 `otelgrpc`, which you compose alongside these interceptors.
 
+### ConnectRPC — `github.com/hyperscale-stack/security/connectrpc`
+
+| Span                         | When                                       | Attributes                                                          | Error status            |
+| ---------------------------- | ------------------------------------------ | -------------------------------------------------------------------- | ----------------------- |
+| `connectrpcsec.Authenticate` | Per RPC, unary and streaming interceptors  | `rpc.method` (string), `security.authenticated` (bool)               | inherited from the core |
+| `connectrpcsec.Authorize`    | The authorization interceptor              | none directly — delegates to `security.AccessDecisionManager.Decide` | inherited from the core |
+
+`connectrpcsec` deliberately does **not** open an `rpc` span — that belongs
+to `otelconnect`, which you compose alongside these interceptors.
+
 ### JWT — `github.com/hyperscale-stack/security/jwt`
 
 | Span                  | When               | Attributes                                              | Error status                                                        |

grpc/go.mod

@@ -23,7 +23,7 @@ require (
 	golang.org/x/sys v0.44.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
-	google.golang.org/protobuf v1.36.1 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 

grpc/go.sum

@@ -45,8 +45,7 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8/go.mod h1:lcTa1sDdWEIHMWlITnIczmw5w60CF9ffkb8Z+DVmmjA=
 google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
 google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
-google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=